CardOS MCP Server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CARDOS_API_KEY | Yes | Your CardOS API key | |
| CARDOS_BASE_URL | No | Override the API base URL | https://cardos.dev/api/v1 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_productsA | List available card products: productCode, currency, issue/topup limits, and whether KYC is required. |
| get_merchant_ratesA | Per-merchant pricing for products (e.g. for github, google). |
| get_balanceA | Get an end user's available balance. |
| issue_cardA | 💳 Issue a virtual card to an end user. Money operation — a test key runs in sandbox (no real money). Idempotent: retries do not double-issue. |
| get_cardA | Masked card details (last4, expiry, status). Raw PAN/CVV are never returned here — use reveal_card. |
| freeze_cardB | Freeze a card (reversible). Idempotent. |
| unfreeze_cardA | Unfreeze a frozen card. Idempotent. |
| close_cardA | Close a card permanently (irreversible). Idempotent. |
| set_card_pinA | Set a 4-digit PIN. The PIN is not stored by CardOS. |
| set_card_controlsA | Set soft spend controls (per-transaction / daily / monthly limits, blocked MCC/countries). On breach the card is auto-frozen + an alert is sent (no hard auth-time block). |
| reveal_cardA | Mint a one-time hosted link that shows full card details (PAN/CVV) to the end user, bypassing you (PCI on CardOS). Short-lived, single-use. |
| create_card_sessionA | Mint hosted card screens (manage + transactions) on real data, to open in a webview for the end user — bypassing you. Returns manage_url / transactions_url. |
| list_card_transactionsA | List transactions for a card (amount, currency, commission, FX original amount/currency, merchant, MCC, decline reason, status). |
| create_depositC | Create a crypto deposit invoice to top up an end-user balance. Money operation — sandbox with a test key. Idempotent. |
| confirm_deposit_sandboxA | [SANDBOX] Simulate confirmation of a pending deposit (test key only). In live, an on-chain watcher credits it. |
| simulate_transaction_sandboxA | [SANDBOX] Inject a test card transaction (test key only) to exercise webhooks, analytics, controls and cashback. |
| get_statementA | An end user's statement (summary: spent/received/fees/holds + line items + balance). |
| get_spending_analyticsC | Spending breakdown by category (from MCC) for an end user. |
| file_disputeC | Open a dispute on a transaction. |
| list_disputesC | List disputes, optionally filtered by user or status. |
| get_disputeC | Get one dispute by id. |
| update_disputeC | Update a dispute (status / note / provider reference). |
| start_kycA | Start KYC for an end user. Returns a hosted url_for_user and a uuid to poll. |
| get_kyc_statusC | Status of a KYC session by uuid. |
| register_webhookA | Register an HTTPS endpoint for outbound events (transaction, balance, issued, card_status, kyc). Returns the signing secret once. |
| list_webhooksA | List registered webhook endpoints (no secrets). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| issue_card_for_user | Guide the assistant through issuing a virtual card for an end user, end to end. |
| integrate_cardos | Walk through integrating CardOS into an app from scratch. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| CardOS developer guide | Auth, idempotency, webhooks and links — quick orientation for an agent. |
| CardOS OpenAPI specification | The full OpenAPI 3 spec (YAML) for the CardOS Tenant API. |
TDQS
Scored across 26 tools
Each tool targets a distinct operation on a specific resource (e.g., card, deposit, dispute, KYC, webhook). No two tools have overlapping purposes; descriptions clearly differentiate them.
All tool names follow a consistent verb_noun pattern using snake_case. The naming convention is uniform across the entire set, making it predictable and easy to navigate.
With 26 tools, the count is slightly above the typical 3-15 range, but the breadth of card operations (issuing, management, disputes, KYC, webhooks) justifies the number. It is still reasonable and not overly bloated.
The tool surface covers the full lifecycle of card management, deposits, disputes, KYC, webhooks, and analytics. Essential CRUD operations are present, and sandbox tools support testing. Missing operations are minor and non-critical.