@payretailers/mcp
OfficialClick on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@payretailers/mcpvalidate my PIX payin payload for Brazil"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@payretailers/mcp
Official Model Context Protocol (MCP) server for the PayRetailers Payments API.
Turn any MCP-compatible AI assistant into a PayRetailers integration expert. This server exposes the official Guides, tactical Skills, endpoint reference, and integration tools (search, country-specific validation, webhook playbook) as first-class MCP Resources, Tools, and Prompts.
Works with Cursor, Claude Desktop, Claude Code, Windsurf, Antigravity, Zed, VS Code + Copilot, JetBrains IDEs, Continue.dev, Cline, and any other client that speaks MCP over stdio.
Why use it
When you install this server, your AI assistant stops guessing about PayRetailers and starts consulting the source of truth on every step.
Correct code on the first try. The assistant reads the real OpenAPI shape for each endpoint (
get_endpoint_spec), so generated code uses the actual field names, types, and required combinations — not something borrowed from another PSP.Country-aware from the start. Ask for a PIX payin and the assistant knows PIX is Brazil-only, expects BRL, needs a valid 11-digit CPF, and that the QR expires fast. Ask for SPEI and it knows Mexico wants a CURP or RFC, MXN, and that CLABE is provisioned asynchronously. All powered by
get_country_rules.Payloads validated before they hit the sandbox.
validate_payloadruns real checksum validation on CPF, CNPJ, RUT, DNI, RUC, CC, NIT, CURP, RFC, CLABE — plus cross-cutting rules (integer minor units, HTTPS notification URLs, currency/country match, method/country compatibility, idempotency keys, customer required-fields matrix, subscription AmountModel shape, PIX Automático retry contract). You catch bugs in your editor, not in a400 INVALID_MODEL_SCHEMAresponse.Webhook receivers designed correctly.
get_webhook_playbookreturns the canonical event vocabulary, retry policies, and signature/replay contract.validate_webhook_handlercatches the six most damaging anti-patterns (ack-after-processing, missing eventId de-duplication, business-errors-as-500, disabled signature in production, wall-clock-order assumptions, HTTPS missing) before you write a single line of receiver code.Slash-command prompts for the hard flows. Type
/integrate-pix-payin,/integrate-subscriptions,/implement-webhook-handler,/integrate-payout-fx,/build-checkout,/debug-401-auth, or/reconcile-with-graphqland get a production-shaped implementation in the stack of your choice.Zero-config, zero-network, offline-friendly. Everything ships bundled in the release zip. No account, no API key, no outbound calls just to answer a question about the docs. Credentials are only needed for the (planned)
simulate_transactiontool.
Under the hood you have 7 tools, 7 prompts, 158 documentation resources (Guides + Skills + Reference + Recipes + concept docs), all mirrored verbatim from the payretailers-ai-docs repository.
Related MCP server: Payments Developer Portal MCP Server
What it exposes
Resources
Structured, LLM-friendly access to the PayRetailers documentation.
URI pattern | What it returns |
| An end-to-end integration guide with architecture, sequence diagrams, implementation steps, and production checklist. |
| A task-focused workflow that combines multiple endpoints (e.g. |
| A single API reference page (parameters, response, error codes). |
| A short code recipe for a common operation. |
| A concept/documentation page (subscription-concepts, webhooks-and-notifications, retry-policies, automatic-scheduling, clabe-per-customer, ...). |
The full list is announced dynamically at connect time — clients can browse them via their resource picker.
Tools
Actions the LLM can invoke instead of guessing.
Tool | What it does | Phase |
| Full-text search across Guides, Skills, Reference, Recipes and concept Docs with fuzzy matching and boosted title/slug fields. | ✅ 0.1 |
| Return the customer fields, personalId format (CPF, DNI, CURP, CC, RUT, ...), currencies, and payment-method constraints for a country + method. | ✅ 0.2 |
| Return sandbox test data (customers, cards, PIX keys, Bre-B keys) for a given country. | ✅ 0.2 |
| Return the full reference page (parameters, response, error codes) for a specific endpoint by slug. | ✅ 0.2 |
| Validate a payload against country-specific rules with real checksum validation for CPF, CNPJ, RUT, DNI, RUC, CC, NIT, CURP, RFC, CLABE. Also validates subscription products, subscriptions, and subscription payments (billing cycle, PIX_SPECIFIC retry policy, immutability). Catches non-integer minor units, wrong currency for the country, non-HTTPS webhooks, method/country mismatches, missing idempotency keys, and more. | ✅ 0.3 / 0.4 |
| Canonical PayRetailers webhook contract: envelope schema, complete event vocabulary (transactions, payouts, subscriptions, subscription payments), retry policies, signature/replay guidance, top 6 common mistakes. | ✅ 0.4 |
| Analyse a declarative description of a webhook receiver design and return machine-readable | ✅ 0.4 |
| Execute a real request against the PayRetailers sandbox using the developer's env credentials. | 🚧 planned |
Prompts
Ready-to-use templates that the developer can select with / in Cursor / Claude Desktop / etc.
