Skip to main content
Glama

@payretailers/mcp

面向 PayRetailers 支付 API 的官方 Model Context Protocol (MCP) 服务器。

将任何兼容 MCP 的 AI 助手变成 PayRetailers 集成专家。此服务器将官方指南、战术技能、端点参考和集成工具(搜索、国家特定验证、Webhook 操作手册)作为一流的 MCP 资源、工具和提示词公开。

适用于 Cursor、Claude Desktop、Claude Code、Windsurf、Antigravity、Zed、VS Code + Copilot、JetBrains IDEs、Continue.dev、Cline 以及任何其他通过 stdio 支持 MCP 的客户端。


为什么使用它

安装此服务器后,你的 AI 助手将不再猜测 PayRetailers 的相关信息,而是在每一步都查阅权威来源。

  • 首次尝试即获得正确代码。 助手会读取每个端点的真实 OpenAPI 结构(get_endpoint_spec),因此生成的代码使用实际的字段名、类型和必填组合——而不是从其他 PSP 借用的内容。

  • 从一开始就具备国家感知。 询问 PIX 付款,助手会知道 PIX 仅限巴西,期望使用 BRL,需要有效的 11 位 CPF,并且二维码过期很快。询问 SPEI,它会知道墨西哥需要 CURP 或 RFC、MXN,并且 CLABE 是异步配置的。所有这些都由 get_country_rules 提供支持。

  • 在进入沙箱之前验证负载。 validate_payload 对 CPF、CNPJ、RUT、DNI、RUC、CC、NIT、CURP、RFC、CLABE 执行真实的校验和验证——以及跨领域规则(整数最小货币单位、HTTPS 通知 URL、货币/国家匹配、方法/国家兼容性、幂等键、客户必填字段矩阵、订阅 AmountModel 形状、PIX Automático 重试契约)。你在编辑器中捕获错误,而不是在 400 INVALID_MODEL_SCHEMA 响应中。

  • 正确设计的 Webhook 接收器。 get_webhook_playbook 返回规范的事件词汇表、重试策略和签名/重放契约。validate_webhook_handler 在编写任何接收器代码之前捕获六种最具破坏性的反模式(处理后确认、缺少 eventId 去重、业务错误作为 500、生产环境中禁用签名、依赖时钟顺序的假设、缺少 HTTPS)。

  • 针对复杂流程的斜杠命令提示词。 输入 /integrate-pix-payin、/integrate-subscriptions、/implement-webhook-handler、/integrate-payout-fx、/build-checkout、/debug-401-auth 或 /reconcile-with-graphql,即可获得所选技术栈中的生产级实现。

  • 零配置、零网络、离线友好。 所有内容都打包在发布 zip 中。无需账户、无需 API 密钥、无需出站调用即可回答文档相关问题。仅当使用(计划中的)simulate_transaction 工具时才需要凭据。

在底层,你有 7 个工具、7 个提示词、158 个文档资源(指南 + 技能 + 参考 + 配方 + 概念文档),全部从 payretailers-ai-docs 仓库逐字镜像。


Related MCP server: Payments Developer Portal MCP Server

它暴露了什么

资源

对 PayRetailers 文档的结构化、LLM 友好的访问。

URI 模式

返回内容

payretailers://guide/{slug}

端到端集成指南,包含架构、时序图、实现步骤和生产检查清单。

payretailers://skill/{slug}

结合多个端点的任务导向工作流(例如 brazil-pix-payin、payout-fx-quote-flow)。

payretailers://reference/{slug}

单个 API 参考页面(参数、响应、错误代码)。

payretailers://recipe/{slug}

常见操作的简短代码配方。

payretailers://doc/{slug}

概念/文档页面(subscription-concepts、webhooks-and-notifications、retry-policies、automatic-scheduling、clabe-per-customer、...)。

完整列表在连接时动态公布——客户端可以通过其资源选择器浏览。

工具

LLM 可以调用而不是猜测的操作。

工具

功能

阶段

search_docs

在指南、技能、参考、配方和概念文档中进行全文搜索,支持模糊匹配和标题/别名字段加权。

✅ 0.1

get_country_rules

返回国家 + 方法的客户字段、personalId 格式(CPF、DNI、CURP、CC、RUT、...)、货币和支付方式约束。

✅ 0.2

get_test_data

返回给定国家的沙箱测试数据(客户、卡、PIX 密钥、Bre-B 密钥)。

✅ 0.2

get_endpoint_spec

按别名返回特定端点的完整参考页面(参数、响应、错误代码)。

✅ 0.2

validate_payload

根据国家特定规则验证负载,对 CPF、CNPJ、RUT、DNI、RUC、CC、NIT、CURP、RFC、CLABE 进行真实校验和验证。还验证订阅产品、订阅和订阅付款(计费周期、PIX_SPECIFIC 重试策略、不可变性)。捕获非整数最小货币单位、国家货币不匹配、非 HTTPS Webhook、方法/国家不匹配、缺少幂等键等。

