Skip to main content
Glama

paypay-mcp

npm version npm downloads MCP Badge License: MIT

Model Context Protocol server for the PayPay Open Payment API.

Works with Claude Desktop, Claude Code, Cursor, Windsurf, Zed, ChatGPT Apps SDK, and any other MCP-compatible client. Tool descriptions are provided in English and Japanese.

Status

v0.2.x — production-capable, not yet battle-tested at scale.

The server runs cleanly against PayPay's production Open Payment API once PAYPAY_ENV=production is set with approved merchant credentials. It has not yet processed meaningful real-world volume. If you are routing real payments through it, pin the version and review the source first.

Related MCP server: paymongo-mcp

Tools

Tool

Description

create_qr_code

Create a dynamic PayPay QR code. Returns the payment URL, deeplink, and a rendered PNG.

get_payment_details

Fetch the current status of a payment.

wait_for_payment

Poll until a payment reaches a terminal state.

delete_qr_code

Invalidate a QR code before payment.

refund_payment

Full or partial refund. Disabled unless PAYPAY_ENABLE_REFUNDS=true.

cancel_payment

Cancel a payment when its state is unclear (timeout or error). Disabled unless PAYPAY_ENABLE_CANCELS=true.

Prompts

accept_single_payment, refund_last_payment, debug_stuck_payment.

Resources

URI

Description

paypay://docs/opa-reference

Endpoint map, auth scheme, and status vocabulary for the PayPay OPA API.

paypay://docs/payment-states

Payment lifecycle and the cancel-vs-refund decision rule.

paypay://config/current

Non-secret view of the active config (env, merchantId, baseUrl, transport).

Install

One-click:

Install in Cursor Install in VS Code

Or via npm:

npm install -g paypay-mcp

Configuration

Credentials come from the PayPay Developer Dashboard.

Variable

Required

Description

PAYPAY_API_KEY

yes

OPA API Key ID

PAYPAY_API_SECRET

yes

OPA API Key Secret

PAYPAY_MERCHANT_ID

yes

Merchant ID

PAYPAY_ENV

no

sandbox (default) or production

PAYPAY_ENABLE_REFUNDS

no

Set to true to expose refund_payment. Disabled by default.

PAYPAY_ENABLE_CANCELS

no

Set to true to expose cancel_payment. Disabled by default.

MCP_TRANSPORT

no

stdio (default) or http

MCP_HTTP_PORT

no

Port when MCP_TRANSPORT=http. Default 3000.

MCP_HTTP_HOST

no

Bind address. Default 127.0.0.1. Public binds require MCP_AUTH_TOKEN.

MCP_AUTH_TOKEN

no

Bearer token required on inbound HTTP requests when set. Mandatory for non-loopback binds.

MCP_HTTP_ALLOWED_ORIGINS

no

Comma-separated CORS allowlist. Default: none.

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "paypay": {
      "command": "npx",
      "args": ["-y", "paypay-mcp"],
      "env": {
        "PAYPAY_API_KEY": "a_...",
        "PAYPAY_API_SECRET": "...",
        "PAYPAY_MERCHANT_ID": "...",
        "PAYPAY_ENV": "sandbox"
      }
    }
  }
}

Claude Code

claude mcp add paypay -e PAYPAY_API_KEY=... -e PAYPAY_API_SECRET=... -e PAYPAY_MERCHANT_ID=... -- npx -y paypay-mcp

Cursor

Add to ~/.cursor/mcp.json with the same shape as Claude Desktop.

Remote hosting

Run in HTTP mode. Public binds require MCP_AUTH_TOKEN; the server refuses to start otherwise.

MCP_TRANSPORT=http \
  MCP_HTTP_HOST=0.0.0.0 \
  MCP_AUTH_TOKEN="$(openssl rand -hex 32)" \
  MCP_HTTP_ALLOWED_ORIGINS="https://claude.ai,https://your-app.example.com" \
  PAYPAY_ENV=sandbox \
  PAYPAY_API_KEY=... PAYPAY_API_SECRET=... PAYPAY_MERCHANT_ID=... \
  npx paypay-mcp

Endpoint: POST http(s)://<host>:3000/mcp (Streamable HTTP transport). Clients send Authorization: Bearer <MCP_AUTH_TOKEN>. CORS is closed by default.

For local testing the auth token can be omitted; the server binds to 127.0.0.1 and only accepts loopback connections.

