Skip to main content
Glama
ramigs

payments-toolkit-mcp

by ramigs

payments-toolkit-mcp

A minimal Model Context Protocol (MCP) server, built as a hands-on learning project (see PLAN.md for the full step-by-step walkthrough).

It exposes payments-related validation utilities as MCP tools, one static resource, and one prompt template — all local logic, no network calls, no API keys required.

Tools

  • validate_card_number — Luhn checksum validation for a card number (digits only, 8-19 length).

  • detect_card_type — identifies the card network (Visa, Mastercard, American Express, Discover, Diners Club, JCB) from the IIN/BIN prefix. Bound to the card-preview MCP App widget.

  • validate_iban — format, country-specific length, and ISO 13616 mod-97 checksum validation for an IBAN. Bound to the iban-preview MCP App widget; its result also carries the country name and flag SVG.

Related MCP server: stripe-mcp-server

Resources

  • card_networks (payments-toolkit://card-networks) — static JSON listing of supported card networks and their prefix ranges.

  • card-preview (ui://payments-toolkit/card-preview) — MCP App widget HTML rendered by detect_card_type.

  • iban-preview (ui://payments-toolkit/iban-preview) — MCP App widget HTML rendered by validate_iban; shows the grouped IBAN, its country and flag, and whether the checksum passed. Flags are vendored from flag-icons (MIT) by pnpm run vendor:flags.

Prompts

  • check_payment_details — takes an optional cardNumber and/or iban argument and returns a message instructing the model to run the relevant tools and summarize the results. Unlike tools, prompts are invoked explicitly by the user (e.g. as a /mcp__payments-toolkit-mcp__check_payment_details slash command in Claude Code), not chosen autonomously by the model.

Prerequisites

  • Node.js 18+ (project developed against v24)

  • pnpm

Setup

pnpm install
pnpm run build

Usage

The server supports two transports, chosen at startup.

Stdio (default — one client per process, e.g. Claude Code/Desktop):

pnpm run start

Streamable HTTP (a single long-running server multiple clients can connect to over POST/GET/DELETE /mcp, with sessions keyed by the Mcp-Session-Id header):

pnpm run start:http          # listens on PORT (default 3000)
PORT=4000 pnpm run start:http

Inspect and call the tools/resource directly via a local web UI, without wiring up a client:

pnpm run inspect

Testing

pnpm test              # run the full suite once
pnpm run test:watch    # re-run on file changes
pnpm run test:coverage # run once and print a coverage report

Tests are split into two kinds, mirroring src/:

  • tests/unit/ — pure logic (src/lib/*), no MCP or HTTP involved.

  • tests/integration/server.test.ts wires the real McpServer to a real Client over an in-memory transport and drives it through tools/resources/prompts; http.test.ts drives the Streamable HTTP transport's Express app directly with supertest to cover session creation/reuse/teardown.

Connect to Claude Code

Over stdio:

claude mcp add payments-toolkit-mcp -- node /path/to/payments-toolkit-mcp/dist/index.js
claude mcp list

Over HTTP (start the server with pnpm run start:http first):

claude mcp add --transport http payments-toolkit-mcp http://localhost:3000/mcp

Inside a Claude Code session, run /mcp to confirm the connection and see the discovered tools/resources/prompts. If you add or change a prompt after the session already connected, reconnect via /mcp (or restart the session) — the prompt list is enumerated at connection time.