Prompt | What it triggers | Phase |
| Generate a complete Brazil PIX payin integration in the language of your choice. | ✅ 0.1 |
| Cross-currency payout with 5-min FX quote TTL handling. | ✅ 0.2 |
| Country-aware checkout: frontend picker + backend endpoint + webhook receiver. | ✅ 0.2 |
| Diagnose HTTP 401/403 (subscription key, Basic Auth, IP whitelist, env mix-up). | ✅ 0.2 |
| Build a reconciliation pipeline using the Merchant Data GraphQL API. | ✅ 0.2 |
| Generate a production-grade webhook receiver for the requested stack, scope, and queue backend. Enforces the four non-negotiables (200 fast, dedupe by eventId, strict signature, never confirm before terminal status). | ✅ 0.4 |
| Generate a full subscription integration for the given country + channel (product + activation + subscription + charge + retry + cancellation). | ✅ 0.4 |
Install
Two supported paths. Pick one:
Option A — Prebuilt zip from GitHub Releases (recommended today): no npm account, no compilation, works fully offline once downloaded. This is the officially supported distribution while
@payretailers/mcpis not yet on npm.Option B — Build from source: for contributors and security-conscious deployments that want to audit the code before running it.
Option C — installing from npm as @payretailers/mcp — is planned but not yet available. When the package is published, the npx -y @payretailers/mcp snippets in the Configuration by client section will work out of the box.
Option A — Install from GitHub Releases
Prerequisites: Node.js 20 or later (node --version). Nothing else — the release zip is self-contained.
Open the Releases page and download the latest
payretailers-mcp-vX.Y.Z.zipfrom the "Assets" section of the top release.Unzip it anywhere. Common locations:
Windows:
C:\Tools\payretailers-mcpmacOS / Linux:
~/tools/payretailers-mcp
Add the server to your MCP client (see Configuration by client below, or the step-by-step guides linked there). Point it at the absolute path of
dist/index.jsinside the unzipped folder.Reload / restart your MCP client. The server will show up alongside your other tools.
Step-by-step setup guides with screenshots and verification prompts:
Optional smoke check before or after wiring it in — proves the bundle is healthy end-to-end:
cd /path/to/payretailers-mcp-X.Y.Z
node scripts/smoke-test.mjsExpected: PASS ✅ at the end, with 7 tools, 158 resources, 7 prompts, 5 resource templates announced.
Option B — Build from source
For contributors, or if your security policy requires you to audit the code before running it. Prerequisites: Node.js 20 or later, git.
git clone https://github.com/payretailers-dev/payretailers-mcp.git
cd payretailers-mcp
npm install
npm run build # generates dist/index.js (bundle + runtime deps)
npm start # optional: run over stdio manually (Ctrl+C to stop)data/ (Guides, Skills, Reference, Recipes, concept docs, curated JSON) is checked in — you do not need npm run sync:docs unless you are mirroring an updated payretailers-ai-docs checkout on the same machine.
Then wire dist/index.js into your MCP client the same way as Option A.
Configuration by client
Prefer a full walkthrough with verification prompts and troubleshooting? See the step-by-step guides in
docs/setup/for Cursor, Claude Code, Claude Desktop, and VS Code + Copilot. The snippets below are the minimal JSON needed if you already know your way around your client.
Every client takes the same three pieces of information: a command (node), an args array pointing at the absolute path of dist/index.js, and an optional env block for the future simulate_transaction tool.
Replace C:/Tools/payretailers-mcp/dist/index.js below with the absolute path where you unzipped the release. On Windows use forward slashes in JSON — backslashes need to be escaped and cause confusing errors.
Cursor
Add to ~/.cursor/mcp.json (global) or .cursor/mcp.json (per-project):
{
"mcpServers": {
"payretailers": {
"command": "node",
"args": ["C:/Tools/payretailers-mcp/dist/index.js"],
"env": {
"PAYRETAILERS_ENV": "sandbox",
"PAYRETAILERS_SHOP_ID": "your_sandbox_shop_id",
"PAYRETAILERS_SECRET_KEY": "your_sandbox_secret_key",
"PAYRETAILERS_SUBSCRIPTION_KEY": "your_sandbox_subscription_key"
}
}
}
}The env block is optional — Resources, search_docs, and all validators work without any credentials.
Claude Desktop
Add to your claude_desktop_config.json:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"payretailers": {
"command": "node",
"args": ["C:/Tools/payretailers-mcp/dist/index.js"]
}
}
}Windsurf
Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"payretailers": {
"command": "node",
"args": ["C:/Tools/payretailers-mcp/dist/index.js"]
}
}
}VS Code + Copilot
Add to .vscode/mcp.json (workspace) or open the user-scoped file with Command Palette → MCP: Open User Configuration:
{
"servers": {
"payretailers": {
"type": "stdio",
"command": "node",
"args": ["C:/Tools/payretailers-mcp/dist/index.js"]
}
}
}Note: VS Code is the odd one out — the root key is
"servers"(not"mcpServers"). MCP tools only run in Copilot Chat's Agent mode.