Environments

Sandbox is the default. Production requires PayPay merchant onboarding (business verification and a contract) and must be enabled by explicitly setting PAYPAY_ENV=production.

Constraints

  • Amounts are integer JPY.

  • A payment can be canceled until 00:14:59 JST the day after the payment attempt. After that, use a refund.

  • A single order can receive multiple partial refunds, each with a unique merchantRefundId, up to the merchant-configured cap.

  • TLS 1.2+ required (Node 20+).

Development

git clone https://github.com/mrslbt/paypay-mcp.git
cd paypay-mcp
npm install
cp .env.example .env
npm run dev
npm test
npm run smoke
npm run build

Roadmap

v0.2: PreAuth + Capture, ContinuousPayments, DirectDebit, AccountLink QR, webhook signature verification, reconciliation tools.

v0.3: Native Payment (App Invoke + user JWT auth), Visa-partnership endpoints, OpenTelemetry tracing.

Safety

This server can move real money through the PayPay OPA API. Key safeguards:

  • Refund and cancel tools are disabled by default. refund_payment and cancel_payment are only registered when PAYPAY_ENABLE_REFUNDS=true or PAYPAY_ENABLE_CANCELS=true. Only enable them in trusted agent contexts where tool inputs cannot be influenced by untrusted content.

  • Sandbox is the default. Production requires an explicit PAYPAY_ENV=production, plus completed PayPay merchant onboarding. Always test against sandbox first.

  • Unique merchantPaymentId and merchantRefundId per call. PayPay deduplicates by these IDs, so reusing one will either fail or target an older payment. Generate a fresh ID for each new payment or refund.

  • Tools carry MCP safety annotations. Read-only tools (get_payment_details, wait_for_payment) are flagged readOnlyHint; money-moving and destructive tools (refund_payment, cancel_payment, delete_qr_code) are flagged destructiveHint so compatible clients can warn you before the call. These are advisory hints — the real guard is the gating above.

Even with these gates on, review any money-moving request before approving the tool call. Treat tool inputs derived from model output as untrusted.

Disclaimer

This is an unofficial, community-built MCP server. Not affiliated with, endorsed by, or sponsored by PayPay Corporation. PayPay is a registered trademark of its respective owners. Use at your own risk. The author accepts no liability for funds lost through misuse, prompt injection, or bugs.

License

MIT

Available Tools

4 tools
create_qr_codeCreate PayPay QR CodeA

Create a dynamic PayPay QR code that a customer can scan to pay. Returns the QR code both as a URL (deeplink + hosted image) and as an inline PNG image. Use wait_for_payment to poll until the customer completes the payment.

顧客がスキャンして支払うためのPayPay動的QRコードを作成します。 QRコードのURL(ディープリンクとホストされた画像)とインラインPNG画像の両方を返します。 顧客が支払いを完了するまで wait_for_payment でポーリングしてください。

ParametersJSON Schema
NameRequiredDescriptionDefault
amountYesAmount in JPY (integer, no decimals). 金額(円、整数)。
code_typeNoQR code type. Currently only ORDER_QR is supported.ORDER_QR
order_itemsNoOptional line-item breakdown shown in the PayPay app. 商品明細(任意)。
redirect_urlNoWhere to send the user after they complete payment in the PayPay app.
redirect_typeNoHow the redirect should open: browser (WEB_LINK) or app (APP_DEEP_LINK).
is_authorizationNoIf true, this is a pre-auth (hold funds now, capture later). 事前承認(preauth)フラグ。
order_descriptionYesWhat the customer is paying for. 注文内容。
merchant_payment_idNoUnique ID for this payment. Auto-generated (UUID) if omitted. Reusing an ID for a different order will fail. 注文ごとの一意のID。省略時は自動生成。