✅ 0.3 / 0.4

get_webhook_playbook

规范的 PayRetailers Webhook 契约:信封模式、完整事件词汇表(交易、付款、订阅、订阅付款)、重试策略、签名/重放指南、前 6 个常见错误。

✅ 0.4

validate_webhook_handler

分析 Webhook 接收器设计的声明式描述,并返回机器可读的 {errors, warnings, info}。捕获处理后确认、缺少幂等性、业务错误作为 500、依赖时钟顺序的假设、生产环境中禁用签名。

✅ 0.4

simulate_transaction

使用开发者的环境凭据对 PayRetailers 沙箱执行真实请求。

🚧 计划中

提示词

开发者可以在 Cursor / Claude Desktop 等中使用 / 选择的现成模板。

提示词

触发内容

阶段

integrate-pix-payin

生成所选语言中的完整巴西 PIX 付款集成。

✅ 0.1

integrate-payout-fx

跨货币付款,处理 5 分钟 FX 报价 TTL。

✅ 0.2

build-checkout

国家感知结账:前端选择器 + 后端端点 + Webhook 接收器。

✅ 0.2

debug-401-auth

诊断 HTTP 401/403(订阅密钥、Basic Auth、IP 白名单、环境混淆)。

✅ 0.2

reconcile-with-graphql

使用 Merchant Data GraphQL API 构建对账管道。

✅ 0.2

implement-webhook-handler

为请求的技术栈、范围和队列后端生成生产级 Webhook 接收器。强制执行四个不可协商项(快速返回 200、按 eventId 去重、严格签名、在终端状态之前绝不确认)。

✅ 0.4

integrate-subscriptions

为给定国家和渠道生成完整的订阅集成(产品 + 激活 + 订阅 + 收费 + 重试 + 取消)。

✅ 0.4


安装

两种受支持的路径。选择一种:

  • 选项 A — 从 GitHub Releases 下载预构建 zip(目前推荐):无需 npm 账号,无需编译,下载后即可完全离线使用。在 @payretailers/mcp 尚未发布到 npm 之前,这是官方支持的发行方式。

  • 选项 B — 从源码构建:适用于贡献者以及希望在运行前审计代码的安全敏感型部署。

选项 C — 通过 npm 安装为 @payretailers/mcp — 已规划但尚未可用。当该包发布后,按客户端配置 一节中的 npx -y @payretailers/mcp 片段将开箱即用。

选项 A — 从 GitHub Releases 安装

前置条件:Node.js 20 或更高版本(node --version)。其他无需任何安装 — 发布 zip 是自包含的。

  1. 打开 Releases 页面,从顶部 release 的 "Assets" 部分下载最新的 payretailers-mcp-vX.Y.Z.zip。

  2. 将其解压到任意位置。常见位置:

    • Windows:C:\Tools\payretailers-mcp

    • macOS / Linux:~/tools/payretailers-mcp

  3. 将服务器添加到你的 MCP 客户端(参见下方的 按客户端配置,或该处链接的分步指南)。将其指向解压文件夹内 dist/index.js 的绝对路径。

  4. 重新加载 / 重启你的 MCP 客户端。服务器将与其他工具一起显示。

带截图和验证提示的分步设置指南:

可选的在接入前后进行的冒烟检查 — 用于证明该 bundle 端到端健康:

cd /path/to/payretailers-mcp-X.Y.Z
node scripts/smoke-test.mjs

预期结果:末尾显示 PASS ✅,并宣告 7 个工具、158 个资源、7 个提示词、5 个资源模板。

选项 B — 从源码构建

适用于贡献者,或如果你的安全策略要求在运行前审计代码。前置条件:Node.js 20 或更高版本、git。

git clone https://github.com/payretailers-dev/payretailers-mcp.git
cd payretailers-mcp
npm install
npm run build          # generates dist/index.js (bundle + runtime deps)
npm start              # optional: run over stdio manually (Ctrl+C to stop)

data/(Guides、Skills、Reference、Recipes、概念文档、精选 JSON)已纳入版本控制 — 除非你需要在同一台机器上镜像更新的 payretailers-ai-docs 检出,否则无需运行 npm run sync:docs。

然后按照选项 A 的相同方式将 dist/index.js 接入你的 MCP 客户端。


按客户端配置

更倾向于带验证提示和故障排查的完整演练?请参阅 docs/setup/ 中针对 Cursor、Claude Code、Claude Desktop 和 VS Code + Copilot 的分步指南。如果你已经熟悉你的客户端,下面的片段是所需的最简 JSON。

每个客户端都接收相同三条信息:command(node)、指向 dist/index.js 绝对路径的 args 数组,以及为将来的 simulate_transaction 工具准备的可选 env 块。

将下面的 C:/Tools/payretailers-mcp/dist/index.js 替换为你解压 release 的绝对路径。在 Windows 上,JSON 中请使用正斜杠 — 反斜杠需要转义,且会导致令人困惑的错误。

Cursor

添加到 ~/.cursor/mcp.json(全局)或 .cursor/mcp.json(按项目):