Zed
Add to ~/.config/zed/settings.json:
{
"context_servers": {
"payretailers": {
"command": {
"path": "node",
"args": ["C:/Tools/payretailers-mcp/dist/index.js"]
}
}
}
}Continue.dev
Add to ~/.continue/config.json:
{
"mcpServers": [
{
"name": "payretailers",
"command": "node",
"args": ["C:/Tools/payretailers-mcp/dist/index.js"]
}
]
}JetBrains AI Assistant
Open Settings → AI Assistant → MCP Servers → Add and enter:
Name:
payretailersCommand:
nodeArguments:
C:/Tools/payretailers-mcp/dist/index.js(absolute path)
Other clients
Any client that speaks MCP over stdio can consume this server. Point it at node <absolute-path-to>/dist/index.js and you are done.
Once npm is available
When @payretailers/mcp is published to npm, the same configs work with the shorter form:
{ "command": "npx", "args": ["-y", "@payretailers/mcp"] }No changes to env, no need to keep an unzipped folder around.
Verify it works
After reloading your MCP client you should see, on the server's status entry, something like:
7 tools · 158 resources · 7 prompts · 5 resource templates
Cursor:
Ctrl+Shift+P→ Customize → MCPs tab. Look forpayretailerswith a green dot and expand it.Claude Desktop: check the tools drawer in a new chat; the PayRetailers tools should appear alongside your other MCPs.
VS Code / Zed / Continue.dev / Windsurf: consult each client's docs for its MCP status panel.
If your assistant does not appear to call the tools, force it once by prefixing a prompt with "Use the PayRetailers MCP to...". Once it has invoked a tool once in a conversation, it tends to keep doing so.
Troubleshooting
The server fails to start. Run the bundle manually from a terminal:
node /path/to/payretailers-mcp/dist/index.jsIf it stays silent waiting for input, the bundle is fine — the issue is on the client side (path typo in the config, forward-slashes vs backslashes on Windows, wrong process being restarted). If it prints an error, the most common causes are Node < 20 (upgrade Node) or a truncated download (re-download the zip).
The client shows old counts (e.g. 5 tools, 89 resources). Some clients cache the MCP tool/resource enumeration. Toggle the server OFF → ON in the client's MCP panel, or add an unused env entry to the config (e.g. "MCP_VERSION": "0.4.1") to force a re-spawn.
The model does not seem to call any MCP tool. Make sure the chat is in Agent mode (not Ask / read-only mode). Some lightweight models are less eager to call tools — switch to a top-tier model for the first invocations, and the assistant will remember the tools are available for the rest of the conversation.
Where are the logs? Every MCP client has an MCP logs panel that captures the JSON-RPC handshake, parse errors, and server stderr. In Cursor: Ctrl+Shift+U → dropdown → MCP Logs.
Environment variables
Optional — required only for the future simulate_transaction tool (Phase 4). Everything else (Resources, search_docs, Prompts) works without any credentials.
Variable | Description | Default |
|
|
|
| Your Shop ID from the merchant portal. | (unset) |
| Your Secret Key for HTTP Basic Auth. | (unset) |
| Value of the | (unset) |
Security: the server never logs credentials and never persists them. They live in-memory for the duration of the session and are only sent to api-sandbox.payretailers.com or api.payretailers.com when you invoke simulate_transaction.
Example usage
Once configured, ask your AI assistant in plain language:
"Create my first PIX payin in the sandbox for R$50 in Brazil. Use Node.js."
Under the hood, the assistant will:
Call
search_docs({ query: "pix payin brazil" })→ find thebrazil-pix-payinskill.Read
payretailers://skill/brazil-pix-payinfor the exact steps.Generate runnable code with the right endpoint, headers, minor units, and CPF format.
Or use the /integrate-pix-payin prompt directly for a fully-scaffolded answer.
Validating a payload before submission
Once the assistant has drafted a payload it can validate it before hitting the API:
// tools/call → validate_payload
{
"operation": "create-transaction",
"country": "BR",
"method": "PIX",
"payload": {
"trackingId": "abc-12345678",
"amount": 100.50, // will be flagged: use 10050 (minor units)
"currency": "USD", // will be flagged: BR expects BRL
"notificationUrl": "http://example.com/wh", // will be flagged: must be HTTPS
"customer": {
"firstName": "Ana",
"lastName": "Santos",
"email": "ana@example.com",
"personalId": "12345678900" // will be flagged: invalid CPF checksum
}
}
}The response lists every issue with a code, severity, path, message, and often a hint and suggestion — the LLM can fix the payload before wasting a network round-trip.