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses that the QR code is dynamic, that the result is returned both as a URL (deeplink + hosted image) and as an inline PNG, and that the caller must poll with wait_for_payment. This adds useful behavioral context beyond the simple readOnly/idempotent/destructive flags and does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The English description is concise and front-loaded: purpose, return format, and follow-up action in three sentences. The Japanese translation is redundant for an AI agent and doubles the length, but it is placed after the English and does not obscure the key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description does a good job of stating what is returned (URL and inline PNG) and what the caller should do next (poll with wait_for_payment). Combined with the fully documented input schema, this covers the essential workflow, though it omits details like error conditions or QR expiration.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already explains amount, order_description, redirect_url, merchant_payment_id, and other fields in detail. The tool description adds no parameter-level meaning, so the baseline of 3 is appropriate; the schema carries the parameter documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Create a dynamic PayPay QR code that a customer can scan to pay.' It clearly identifies the tool's function and distinguishes it from the sibling tools (get_payment_details, delete_qr_code, wait_for_payment) by framing it as the creation step, not a lookup, deletion, or polling operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit follow-up guidance: 'Use wait_for_payment to poll until the customer completes the payment.' This tells the agent what to do after calling this tool. It does not explicitly contrast with get_payment_details or delete_qr_code, but the creation-oriented wording makes the appropriate context clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_qr_codeDelete PayPay QR CodeA
DestructiveIdempotent

Invalidate a QR code before it is paid. Cannot be used after payment has completed. Use this when an order is canceled before checkout, or to clean up expired codes.

支払い前のQRコードを無効化します。決済完了後は使用できません。 注文がキャンセルされた場合や、期限切れのコードを整理する際に使用してください。

ParametersJSON Schema
NameRequiredDescriptionDefault
code_idYesThe codeId returned from create_qr_code (NOT the merchantPaymentId). create_qr_codeで返されたcodeId。

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry destructiveHint=true, readOnlyHint=false, and idempotentHint=true. The description adds valuable behavioral context by stating the invalidation happens only before payment and cannot be used afterward. This goes beyond the structured annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core behavior and includes a clear use-case sentence. The Japanese translation doubles the length, but it is intentional localization rather than filler, so the structure remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with rich annotations and no output schema, the description covers the essential operational context: purpose, timing constraint, and when to use it. It does not describe error behavior or return values, but those are less critical for this simple invalidation operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the code_id property is already documented as "The codeId returned from create_qr_code (NOT the merchantPaymentId)." The tool description itself adds no additional parameter-level meaning, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: "Invalidate a QR code before it is paid." It clearly defines the tool's scope and distinguishes it from siblings by emphasizing the pre-payment invalidation purpose, which separates it from create_qr_code, get_payment_details, and wait_for_payment.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: "Use this when an order is canceled before checkout, or to clean up expired codes." It also states a clear exclusion: "Cannot be used after payment has completed," so an agent knows the boundary without ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_payment_detailsGet PayPay Payment DetailsA
Read-only

Fetch the current status and details of a payment by merchantPaymentId. Returns status: CREATED | AUTHORIZED | COMPLETED | REFUNDED | FAILED | CANCELED. Use this for one-off status checks. For active polling, prefer wait_for_payment.

merchantPaymentIdで指定した取引の現在のステータスと詳細を取得します。 ステータス: CREATED / AUTHORIZED / COMPLETED / REFUNDED / FAILED / CANCELED。 単発の確認に使用してください。継続的な確認は wait_for_payment を推奨します。

ParametersJSON Schema
NameRequiredDescriptionDefault
merchant_payment_idYesThe merchantPaymentId used when creating the QR code. QR作成時のmerchantPaymentId。

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the description doesn't need to repeat safety. It adds value by disclosing the return statuses and the polling-vs-one-off distinction, which is useful behavioral context. It doesn't contradict annotations and provides extra detail beyond them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact paragraphs (English and Japanese) that front-load the purpose and statuses, then give usage guidance. No redundant sentences; every line earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only one parameter, no output schema, and read-only annotations, the description covers the essential: what it does, the parameter source, and when to use it. It could mention the response structure beyond statuses, but for a simple status check it is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description for merchant_payment_id is already present (100% coverage), and the description adds context by noting it's 'the merchantPaymentId used when creating the QR code', helping the agent locate the correct identifier. This goes beyond the schema's basic type definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (fetch status and details) and the resource (payment by merchantPaymentId). It lists the exact possible statuses, distinguishing it from sibling tools like wait_for_payment. The purpose is unambiguous and specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it: 'Use this for one-off status checks. For active polling, prefer wait_for_payment.' This gives clear context and directs to an alternative, leaving no ambiguity about when to select this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wait_for_paymentWait for PayPay PaymentA
Read-only

Poll PayPay until a payment reaches a terminal state (COMPLETED, AUTHORIZED, REFUNDED, FAILED, CANCELED) or the timeout elapses. Uses PayPay's recommended 2–3s polling interval by default. Returns the final status and full payment detail.