{
  "mcpServers": {
    "payretailers": {
      "command": "node",
      "args": ["C:/Tools/payretailers-mcp/dist/index.js"],
      "env": {
        "PAYRETAILERS_ENV": "sandbox",
        "PAYRETAILERS_SHOP_ID": "your_sandbox_shop_id",
        "PAYRETAILERS_SECRET_KEY": "your_sandbox_secret_key",
        "PAYRETAILERS_SUBSCRIPTION_KEY": "your_sandbox_subscription_key"
      }
    }
  }
}

env 块是可选的 — Resources、search_docs 和所有验证器无需任何凭据即可工作。

Claude Desktop

添加到你的 claude_desktop_config.json:

  • macOS:~/Library/Application Support/Claude/claude_desktop_config.json

  • Windows:%APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "payretailers": {
      "command": "node",
      "args": ["C:/Tools/payretailers-mcp/dist/index.js"]
    }
  }
}

Windsurf

添加到 ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "payretailers": {
      "command": "node",
      "args": ["C:/Tools/payretailers-mcp/dist/index.js"]
    }
  }
}

VS Code + Copilot

添加到 .vscode/mcp.json(工作区),或通过命令面板 → MCP: Open User Configuration 打开用户级文件:

{
  "servers": {
    "payretailers": {
      "type": "stdio",
      "command": "node",
      "args": ["C:/Tools/payretailers-mcp/dist/index.js"]
    }
  }
}

注意:VS Code 是个例外 — 根键是 "servers"(而非 "mcpServers")。MCP 工具仅在 Copilot Chat 的 Agent 模式下运行。

Zed

添加到 ~/.config/zed/settings.json:

{
  "context_servers": {
    "payretailers": {
      "command": {
        "path": "node",
        "args": ["C:/Tools/payretailers-mcp/dist/index.js"]
      }
    }
  }
}

Continue.dev

添加到 ~/.continue/config.json:

{
  "mcpServers": [
    {
      "name": "payretailers",
      "command": "node",
      "args": ["C:/Tools/payretailers-mcp/dist/index.js"]
    }
  ]
}

JetBrains AI Assistant

打开 Settings → AI Assistant → MCP Servers → Add 并输入:

  • Name:payretailers

  • Command:node

  • Arguments:C:/Tools/payretailers-mcp/dist/index.js(绝对路径)

其他客户端

任何支持通过 stdio 使用 MCP 的客户端都可以使用此服务器。将其指向 node <absolute-path-to>/dist/index.js 即可。

当 npm 可用时

当 @payretailers/mcp 发布到 npm 后,相同的配置可以使用更简短的形式:

{ "command": "npx", "args": ["-y", "@payretailers/mcp"] }

无需更改 env,也无需保留解压文件夹。


验证是否正常工作

重新加载 MCP 客户端后,你应该在服务器的状态条目上看到类似:

7 个工具 · 158 个资源 · 7 个提示词 · 5 个资源模板

  • Cursor:Ctrl+Shift+P → Customize → MCPs 选项卡。查找带绿色圆点的 payretailers 并展开它。

  • Claude Desktop:在新聊天中检查工具抽屉;PayRetailers 工具应与其他 MCP 一起出现。

  • VS Code / Zed / Continue.dev / Windsurf:查阅各客户端文档中的 MCP 状态面板。

如果你的助手似乎没有调用工具,请通过在提示词前加上 "Use the PayRetailers MCP to..." 来强制调用一次。一旦它在对话中调用过一次工具,它往往会继续这样做。


故障排查

服务器无法启动。 从终端手动运行该 bundle:

node /path/to/payretailers-mcp/dist/index.js

如果它保持静默等待输入,则 bundle 没有问题 — 问题出在客户端(配置中的路径拼写错误、Windows 上正斜杠与反斜杠的问题、重启了错误的进程)。如果它打印错误,最常见的原因是 Node < 20(升级 Node)或下载不完整(重新下载 zip)。

客户端显示旧计数(例如 5 个工具、89 个资源)。 某些客户端会缓存 MCP 工具/资源的枚举结果。在客户端的 MCP 面板中将服务器切换为 OFF → ON,或在配置中添加一个未使用的 env 条目(例如 "MCP_VERSION": "0.4.1")以强制重新生成进程。

模型似乎没有调用任何 MCP 工具。 确保聊天处于 Agent 模式(而非 Ask / 只读模式)。一些轻量级模型不太愿意调用工具 — 在首次调用时切换到顶级模型,助手将在对话的其余部分记住这些工具可用。

日志在哪里? 每个 MCP 客户端都有一个 MCP 日志面板,用于捕获 JSON-RPC 握手、解析错误和服务器 stderr。在 Cursor 中:Ctrl+Shift+U → 下拉菜单 → MCP Logs。


环境变量

可选 — 仅将来的 simulate_transaction 工具(阶段 4)需要。其他所有内容(Resources、search_docs、Prompts)无需任何凭据即可工作。

变量

描述

默认值

PAYRETAILERS_ENV

sandbox 或 production。

sandbox

PAYRETAILERS_SHOP_ID

商户门户中的 Shop ID。

(未设置)

PAYRETAILERS_SECRET_KEY

用于 HTTP Basic Auth 的 Secret Key。

(未设置)

PAYRETAILERS_SUBSCRIPTION_KEY

Ocp-Apim-Subscription-Key 请求头的值。

(未设置)

安全性: 服务器从不记录凭据,也从不持久化凭据。它们仅在会话期间驻留于内存中,并且仅在你调用 simulate_transaction 时发送到 api-sandbox.payretailers.com 或 api.payretailers.com。


使用示例

配置完成后,用自然语言向你的 AI 助手提问:

"Create my first PIX payin in the sandbox for R$50 in Brazil. Use Node.js."