Development
git clone https://github.com/payretailers-dev/payretailers-mcp.git
cd payretailers-mcp
npm install
npm run build # generates dist/index.js
npm test # 93 unit tests
node scripts/smoke-test.mjs # end-to-end stdio handshake + tool calls
npm start # optional: run the server manually on stdiodata/ (Guides, Skills, Reference, Recipes, concept docs, curated JSON) is checked into the repository. Run npm run sync:docs only if you have ../payretailers-ai-docs checked out and want to refresh the mirror.
The server can be inspected with the official MCP Inspector:
npx @modelcontextprotocol/inspector node dist/index.jsReleasing (maintainers)
Releases are automated via GitHub Actions on tag push (v*.*.*). The workflow:
Runs lint, typecheck, unit tests, build, and smoke test.
Runs
npm run pack:releaseto producerelease/payretailers-mcp-vX.Y.Z.zip(bundleddist/index.js+data/mirror + README + LICENSE + CHANGELOG + smoke test).Creates a GitHub Release and attaches the zip.
Publishes to npm as
@payretailers/mcponly if theNPM_TOKENrepository secret is configured — otherwise the release is GitHub-only.
To cut a release locally, then push the tag:
# 1. Bump version in package.json, config.ts, CHANGELOG.md
# 2. Verify locally
npm run clean && npm ci && npm test && npm run build
node scripts/smoke-test.mjs
npm run pack:release # writes release/payretailers-mcp-vX.Y.Z.zip
# 3. Commit + tag + push
git add -A
git commit -m "chore: release vX.Y.Z"
git tag vX.Y.Z
git push origin main
git push origin vX.Y.Z # this triggers .github/workflows/release.ymlSemver is enforced strictly: patch releases fix bugs, minor releases add tools/prompts/resources without breaking existing ones, major releases only for renames/removals.
Roadmap
0.1 ✅ Resources (Guides, Skills),
search_docs,integrate-pix-payinprompt.0.2 ✅ Resources (Reference, Recipes),
get_country_rules,get_test_data,get_endpoint_spec, promptsintegrate-payout-fx,build-checkout,debug-401-auth,reconcile-with-graphql.0.3 ✅
validate_payloadwith real checksum validation for CPF, CNPJ, RUT, DNI, RUC, CC, NIT, CURP, RFC, CLABE + cross-cutting rules (minor units, currency/country, HTTPS webhooks, method/country, idempotency).0.4 ✅ Concept docs resource category,
get_webhook_playbook,validate_webhook_handler, expandedvalidate_payloadfor subscription operations, promptsimplement-webhook-handler,integrate-subscriptions.0.4.1 ✅ Subscriptions schema alignment (AmountModel, frequency enum, authorizationType) — CHANGELOG.md.
0.5 —
simulate_transaction(dry-run against sandbox),get_error_code, expanded country coverage.1.0 — Stable public release + listing in the official MCP Registry + npm publish.
See CHANGELOG.md for details.
Related
Step-by-step setup guides for Cursor, Claude Code, Claude Desktop and VS Code + Copilot:
docs/setup/.Companion documentation repository: payretailers-dev/payretailers-ai-docs — the source of Guides, Skills, and the docs mirror.
Official documentation: www.payretailers.dev.
Develop with LLMs guide: www.payretailers.dev/docs/develop-with-llms.
Model Context Protocol: modelcontextprotocol.io.
License
Source code: MIT. See LICENSE.
Documentation content bundled in data/ (Guides, Skills, Reference, Recipes) is licensed under CC BY-ND 4.0, inherited from the payretailers-ai-docs repository. The curated data files (data/country-rules.json, data/test-data.json) are also released under CC BY-ND 4.0.
Contributing
Bug reports and feature requests are welcome via GitHub Issues. Pull requests from the community are reviewed but merged at the discretion of the PayRetailers team — see CONTRIBUTING.md when available.
Available Tools
7 toolsget_country_rulesA
Return the country-specific rules for a PayRetailers integration: accepted currencies, personalId format (CPF, DNI, CLABE, RUT, ...), payment method constraints, and regulatory notes. Call this before emitting any country-specific payload.
| Name | Required | Description | Default |
|---|---|---|---|
| method | No | Optional payment method filter (e.g. 'PIX', 'ALIAS_CVU', 'SPEI', 'CARD', 'BRE_B'). If omitted, returns full country rules. | |
| country | Yes | ISO 3166-1 alpha-2 country code. Supported: BR, AR, MX, CO, CL, PE. Use uppercase. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and it does well: 'Return' signals a safe read, and the description discloses exactly what the response contains (currencies, personalId, constraints, notes). It adds the workflow context of calling before payload emission. It doesn't cover failure behavior for unsupported countries, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences of densely packed information: the purpose plus content enumeration, followed by a single directive. No filler, and the most important constraint (when to call) is placed clearly at the end.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple lookup with 2 fully-documented parameters and no output schema, the description compensates well by detailing what the return value contains. The only minor omission is error handling for unsupported country codes, but the schema already lists the supported countries, so the description is complete for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'country' and 'method' are already well documented in the schema, including the supported values and formatting rules (uppercase, ISO code). The description adds no parameter detail beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and resource ('country-specific rules') and enumerates the exact content: accepted currencies, personalId formats, payment method constraints, and regulatory notes. This clearly distinguishes it from siblings like search_docs and get_endpoint_spec, which serve different lookup purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit when-to-call directive: 'Call this before emitting any country-specific payload.' This frames the tool as a prerequisite step in the integration flow. It lacks explicit exclusions or named alternatives, but the precondition is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_endpoint_specA
Return the full reference page (parameters, response, error codes) for a specific PayRetailers endpoint. Use this to ground your generated code against the exact request/response schema before emitting it.