Project structure

src/
  index.ts                   # entry point: picks a transport from argv/env
  server.ts                  # factory: builds an McpServer with tools/resources/prompts registered
  transports/
    stdio.ts                 # single-session stdio transport
    http.ts                  # StreamableHTTPServerTransport, one server instance per session
  lib/                       # pure validation/lookup logic (no MCP dependency)
    luhn.ts
    card-networks.ts
    iban.ts
    flags.ts                 # loads one vendored country flag SVG on demand
    schemas.ts
  tools/                     # one file per registered MCP tool
    validate-card-number.ts
    detect-card-type.ts
    validate-iban.ts
  resources/                 # one file per registered MCP resource
    card-networks.ts
    card-preview.ts          # serves the detect_card_type widget HTML
    iban-preview.ts          # serves the validate_iban widget HTML
  prompts/                    # one file per registered MCP prompt
    check-payment-details.ts
  ui/                        # MCP App widgets, bundled to one HTML file each by Vite
    card-preview/
    iban-preview/            # includes flags/ — vendored, served by validate_iban
scripts/
  vendor-flags.mjs           # regenerates src/ui/iban-preview/flags from flag-icons
  copy-flags.mjs             # copies those flags into dist/ during build
tests/
  unit/lib/                   # unit tests for src/lib, mirrored 1:1
  integration/
    server.test.ts            # McpServer <-> Client over an in-memory transport
    http.test.ts              # Streamable HTTP transport, via supertest

Notes

  • Never console.log in this server — over stdio, stdout is reserved for the JSON-RPC protocol stream. Use console.error for any debug output (harmless but kept consistent for the HTTP transport too).

  • Each MCP server instance can only be connect()-ed to one transport, so the HTTP transport creates a fresh McpServer per session (keyed by Mcp-Session-Id) rather than sharing one across clients.

Available Tools

3 tools
detect_card_typeDetect Card TypeA

Identifies the card network (Visa, Mastercard, American Express, Discover, Diners Club, JCB) from the card number's IIN/BIN prefix. Accepts digits only (spaces/dashes should be stripped by the caller).

ParametersJSON Schema
NameRequiredDescriptionDefault
cardNumberYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
networkYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the core behavior (uses the IIN/BIN prefix) and the input requirement (digits only, caller must strip spaces/dashes). However, it does not describe what happens for invalid inputs (e.g., unknown prefix, out-of-specified length) or clarify that it performs no validation (suggested by sibling). There is no mention of side effects, but none are expected. It provides some transparency but leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences that pack essential information: purpose, network list, and input preprocessing instruction. There is no extraneous text. It front-loads the core action and follows with important input guidance. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple with one parameter and an output schema, so description need not explain return values. It covers purpose, input format, and the IIN/BIN mechanism. It lacks explicit caveats (e.g., handling of unknown networks, validation not performed) but given complexity and annotations, it is reasonably complete. The lack of usage guidance vs. siblings is a minor gap, but overall adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds value beyond the schema: it clarifies the parameter is the full card number and explicitly states that spaces/dashes should be removed, which complements the pattern '^\d{8,19}$'. It also explains the number's use (IIN/BIN prefix) that the schema doesn't convey. However, it does not mention the parameter name by name or provide additional format details (e.g., maximum length, examples). Given the schema has strong constraints, the description provides marginal extra semantics but not complete coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Identifies the card network (Visa, Mastercard, American Express, Discover, Diners Club, JCB) from the card number's IIN/BIN prefix.' It specifies the resource (card number) and the action (detect card type), and lists the distinct networks. This distinguishes it from siblings like 'validate_card_number' (validation) and 'validate_iban' (IBAN), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description notes an input precondition: 'Accepts digits only (spaces/dashes should be stripped by the caller).' This is a clear usage instruction on formatting, but it does not provide guidance on when to choose this tool versus the sibling tools (validate_card_number, validate_iban). The usage is implied by the tool's name and purpose, but no explicit alternatives or exclusions are given. As such, it is adequate but not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_card_numberValidate Card NumberA

Checks whether a card number passes the Luhn checksum algorithm. Accepts digits only (spaces/dashes should be stripped by the caller).

ParametersJSON Schema
NameRequiredDescriptionDefault
cardNumberYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
validYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It states the algorithm (Luhn) and input requirements (digits only, spaces/dashes stripped by caller), which is useful. However, it does not disclose what happens on invalid input (e.g., return value or error behavior) or any other side effects, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose, and every sentence adds value. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, clear algorithm) and the presence of an output schema, the description is fairly complete. It covers the algorithm, input constraints, and caller responsibility. It could mention the return format (boolean) but the output schema likely covers that, so this is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description must compensate. It explains that the cardNumber should be digits only and that spaces/dashes should be stripped, which adds meaning beyond the schema's pattern. However, it does not explain the expected format beyond digits (e.g., length range) or the meaning of the return value, so it only partially compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Checks whether a card number passes the Luhn checksum algorithm.' It uses a specific verb ('checks') and resource ('card number'), and the mention of the Luhn algorithm distinguishes it from sibling tools like detect_card_type and validate_iban.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool (to validate a card number via Luhn) and includes a usage note about stripping spaces/dashes. However, it does not explicitly state when not to use it or mention alternatives like validate_iban for other validation needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_ibanValidate IBANA