在底层,助手将:

  1. 调用 search_docs({ query: "pix payin brazil" }) → 找到 brazil-pix-payin skill。

  2. 读取 payretailers://skill/brazil-pix-payin 获取确切步骤。

  3. 使用正确的端点、请求头、最小货币单位和 CPF 格式生成可运行代码。

或者直接使用 /integrate-pix-payin 提示词获取完整搭建的答案。

提交前验证 payload

一旦助手起草了 payload,它可以在调用 API 之前进行验证:

// tools/call → validate_payload
{
  "operation": "create-transaction",
  "country": "BR",
  "method": "PIX",
  "payload": {
    "trackingId": "abc-12345678",
    "amount": 100.50,              // will be flagged: use 10050 (minor units)
    "currency": "USD",             // will be flagged: BR expects BRL
    "notificationUrl": "http://example.com/wh", // will be flagged: must be HTTPS
    "customer": {
      "firstName": "Ana",
      "lastName": "Santos",
      "email": "ana@example.com",
      "personalId": "12345678900"  // will be flagged: invalid CPF checksum
    }
  }
}

响应会列出每个问题,包含 code、severity、path、message,通常还有 hint 和 suggestion — LLM 可以在浪费一次网络往返之前修复 payload。


开发

git clone https://github.com/payretailers-dev/payretailers-mcp.git
cd payretailers-mcp
npm install
npm run build          # generates dist/index.js
npm test               # 93 unit tests
node scripts/smoke-test.mjs   # end-to-end stdio handshake + tool calls
npm start              # optional: run the server manually on stdio

data/(Guides、Skills、Reference、Recipes、概念文档、精选 JSON)已纳入版本控制。仅当你检出了 ../payretailers-ai-docs 并希望刷新镜像时,才运行 npm run sync:docs。

可以使用官方 MCP Inspector 检查服务器:

npx @modelcontextprotocol/inspector node dist/index.js

发布(维护者)

发布通过 GitHub Actions 在标签推送(v*.*.*)时自动进行。工作流程:

  1. 运行 lint、类型检查、单元测试、构建和冒烟测试。

  2. 运行 npm run pack:release 生成 release/payretailers-mcp-vX.Y.Z.zip(打包的 dist/index.js + data/ 镜像 + README + LICENSE + CHANGELOG + 冒烟测试)。

  3. 创建 GitHub Release 并附加 zip。

  4. 仅当配置了 NPM_TOKEN 仓库密钥时才发布到 npm 作为 @payretailers/mcp — 否则该 release 仅限 GitHub。

要在本地发布,然后推送标签:

# 1. Bump version in package.json, config.ts, CHANGELOG.md
# 2. Verify locally
npm run clean && npm ci && npm test && npm run build
node scripts/smoke-test.mjs
npm run pack:release        # writes release/payretailers-mcp-vX.Y.Z.zip

# 3. Commit + tag + push
git add -A
git commit -m "chore: release vX.Y.Z"
git tag vX.Y.Z
git push origin main
git push origin vX.Y.Z      # this triggers .github/workflows/release.yml

严格强制语义化版本:补丁版本修复 bug,次要版本在不破坏现有功能的前提下添加工具/提示词/资源,主版本仅用于重命名/移除。


路线图

  • 0.1 ✅ Resources(Guides、Skills)、search_docs、integrate-pix-payin 提示词。

  • 0.2 ✅ Resources(Reference、Recipes)、get_country_rules、get_test_data、get_endpoint_spec、提示词 integrate-payout-fx、build-checkout、debug-401-auth、reconcile-with-graphql。

  • 0.3 ✅ validate_payload,支持 CPF、CNPJ、RUT、DNI、RUC、CC、NIT、CURP、RFC、CLABE 的真实校验和验证 + 跨领域规则(最小货币单位、货币/国家、HTTPS webhook、方式/国家、幂等性)。

  • 0.4 ✅ 概念文档资源类别、get_webhook_playbook、validate_webhook_handler、为订阅操作扩展的 validate_payload、提示词 implement-webhook-handler、integrate-subscriptions。