| Name | Required | Description | Default |
|---|---|---|---|
| section | No | 'full' returns the entire reference page. 'summary' returns just the top of the page. Default 'full'. | |
| endpoint | Yes | Endpoint slug or logical name. Examples: 'create-transaction', 'create-payout', 'createpayoutquote', 'get-payment-methods', 'post_v1-subscriptions'. Case-insensitive. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses what the tool returns (parameters, response, error codes), which is the core behavior. However, it doesn't mention any potential error handling, rate limits, or any side effects. As a read-only retrieval, this is acceptable but not exceptionally transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences. The first sentence states the core function, and the second provides usage context. No filler words, and the most critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since there is no output schema, the description correctly explains what the response contains ('parameters, response, error codes'). It covers the essential information for a retrieval tool. The 'section' parameter is described in the schema, so no need to repeat. Slightly more could be said about expected size or format, but it is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not add any extra meaning beyond what the schema already documents for 'section' and 'endpoint' – it simply restates the purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Return'), a clear resource ('full reference page'), and the specific content ('parameters, response, error codes'). It clearly distinguishes itself from siblings like search_docs by being the tool that retrieves a specific endpoint's spec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a clear use case: 'to ground your generated code against the exact request/response schema before emitting it.' This tells the agent when to use it. It doesn't explicitly mention alternatives, but the sibling list includes search_docs, which is likely for broader searching, so the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_test_dataA
Return official-shaped sandbox test data for a country: sample customers (name, email, personalId in correct format, address), test cards (approved/declined), and PIX/Bre-B keys where applicable. Use this to populate sandbox requests with realistic values instead of inventing them.
| Name | Required | Description | Default |
|---|---|---|---|
| country | Yes | ISO 3166-1 alpha-2 country code. Supported: BR, AR, MX, CO, CL, PE. | |
| section | No | Which section of test data to return. 'all' returns everything. Defaults to 'all'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden of behavioral disclosure. The description implies a read-only data fetch (returning data) but does not explicitly state that it makes no changes or that it is safe to call. It also does not mention error cases, rate limits, or the exact structure of the returned data. Adequate for a simple retrieval, but lacks depth given the absence of annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler. The primary action and scope are front-loaded, followed by a concise usage recommendation. Every word earns its place; no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only 2 parameters, no output schema, and no nested objects, the description covers the essential information: what is returned, its purpose, and how to invoke it. It could optionally describe the response structure more explicitly, but the types of data are listed, which is sufficient for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — both 'country' and 'section' have descriptions, including supported values and defaults. The description adds context about why these parameters matter (to populate realistic sandbox requests) but does not add syntax or format details beyond what the schema already covers. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Return' and the resource 'official-shaped sandbox test data for a country', enumerating the exact contents (customers, test cards, PIX/Bre-B keys). This is specific and distinct from sibling tools like get_country_rules or get_endpoint_spec, making it easy for an agent to identify this as the correct tool for generating test data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this to populate sandbox requests with realistic values instead of inventing them', which gives clear context on when to use it. It does not explicitly state when not to use it or compare to alternatives, but the purpose is clear enough that an agent would not confuse it with the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_webhook_playbookA
REQUIRED before implementing any webhook receiver or reconciliation flow. Returns the canonical PayRetailers webhook contract: envelope schema, complete event vocabulary (transaction lifecycle: PENDING/IN_PROGRESS/APPROVED/REJECTED/CANCELLED/EXPIRED/REFUNDED/CHARGEBACK; payout lifecycle; subscription and subscription_payment events with retry semantics), HTTP response contract (200 fast / 400 no-retry / 500 retried), idempotency by eventId, replay protection, signature verification, retry policies (PIX_SPECIFIC / FIXED_RETRY / NOT_ALLOWED), and the top 6 wrong-way patterns integrators hit. Filter by category or eventType for a focused answer. Do not attempt to design a webhook handler from memory — call this tool first.
