xendit-mcp

Model Context Protocol server for the Xendit payment API. Supports invoices, disbursements, balances, and transactions across Indonesia, the Philippines, Thailand, Vietnam, and Malaysia.

Install

npm install -g xendit-mcp

Or run on demand with npx xendit-mcp.

Related MCP server: rakuten-mcp

Configuration

1. Sign up at the Xendit Dashboard.

2. Go to Settings → API Keys and generate a key.

3. Use a test key (xnd_development_...) for development or a live key for production.

Claude Desktop

Edit claude_desktop_config.json:

{
  "mcpServers": {
    "xendit": {
      "command": "npx",
      "args": ["-y", "xendit-mcp"],
      "env": {
        "XENDIT_API_KEY": "your-api-key"
      }
    }
  }
}

Claude Code

claude mcp add xendit -e XENDIT_API_KEY=your-api-key -- npx -y xendit-mcp

Cursor

Add to ~/.cursor/mcp.json with the same shape as Claude Desktop.

Tools

Prompts

Resources

Example queries

What's my current Xendit balance?
Saldo Xendit saya berapa?

Create an invoice for Rp 500,000 for "Website design deposit".
Buatkan invoice Rp 500.000 untuk "Deposit desain website".

Show me all unpaid invoices.
Tampilkan semua invoice yang belum dibayar.

With XENDIT_ENABLE_DISBURSEMENTS=true:

Send Rp 1,000,000 to Ahmad at BCA.
Kirim Rp 1.000.000 ke Ahmad di BCA.

List available banks for disbursement in the Philippines.

Environments

Xendit issues separate test and live API keys. Test keys operate against the Xendit sandbox, so no real funds move. Live keys (xnd_production_..., iluma_production_..., sk_live_...) operate against production.

Safety

This server can move real money through the Xendit API. Key safeguards:

• Disbursement tools are disabled by default. create_disbursement, get_disbursement, and list_disbursement_banks are only registered when XENDIT_ENABLE_DISBURSEMENTS=true. Only enable them in trusted agent contexts where tool inputs cannot be influenced by untrusted content.

• Live keys are refused by default. Keys with the prefixes xnd_production_, iluma_production_, or sk_live_ are rejected at startup unless XENDIT_ALLOW_LIVE=true. Always test with a development key (xnd_development_...) first.

• Idempotency. create_disbursement uses your externalId as the Idempotency-Key, so retries with the same externalId will not create duplicate transfers. Use a fresh externalId for each new disbursement.

Even with these gates on, review any money-moving request before approving the tool call. Treat tool inputs derived from model output as untrusted.

Disclaimer

This is an unofficial, community-built MCP server. Not affiliated with, endorsed by, or sponsored by Xendit. Xendit is a trademark of its respective owners. Use at your own risk. The author accepts no liability for funds lost through misuse, prompt injection, or bugs.

License

MIT