  • 0.4.1 ✅ 订阅模式对齐(AmountModel、frequency 枚举、authorizationType)— CHANGELOG.md。

  • 0.5 — simulate_transaction(针对沙箱的干跑)、get_error_code、扩展国家覆盖范围。

  • 1.0 — 稳定公开版本 + 列入 官方 MCP Registry + npm 发布。

详见 CHANGELOG.md。


相关


许可证

源代码:MIT。参见 LICENSE。

data/ 中捆绑的文档内容(Guides、Skills、Reference、Recipes)根据 CC BY-ND 4.0 许可,继承自 payretailers-ai-docs 仓库。精选数据文件(data/country-rules.json、data/test-data.json)也以 CC BY-ND 4.0 发布。


贡献

欢迎通过 GitHub Issues 提交 bug 报告和功能请求。社区提交的 Pull Request 会被审查,但由 PayRetailers 团队酌情合并 — 可用时参见 CONTRIBUTING.md。

Available Tools

7 tools
get_country_rulesA

Return the country-specific rules for a PayRetailers integration: accepted currencies, personalId format (CPF, DNI, CLABE, RUT, ...), payment method constraints, and regulatory notes. Call this before emitting any country-specific payload.

NameRequiredDescriptionDefault
methodNoOptional payment method filter (e.g. 'PIX', 'ALIAS_CVU', 'SPEI', 'CARD', 'BRE_B'). If omitted, returns full country rules.
countryYesISO 3166-1 alpha-2 country code. Supported: BR, AR, MX, CO, CL, PE. Use uppercase.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and it does well: 'Return' signals a safe read, and the description discloses exactly what the response contains (currencies, personalId, constraints, notes). It adds the workflow context of calling before payload emission. It doesn't cover failure behavior for unsupported countries, but the core behavior is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences of densely packed information: the purpose plus content enumeration, followed by a single directive. No filler, and the most important constraint (when to call) is placed clearly at the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple lookup with 2 fully-documented parameters and no output schema, the description compensates well by detailing what the return value contains. The only minor omission is error handling for unsupported country codes, but the schema already lists the supported countries, so the description is complete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both 'country' and 'method' are already well documented in the schema, including the supported values and formatting rules (uppercase, ISO code). The description adds no parameter detail beyond what the schema provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Return') and resource ('country-specific rules') and enumerates the exact content: accepted currencies, personalId formats, payment method constraints, and regulatory notes. This clearly distinguishes it from siblings like search_docs and get_endpoint_spec, which serve different lookup purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides an explicit when-to-call directive: 'Call this before emitting any country-specific payload.' This frames the tool as a prerequisite step in the integration flow. It lacks explicit exclusions or named alternatives, but the precondition is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_endpoint_specA

Return the full reference page (parameters, response, error codes) for a specific PayRetailers endpoint. Use this to ground your generated code against the exact request/response schema before emitting it.

NameRequiredDescriptionDefault
sectionNo'full' returns the entire reference page. 'summary' returns just the top of the page. Default 'full'.
endpointYesEndpoint slug or logical name. Examples: 'create-transaction', 'create-payout', 'createpayoutquote', 'get-payment-methods', 'post_v1-subscriptions'. Case-insensitive.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses what the tool returns (parameters, response, error codes), which is the core behavior. However, it doesn't mention any potential error handling, rate limits, or any side effects. As a read-only retrieval, this is acceptable but not exceptionally transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences. The first sentence states the core function, and the second provides usage context. No filler words, and the most critical information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Since there is no output schema, the description correctly explains what the response contains ('parameters, response, error codes'). It covers the essential information for a retrieval tool. The 'section' parameter is described in the schema, so no need to repeat. Slightly more could be said about expected size or format, but it is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add any extra meaning beyond what the schema already documents for 'section' and 'endpoint' – it simply restates the purpose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return'), a clear resource ('full reference page'), and the specific content ('parameters, response, error codes'). It clearly distinguishes itself from siblings like search_docs by being the tool that retrieves a specific endpoint's spec.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a clear use case: 'to ground your generated code against the exact request/response schema before emitting it.' This tells the agent when to use it. It doesn't explicitly mention alternatives, but the sibling list includes search_docs, which is likely for broader searching, so the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_test_dataA

Return official-shaped sandbox test data for a country: sample customers (name, email, personalId in correct format, address), test cards (approved/declined), and PIX/Bre-B keys where applicable. Use this to populate sandbox requests with realistic values instead of inventing them.

NameRequiredDescriptionDefault
countryYesISO 3166-1 alpha-2 country code. Supported: BR, AR, MX, CO, CL, PE.
sectionNoWhich section of test data to return. 'all' returns everything. Defaults to 'all'.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the burden of behavioral disclosure. The description implies a read-only data fetch (returning data) but does not explicitly state that it makes no changes or that it is safe to call. It also does not mention error cases, rate limits, or the exact structure of the returned data. Adequate for a simple retrieval, but lacks depth given the absence of annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero filler. The primary action and scope are front-loaded, followed by a concise usage recommendation. Every word earns its place; no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only 2 parameters, no output schema, and no nested objects, the description covers the essential information: what is returned, its purpose, and how to invoke it. It could optionally describe the response structure more explicitly, but the types of data are listed, which is sufficient for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — both 'country' and 'section' have descriptions, including supported values and defaults. The description adds context about why these parameters matter (to populate realistic sandbox requests) but does not add syntax or format details beyond what the schema already covers. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Return' and the resource 'official-shaped sandbox test data for a country', enumerating the exact contents (customers, test cards, PIX/Bre-B keys). This is specific and distinct from sibling tools like get_country_rules or get_endpoint_spec, making it easy for an agent to identify this as the correct tool for generating test data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this to populate sandbox requests with realistic values instead of inventing them', which gives clear context on when to use it. It does not explicitly state when not to use it or compare to alternatives, but the purpose is clear enough that an agent would not confuse it with the sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_webhook_playbookA