| Name | Required | Description | Default |
|---|---|---|---|
| category | No | Filter events by lifecycle. 'transaction' = payin events; 'payout' = payout events; 'subscription' = subscription entity events (activation/cancellation); 'subscription_payment' = recurring charge events; 'all' (default) returns the complete catalog. | |
| eventType | No | Filter by a specific eventType string (e.g. 'subscription.payment', 'transaction'). Case-sensitive as declared by the API. | |
| includeDelivery | No | Include the delivery / retry / signature section. Defaults to true. Set to false if you only need the event vocabulary. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full disclosure burden. It states the tool is a read-only retrieval operation ('Returns') and details all delivered content: event vocabulary, retry policies, signature verification, etc. It does not claim any side effects or mutations. The emphasis that integrators should not rely on memory signals the tool's authoritative nature. This is sufficient behavioral transparency for a query tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but densely packed with essential information, organized as a list of contract aspects and retry policies. The mandatory-use warning is front-loaded, and every sentence contributes value. While verbose, the complexity of webhook contracts justifies the detail; there is no redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must explain the return value, and it does so extensively: it lists envelope schema, event categories, HTTP response codes, idempotency, replay protection, signature verification, retry policies, and common mistakes. It also explains parameter usage for scoping results. For a reference tool covering a complex integration surface, this is complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the three parameters (category, eventType, includeDelivery) are fully documented in the schema with enums and examples. The description only adds a generic suggestion to filter by category or eventType, but does not introduce new semantic meaning beyond the schema. Per the rubric, baseline 3 is appropriate when the schema handles parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Returns') and resource ('canonical PayRetailers webhook contract') and enumerates the exact contents: envelope schema, event vocabulary, HTTP response contract, idempotency, replay protection, signature verification, retry policies, and common pitfalls. This clearly differentiates it from siblings like search_docs or get_endpoint_spec, which are generic or endpoint-specific rather than webhook-contract-specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mandates when to use the tool: 'REQUIRED before implementing any webhook receiver or reconciliation flow' and 'Do not attempt to design a webhook handler from memory — call this tool first.' It also advises filtering by category or eventType for focused answers, giving clear guidance on how to invoke it effectively. No alternatives are mentioned, but the tool is positioned as the definitive prerequisite, so exclusion guidance is unnecessary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_docsA
Search across PayRetailers Guides and Skills. Returns top matches with a short snippet. Use this before answering any integration question to ground your response in the official documentation.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. Default 10. | |
| query | Yes | Free-text query. Examples: 'pix payout', 'validate cpf', 'fx quote'. | |
| category | No | Optional category filter. 'guide' = end-to-end tutorial. 'skill' = task-focused workflow. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description carries the full burden. It discloses the search-and-return behavior (returning matches with snippets) but does not mention permissions, rate limits, or side effects. It's adequate for a search tool but leaves notable gaps in behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences: the first states the purpose and output, the second gives the usage directive. Every word earns its place, and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward 3-parameter tool with full schema coverage and no output schema, the description supplies enough context for correct usage, including a strong usage hint. It omits details like pagination or error handling, but these are minor for a search tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage with rich descriptions (e.g., query examples, category enum explanations, limit bounds). The description adds little beyond restating the scope, so it meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Search'), a distinct resource ('PayRetailers Guides and Skills'), and the output format ('top matches with a short snippet'). This effectively differentiates it from sibling tools that fetch specific data (e.g., get_endpoint_spec, get_country_rules).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an explicit 'when to use' directive: 'Use this before answering any integration question to ground your response in the official documentation.' This clearly signals the primary use case, but it lacks explicit mention of alternatives or when not to use the tool, so it doesn't reach a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_payloadA
REQUIRED whenever the user shows or you are about to emit a JSON body for POST /transactions, POST /payouts, POST /customers, POST /v1/subscription-products, POST /v1/subscriptions, or POST /v1/subscription-payments — even if the payload looks correct. Runs the same checks a senior PayRetailers integrator would run in code review: country-specific document checksum (CPF, CNPJ, RUT, DNI, RUC, CC, NIT, CURP, RFC, CLABE), minor-units-as-string amount format, currency/country match, HTTPS notificationUrl, method/country compatibility (PIX only BR, BRE_B only CO, SPEI only MX, etc.), idempotency key length, trackingId ≤ 50 chars, customer required fields matrix (customer.ip / customer.country always; city+address in CO or card in EC/MX; zip on cards in EC/MX; phone on Boleto/Efecty/PagoEfectivo/Yape/Plin/WesternUnion-PA/African methods). For subscriptions: enforces billingCycle shape, Bacen PIX_SPECIFIC contract (maxRetries=3 / retryIntervalDays=7 fixed for BR PIX Automático), FIXED_RETRY config completeness, and authorisationJourney vocabulary (BACKGROUND / USER_INTERACTION). Returns machine-readable {errors, warnings, info} with code, path, severity, hint and often a suggestion — pipe those back into the corrected payload before you show any curl / SDK call to the user. Do not skip: a payload that 'looks fine' but hits the API returns generic 4xx errors that are far harder to interpret than the codes this tool emits.