取引が終了状態(COMPLETED / AUTHORIZED / REFUNDED / FAILED / CANCELED)に達するかタイムアウトするまで、PayPayをポーリングします。 PayPay推奨の2〜3秒間隔をデフォルトで使用します。 最終ステータスと取引詳細を返します。

ParametersJSON Schema
NameRequiredDescriptionDefault
timeout_secondsNoGive up after this many seconds. Default: 120.
merchant_payment_idYesThe merchantPaymentId of the payment to wait on.
poll_interval_secondsNoHow often to poll (seconds). PayPay recommends 2–3s.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide readOnlyHint=true, which already signals no state mutation. The description adds valuable behavioral context beyond that: it explicitly mentions the polling action, the timeout behavior, and that it returns final status and full payment detail. It also discloses the default 2–3s polling interval, which is not in the annotations. No contradictions found, and the description augments the safety profile with concrete operational details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The English portion is concise and front-loaded: the first sentence states the core purpose (poll until terminal or timeout), and subsequent sentences add default interval and return value. The Japanese duplicate doubles length but is likely intentional for localization. The structure is well-organized with no wasted words, though the duplication could be trimmed for a purely English audience.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 3 parameters, all fully described in the schema, and no output schema. The description covers the core behavior (polling, terminal states, timeout, return of final status and details) and integrates well with the annotations. A minor gap is the lack of explicit behavior on timeout (e.g., does it return the last status or raise an error?), but overall it provides enough information for an agent to correctly invoke the tool. Sibling tools are distinct, and this description sufficiently differentiates it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter (merchant_payment_id, timeout_seconds, poll_interval_seconds) has a clear description and defaults/min/max. The description itself adds little beyond the schema—it mentions the default polling interval, but that's already in the schema ('default 3', 'PayPay recommends 2–3s'). It does not introduce new meaning for the parameters, so a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (poll), resource (PayPay payment), and the exact terminal states it waits for (COMPLETED, AUTHORIZED, REFUNDED, FAILED, CANCELED). It clearly distinguishes itself from siblings like get_payment_details (which likely returns a one-time snapshot) and create_qr_code/delete_qr_code (which create/delete resources). The purpose is unambiguous and directly tied to its name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly tells when to use this tool: when you need to wait for a payment to reach a terminal state, as opposed to fetching a single status snapshot. While it doesn't explicitly name the alternative (get_payment_details) or state 'use this instead of X', the context is clear from the polling behavior. It lacks explicit exclusions or 'when not to use' guidance, but the intended use case is well communicated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.2.1
    • First observedcreate_qr_code
    • First observeddelete_qr_code
    • First observedget_payment_details
    • First observedwait_for_payment

TDQS

A4.3/5.0

Scored across 4 tools

Disambiguation4/5

create_qr_code and delete_qr_code are clearly distinct lifecycle actions, and get_payment_details vs wait_for_payment are differentiated as one-off status checks vs polling. There is slight conceptual overlap between the two payment-status tools, but the descriptions make the intended use clear.

Naming Consistency5/5

All tool names follow a consistent verb-first snake_case pattern: create_qr_code, get_payment_details, delete_qr_code, wait_for_payment. The naming is predictable and easy to reason about.

Tool Count5/5

Four tools is appropriate for a narrowly scoped PayPay QR code payment server. The count feels focused rather than sparse, with no redundant or filler tools.

Completeness4/5

The core lifecycle is covered: create a QR code, poll/wait for payment, fetch payment details, and invalidate an unpaid QR code. A refund/cancel operation is absent even though REFUNDED appears in the status enum, but this is likely beyond the server's primary checkout-focused scope.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    F
    maintenance
    A comprehensive Model Context Protocol (MCP) server for BTCPayServer integration, providing tools for payment processing, store management, user administration, webhook handling and more with full API coverage.
    3
    8 npm
    3
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    MCP server for PayMongo payment gateway (Philippines). Supports payment intents, sources, payments, refunds, and checkout sessions via Basic Auth.
    24
    12 npm
    2
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    MCP server for Bank of Georgia iPay payment gateway, enabling payment orders, refunds, recurring payments, and pre-authorization via OAuth 2.0 + JWT.
    8
    16 npm
    MIT
  • A
    license
    B
    quality
    D
    maintenance
    MCP server for IDPay payment gateway (Iran). Supports payment creation, verification, inquiry, transaction listing, and payment links.
    8
    18 npm
    MIT