REQUIRED before implementing any webhook receiver or reconciliation flow. Returns the canonical PayRetailers webhook contract: envelope schema, complete event vocabulary (transaction lifecycle: PENDING/IN_PROGRESS/APPROVED/REJECTED/CANCELLED/EXPIRED/REFUNDED/CHARGEBACK; payout lifecycle; subscription and subscription_payment events with retry semantics), HTTP response contract (200 fast / 400 no-retry / 500 retried), idempotency by eventId, replay protection, signature verification, retry policies (PIX_SPECIFIC / FIXED_RETRY / NOT_ALLOWED), and the top 6 wrong-way patterns integrators hit. Filter by category or eventType for a focused answer. Do not attempt to design a webhook handler from memory — call this tool first.

NameRequiredDescriptionDefault
categoryNoFilter events by lifecycle. 'transaction' = payin events; 'payout' = payout events; 'subscription' = subscription entity events (activation/cancellation); 'subscription_payment' = recurring charge events; 'all' (default) returns the complete catalog.
eventTypeNoFilter by a specific eventType string (e.g. 'subscription.payment', 'transaction'). Case-sensitive as declared by the API.
includeDeliveryNoInclude the delivery / retry / signature section. Defaults to true. Set to false if you only need the event vocabulary.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full disclosure burden. It states the tool is a read-only retrieval operation ('Returns') and details all delivered content: event vocabulary, retry policies, signature verification, etc. It does not claim any side effects or mutations. The emphasis that integrators should not rely on memory signals the tool's authoritative nature. This is sufficient behavioral transparency for a query tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but densely packed with essential information, organized as a list of contract aspects and retry policies. The mandatory-use warning is front-loaded, and every sentence contributes value. While verbose, the complexity of webhook contracts justifies the detail; there is no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must explain the return value, and it does so extensively: it lists envelope schema, event categories, HTTP response codes, idempotency, replay protection, signature verification, retry policies, and common mistakes. It also explains parameter usage for scoping results. For a reference tool covering a complex integration surface, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the three parameters (category, eventType, includeDelivery) are fully documented in the schema with enums and examples. The description only adds a generic suggestion to filter by category or eventType, but does not introduce new semantic meaning beyond the schema. Per the rubric, baseline 3 is appropriate when the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Returns') and resource ('canonical PayRetailers webhook contract') and enumerates the exact contents: envelope schema, event vocabulary, HTTP response contract, idempotency, replay protection, signature verification, retry policies, and common pitfalls. This clearly differentiates it from siblings like search_docs or get_endpoint_spec, which are generic or endpoint-specific rather than webhook-contract-specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly mandates when to use the tool: 'REQUIRED before implementing any webhook receiver or reconciliation flow' and 'Do not attempt to design a webhook handler from memory — call this tool first.' It also advises filtering by category or eventType for focused answers, giving clear guidance on how to invoke it effectively. No alternatives are mentioned, but the tool is positioned as the definitive prerequisite, so exclusion guidance is unnecessary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_docsA

Search across PayRetailers Guides and Skills. Returns top matches with a short snippet. Use this before answering any integration question to ground your response in the official documentation.

NameRequiredDescriptionDefault
limitNoMaximum number of results to return. Default 10.
queryYesFree-text query. Examples: 'pix payout', 'validate cpf', 'fx quote'.
categoryNoOptional category filter. 'guide' = end-to-end tutorial. 'skill' = task-focused workflow.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description carries the full burden. It discloses the search-and-return behavior (returning matches with snippets) but does not mention permissions, rate limits, or side effects. It's adequate for a search tool but leaves notable gaps in behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences: the first states the purpose and output, the second gives the usage directive. Every word earns its place, and the key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward 3-parameter tool with full schema coverage and no output schema, the description supplies enough context for correct usage, including a strong usage hint. It omits details like pagination or error handling, but these are minor for a search tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage with rich descriptions (e.g., query examples, category enum explanations, limit bounds). The description adds little beyond restating the scope, so it meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Search'), a distinct resource ('PayRetailers Guides and Skills'), and the output format ('top matches with a short snippet'). This effectively differentiates it from sibling tools that fetch specific data (e.g., get_endpoint_spec, get_country_rules).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides an explicit 'when to use' directive: 'Use this before answering any integration question to ground your response in the official documentation.' This clearly signals the primary use case, but it lacks explicit mention of alternatives or when not to use the tool, so it doesn't reach a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_payloadA