| Name | Required | Description | Default |
|---|---|---|---|
| method | No | Payment method (e.g. 'PIX', 'CARD', 'SPEI', 'BRE_B', 'ALIAS_CVU'). Enables method-specific rules. | |
| country | No | ISO 3166-1 alpha-2 country code. If omitted, taken from payload.country. Determines the personalId format to validate. | |
| payload | Yes | The JSON body you're about to POST to the PayRetailers API. Pass it verbatim (no headers, just the body). | |
| operation | Yes | Which PayRetailers operation the payload targets. Each operation has its own required fields. | |
| environment | No | 'sandbox' allows local/private notificationUrls (with a hint). 'production' rejects them. Default: 'sandbox'. | |
| personalIdType | No | Explicit personalId type. If omitted, inferred from country + value shape (e.g. BR + 11 digits → CPF). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the return format ({errors, warnings, info} with code, path, severity, hint, suggestion) and warns that 'looks fine' payloads still need validation—setting expectations that the tool may catch issues even when the user thinks they're correct. It does not explicitly state non-behavior like 'does not make API calls' or 'no side effects', but the description implies a read-only validation function. It adds substantial context beyond the schema, justifying a 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very long, though it front-loads the critical usage note ('REQUIRED whenever') and structures the validations as a list. Every sentence adds useful detail, but it could be more concise by grouping related checks. For a tool with high complexity, the length is defensible, but it is not tightly packed—several clauses could be trimmed without loss of meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, nested objects, many validation rules) and the absence of an output schema, the description is remarkably complete. It covers all the inputs' roles, the full set of validations, the output structure, and why skipping is risky. An agent would have everything needed to decide whether and how to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is stated as 100%, so the baseline is 3. The description reinforces parameter roles (e.g., 'operation' selects the rule set, 'environment' affects notificationUrl checks, 'personalIdType' inference) but adds no new parameter info beyond what the schema already describes. It does contextualize why parameters matter, but not enough to exceed baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific, actionable purpose: validating JSON payloads for a defined set of PayRetailers POST endpoints. It enumerates the exact operations and lists the specific validation checks (CPF/CNPJ checksums, amount format, currency/country match, etc.), making the tool's function unambiguous and distinct from sibling tools like search_docs or get_endpoint_spec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when the tool is REQUIRED ('REQUIRED whenever... even if the payload looks correct') and explains why (generic 4xx errors are hard to interpret). It also directs the user to pipe the returned errors/warnings back into the payload, effectively telling them the expected workflow. No exclusions or alternatives are mentioned, but the tool is clearly the primary validator for these operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_webhook_handlerA
REQUIRED whenever the user is designing, describing, or about to code a webhook receiver for PayRetailers — even if the design looks fine. Analyses a declarative description of the handler (URL, processing mode, ack strategy, idempotency, signature verification, replay protection, error mapping, ordering assumptions) against the PayRetailers contract and returns {errors, warnings, info} with actionable codes. Catches the top failure modes: acknowledging AFTER processing (times out and gets retried), returning 500 on business errors (infinite retries), missing eventId de-duplication (double-fulfilment), assuming wall-clock order (state corruption), HTTPS missing, signature disabled in production, replay window absent. Pair with get_webhook_playbook when designing from scratch.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | The public URL that will receive PayRetailers webhook POSTs. | |
| ordering | No | Whether the handler relies on wall-clock order of events for the same entityId. Real deliveries can arrive out-of-order; a handler that assumes order will corrupt state. | |
| ackStrategy | Yes | When the handler returns 200: 'before-processing' (recommended), 'after-processing' (blocks retries but risks timeouts), 'conditional-on-outcome' (dangerous: business errors trigger retries). | |
| environment | No | Deployment target for this handler. Defaults to 'sandbox'. | |
| ipAllowlist | No | Optional IP allowlist. NOT sufficient by itself — always combine with signature verification. | |
| errorHandling | No | How the handler maps internal exceptions to HTTP status. Business errors ('order not found') should NOT return 500 — that triggers infinite retries. | |
| processingMode | Yes | How the handler processes the event: 'sync-in-request' = all business logic runs before returning 200; 'async-queue' = enqueue and return 200 immediately (recommended); 'async-thread' = fire-and-forget in-process background thread. | |
| languageOrStack | No | Optional stack hint (e.g. 'C# ASP.NET 8', 'Node.js Express', 'Python FastAPI'). Only used to sharpen suggestions. | |
| replayProtection | No | Optional replay protection based on eventDate. Recommended: enabled=true with maxAgeMinutes=5. | |
| idempotencyStrategy | Yes | How duplicate deliveries are de-duplicated. 'by-eventId' is the required strategy. | |
| signatureVerification | Yes | How the handler treats the PayRetailers webhook signature. 'strict' = reject on mismatch (recommended); 'log-only' = log and continue; 'disabled' = no verification (only acceptable for sandbox). | |
| idempotencyStoreTtlDays | No | How long processed eventIds are retained. Recommended >= 30 days to survive replay attempts and backlogs. | |