Validates an International Bank Account Number (IBAN): checks the country-specific length and the ISO 13616 mod-97 checksum. Spaces are stripped and letters are case-insensitive.

ParametersJSON Schema
NameRequiredDescriptionDefault
ibanYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
validYes
countryNo

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With zero annotations, the description carries full burden and does add useful non-obvious behaviors: spaces are stripped and letters are case-insensitive. However, it omits other behavioral traits like side-effect-free execution, error behavior on invalid input, or whether validation is local. Adds genuine context but doesn't fully cover the space.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences: the first states purpose and validation depth; the second covers input normalization edge cases. Zero wasted words, information density is excellent, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter validation tool with an output schema, this description is nearly complete: it explains the validation logic (length + checksum) and accepted input forms. Annotations are absent, so a note on read-only/side-effect-free semantics would push it to 5, but the scope is fully appropriate for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate—and it does by explaining that the iban string tolerates spaces (stripped) and case variations. This meaningfully enriches the bare schema definition (string, 4-50 chars). Could go further by noting whether other whitespace (tabs) is stripped, but for one parameter it's well-handled.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb ('Validates') with a well-defined resource ('International Bank Account Number (IBAN)') and names the exact validation standard (ISO 13616) and checksum algorithm (mod-97). The IBAN domain is self-evidently distinct from sibling card tools, and the technical specificity makes the tool's scope unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clarifies what 'validates' means by specifying both length checks and checksum verification, giving agents a clear sense of this tool's validation depth. However, it provides no explicit when-to-use vs. alternatives (e.g., no contrast with validate_card_number or note that this is local-only validation).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv1.0.0
    • First observeddetect_card_type
    • First observedvalidate_card_number
    • First observedvalidate_iban

TDQS

A3.9/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: validate_card_number checks Luhn, detect_card_type identifies network via prefix, and validate_iban validates IBAN. No overlap between card validation and IBAN validation, and card type detection is a separate concern.

Naming Consistency4/5

All tools follow the verb_noun pattern (validate_*, detect_*), but there's a slight inconsistency: 'validate_card_number' uses 'card_number' while 'detect_card_type' uses 'card_type', but both are clear and consistent in style. Minor deviation from uniform noun usage.

Tool Count3/5

With only 3 tools, the server is focused but feels slightly thin for a 'payments-toolkit'. The scope is narrow (validation/detection), but it could benefit from additional related tools like card expiry validation or payment amount validation. However, it's not egregiously under-scoped.

Completeness3/5

The server covers card number validation and type detection and IBAN validation, which are core payment validation tasks. However, it omits other common validations (e.g., CVV, expiry date, bank account routing numbers) and any operations beyond validation (e.g., formatting, masking). The gaps are notable but the main validation lifecycle is present.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    An MCP server for validating JSON against schemas, checking email deliverability, verifying URLs, assessing data quality, and validating API responses using RFC-compliant checks and heuristic analysis.
    6
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    A local MCP server for Stripe payment operations with 52 tools across 8 domains, featuring built-in PII redaction and strict input validation for safe AI-assisted development workflows.
    52
    37
    1
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    An MCP server that provides AI agents with tools to validate SWIFT MT and ISO 20022 MX payment messages, check BIC/IBAN correctness, and convert between MT and MX formats.
    7
    15
    MIT
  • F
    license
    A
    quality
    A
    maintenance
    A fully local, closed-world MCP server that manages, validates, and serves bank-specific ISO 20022 clearing profiles and rule packs, enabling AI agents to discover profiles, fetch them, lint payloads against them, and validate rule-pack definitions.
    4
    1
    -