REQUIRED whenever the user shows or you are about to emit a JSON body for POST /transactions, POST /payouts, POST /customers, POST /v1/subscription-products, POST /v1/subscriptions, or POST /v1/subscription-payments — even if the payload looks correct. Runs the same checks a senior PayRetailers integrator would run in code review: country-specific document checksum (CPF, CNPJ, RUT, DNI, RUC, CC, NIT, CURP, RFC, CLABE), minor-units-as-string amount format, currency/country match, HTTPS notificationUrl, method/country compatibility (PIX only BR, BRE_B only CO, SPEI only MX, etc.), idempotency key length, trackingId ≤ 50 chars, customer required fields matrix (customer.ip / customer.country always; city+address in CO or card in EC/MX; zip on cards in EC/MX; phone on Boleto/Efecty/PagoEfectivo/Yape/Plin/WesternUnion-PA/African methods). For subscriptions: enforces billingCycle shape, Bacen PIX_SPECIFIC contract (maxRetries=3 / retryIntervalDays=7 fixed for BR PIX Automático), FIXED_RETRY config completeness, and authorisationJourney vocabulary (BACKGROUND / USER_INTERACTION). Returns machine-readable {errors, warnings, info} with code, path, severity, hint and often a suggestion — pipe those back into the corrected payload before you show any curl / SDK call to the user. Do not skip: a payload that 'looks fine' but hits the API returns generic 4xx errors that are far harder to interpret than the codes this tool emits.

NameRequiredDescriptionDefault
methodNoPayment method (e.g. 'PIX', 'CARD', 'SPEI', 'BRE_B', 'ALIAS_CVU'). Enables method-specific rules.
countryNoISO 3166-1 alpha-2 country code. If omitted, taken from payload.country. Determines the personalId format to validate.
payloadYesThe JSON body you're about to POST to the PayRetailers API. Pass it verbatim (no headers, just the body).
operationYesWhich PayRetailers operation the payload targets. Each operation has its own required fields.
environmentNo'sandbox' allows local/private notificationUrls (with a hint). 'production' rejects them. Default: 'sandbox'.
personalIdTypeNoExplicit personalId type. If omitted, inferred from country + value shape (e.g. BR + 11 digits → CPF).

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the return format ({errors, warnings, info} with code, path, severity, hint, suggestion) and warns that 'looks fine' payloads still need validation—setting expectations that the tool may catch issues even when the user thinks they're correct. It does not explicitly state non-behavior like 'does not make API calls' or 'no side effects', but the description implies a read-only validation function. It adds substantial context beyond the schema, justifying a 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very long, though it front-loads the critical usage note ('REQUIRED whenever') and structures the validations as a list. Every sentence adds useful detail, but it could be more concise by grouping related checks. For a tool with high complexity, the length is defensible, but it is not tightly packed—several clauses could be trimmed without loss of meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 parameters, nested objects, many validation rules) and the absence of an output schema, the description is remarkably complete. It covers all the inputs' roles, the full set of validations, the output structure, and why skipping is risky. An agent would have everything needed to decide whether and how to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is stated as 100%, so the baseline is 3. The description reinforces parameter roles (e.g., 'operation' selects the rule set, 'environment' affects notificationUrl checks, 'personalIdType' inference) but adds no new parameter info beyond what the schema already describes. It does contextualize why parameters matter, but not enough to exceed baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific, actionable purpose: validating JSON payloads for a defined set of PayRetailers POST endpoints. It enumerates the exact operations and lists the specific validation checks (CPF/CNPJ checksums, amount format, currency/country match, etc.), making the tool's function unambiguous and distinct from sibling tools like search_docs or get_endpoint_spec.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when the tool is REQUIRED ('REQUIRED whenever... even if the payload looks correct') and explains why (generic 4xx errors are hard to interpret). It also directs the user to pipe the returned errors/warnings back into the payload, effectively telling them the expected workflow. No exclusions or alternatives are mentioned, but the tool is clearly the primary validator for these operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_webhook_handlerA

REQUIRED whenever the user is designing, describing, or about to code a webhook receiver for PayRetailers — even if the design looks fine. Analyses a declarative description of the handler (URL, processing mode, ack strategy, idempotency, signature verification, replay protection, error mapping, ordering assumptions) against the PayRetailers contract and returns {errors, warnings, info} with actionable codes. Catches the top failure modes: acknowledging AFTER processing (times out and gets retried), returning 500 on business errors (infinite retries), missing eventId de-duplication (double-fulfilment), assuming wall-clock order (state corruption), HTTPS missing, signature disabled in production, replay window absent. Pair with get_webhook_playbook when designing from scratch.