| responseTargetLatencyMs | No | Expected p95 latency of your endpoint in milliseconds. PayRetailers targets < 3000 ms for the 200 ack. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states the return structure ({errors, warnings, info} with actionable codes) and the specific failure modes it catches (acknowledging after processing, returning 500 on business errors, missing idempotency, etc.), giving an agent a concrete mental model of what the tool will do. It does not go into output detail beyond that, but for a static-analysis/validation tool this is adequate; a 4 is warranted because it is explicit and actionable without being exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than typical but every sentence earns its place: the usage directive is front-loaded, the evaluation scope is itemized, and the failure-mode list is concrete and useful. The only slight inefficiency is the duplication of some schema-derived concepts (like the retry risks), but overall it's tightly packed with high-signal guidance rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (13 parameters, 6 enums, nested objects, no output schema), the description is remarkably complete. It states the contract (payload fields), the output format, the key failure modes, and even mentions pairing with a related tool. It could include an example of the 'actionable codes', but the description's coverage of usage, scope, and behavior is sufficient for an agent to decide whether to call it and roughly what to provide.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — every parameter has a substantive description (e.g., ackStrategy explains the three options and warns about 'conditional-on-outcome', idempotencyStrategy says 'by-eventId' is required). The tool description itself adds only a few high-level hints (like the list of failure modes that map to parameters) but does not go beyond what the schema already explains. Since the schema does the heavy lifting, the baseline 3 is appropriate; the description reinforces but does not add new parameter-specific meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Analyses') and a precise resource ('a declarative description of the handler... against the PayRetailers contract') and enumerates the exact inputs (URL, processing mode, ack strategy, etc.) and the output shape ({errors, warnings, info}). It also distinguishes itself from the sibling get_webhook_playbook by naming it explicitly, leaving no ambiguity about which tool fits a design-from-scratch task.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening word 'REQUIRED' plus the explicit trigger condition ('whenever the user is designing, describing, or about to code a webhook receiver') makes the when-to-use unmistakable. It also states an alternative ('Pair with get_webhook_playbook when designing from scratch') and even cautions that the tool is needed 'even if the design looks fine', closing off the common excuse of skipping validation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.4.1- First observed
get_country_rules - First observed
get_endpoint_spec - First observed
get_test_data - First observed
get_webhook_playbook - First observed
search_docs - First observed
validate_payload - First observed
validate_webhook_handler
TDQS
Scored across 7 tools
Each tool targets a distinctly different aspect of the integration workflow: searching docs, retrieving country-specific rules, fetching test data, getting endpoint schemas, validating payloads, validating webhook handlers, and retrieving webhook playbook. There is no overlap in purpose, and descriptions make boundaries crystal clear.
All tool names follow a consistent verb_noun snake_case pattern (search_docs, get_country_rules, validate_payload, etc.). No mixed conventions or ambiguous verbs appear, making the set predictable and easy to navigate.
With 7 tools, the server is well-scoped for its purpose as a PayRetailers integration assistant. Each tool earns its place—offering documentation search, country rules, test data, endpoint specs, payload validation, webhook validation, and webhook playbook—without unnecessary bloat.
The tool surface comprehensively covers the core integration lifecycle: grounding in docs, country-specific rules, sandbox test data, endpoint schemas, payload validation, and webhook design/validation. It addresses the primary pain points integrators face, leaving no obvious gaps for common tasks.
Maintenance
Related MCP Connectors
The Mercado Pago MCP Server implements the Model Context Protocol to provide AI agents and LLMs with access to Mercado Pago's APIs and tools within compatible development environments. It acts as an intermediary that translates Mercado Pago resources into executable functions (tools) that AI applications can invoke to perform actions and automate flows. The server simplifies integration, enables using documentation to implement or improve code, and optimizes operations through natural language interactions without manual implementations.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
- PressoOAuthnow.presso
Connect e-commerce and marketing data to AI assistants via MCP.
Your memory, everywhere AI goes. Build knowledge once, access it via MCP anywhere.
Related MCP Servers
- FlicenseBqualityDmaintenanceProvides AI assistants with access to Payman's documentation, helping developers build integrations more efficiently through enhanced contextual support.5-
- FlicenseNot gradedqualityDmaintenanceA Model Context Protocol server that connects to a payments company's developer portal, providing AI assistants with access to payment documentation, APIs, and guides.-
- AlicenseAqualityDmaintenanceEnables AI agents to integrate Midtrans payments by providing comprehensive documentation, API references, and code examples for 15+ payment methods across 5 languages. Includes tools for generating charge requests, webhook handlers, and searching documentation without requiring API keys.91MIT
- AlicenseAqualityDmaintenanceProvides AI assistants with comprehensive, precise BigCommerce developer documentation via 12 MCP tools, including REST endpoints, GraphQL operations, webhooks, OAuth scopes, and code examples.124 npm3MIT