NameRequiredDescriptionDefault
urlYesThe public URL that will receive PayRetailers webhook POSTs.
orderingNoWhether the handler relies on wall-clock order of events for the same entityId. Real deliveries can arrive out-of-order; a handler that assumes order will corrupt state.
ackStrategyYesWhen the handler returns 200: 'before-processing' (recommended), 'after-processing' (blocks retries but risks timeouts), 'conditional-on-outcome' (dangerous: business errors trigger retries).
environmentNoDeployment target for this handler. Defaults to 'sandbox'.
ipAllowlistNoOptional IP allowlist. NOT sufficient by itself — always combine with signature verification.
errorHandlingNoHow the handler maps internal exceptions to HTTP status. Business errors ('order not found') should NOT return 500 — that triggers infinite retries.
processingModeYesHow the handler processes the event: 'sync-in-request' = all business logic runs before returning 200; 'async-queue' = enqueue and return 200 immediately (recommended); 'async-thread' = fire-and-forget in-process background thread.
languageOrStackNoOptional stack hint (e.g. 'C# ASP.NET 8', 'Node.js Express', 'Python FastAPI'). Only used to sharpen suggestions.
replayProtectionNoOptional replay protection based on eventDate. Recommended: enabled=true with maxAgeMinutes=5.
idempotencyStrategyYesHow duplicate deliveries are de-duplicated. 'by-eventId' is the required strategy.
signatureVerificationYesHow the handler treats the PayRetailers webhook signature. 'strict' = reject on mismatch (recommended); 'log-only' = log and continue; 'disabled' = no verification (only acceptable for sandbox).
idempotencyStoreTtlDaysNoHow long processed eventIds are retained. Recommended >= 30 days to survive replay attempts and backlogs.
responseTargetLatencyMsNoExpected p95 latency of your endpoint in milliseconds. PayRetailers targets < 3000 ms for the 200 ack.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It clearly states the return structure ({errors, warnings, info} with actionable codes) and the specific failure modes it catches (acknowledging after processing, returning 500 on business errors, missing idempotency, etc.), giving an agent a concrete mental model of what the tool will do. It does not go into output detail beyond that, but for a static-analysis/validation tool this is adequate; a 4 is warranted because it is explicit and actionable without being exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than typical but every sentence earns its place: the usage directive is front-loaded, the evaluation scope is itemized, and the failure-mode list is concrete and useful. The only slight inefficiency is the duplication of some schema-derived concepts (like the retry risks), but overall it's tightly packed with high-signal guidance rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (13 parameters, 6 enums, nested objects, no output schema), the description is remarkably complete. It states the contract (payload fields), the output format, the key failure modes, and even mentions pairing with a related tool. It could include an example of the 'actionable codes', but the description's coverage of usage, scope, and behavior is sufficient for an agent to decide whether to call it and roughly what to provide.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — every parameter has a substantive description (e.g., ackStrategy explains the three options and warns about 'conditional-on-outcome', idempotencyStrategy says 'by-eventId' is required). The tool description itself adds only a few high-level hints (like the list of failure modes that map to parameters) but does not go beyond what the schema already explains. Since the schema does the heavy lifting, the baseline 3 is appropriate; the description reinforces but does not add new parameter-specific meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Analyses') and a precise resource ('a declarative description of the handler... against the PayRetailers contract') and enumerates the exact inputs (URL, processing mode, ack strategy, etc.) and the output shape ({errors, warnings, info}). It also distinguishes itself from the sibling get_webhook_playbook by naming it explicitly, leaving no ambiguity about which tool fits a design-from-scratch task.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The opening word 'REQUIRED' plus the explicit trigger condition ('whenever the user is designing, describing, or about to code a webhook receiver') makes the when-to-use unmistakable. It also states an alternative ('Pair with get_webhook_playbook when designing from scratch') and even cautions that the tool is needed 'even if the design looks fine', closing off the common excuse of skipping validation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.4.1
    • First observedget_country_rules
    • First observedget_endpoint_spec
    • First observedget_test_data
    • First observedget_webhook_playbook
    • First observedsearch_docs
    • First observedvalidate_payload
    • First observedvalidate_webhook_handler

TDQS

A4.4/5.0

Scored across 7 tools

Disambiguation5/5

Each tool targets a distinctly different aspect of the integration workflow: searching docs, retrieving country-specific rules, fetching test data, getting endpoint schemas, validating payloads, validating webhook handlers, and retrieving webhook playbook. There is no overlap in purpose, and descriptions make boundaries crystal clear.

Naming Consistency5/5

All tool names follow a consistent verb_noun snake_case pattern (search_docs, get_country_rules, validate_payload, etc.). No mixed conventions or ambiguous verbs appear, making the set predictable and easy to navigate.

Tool Count5/5

With 7 tools, the server is well-scoped for its purpose as a PayRetailers integration assistant. Each tool earns its place—offering documentation search, country rules, test data, endpoint specs, payload validation, webhook validation, and webhook playbook—without unnecessary bloat.

Completeness5/5

The tool surface comprehensively covers the core integration lifecycle: grounding in docs, country-specific rules, sandbox test data, endpoint schemas, payload validation, and webhook design/validation. It addresses the primary pain points integrators face, leaving no obvious gaps for common tasks.

Maintenance

ActivityStale
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers