payments-toolkit-mcp
This server provides payments-related validation and lookup capabilities as MCP tools, plus a static resource and a prompt template.
Validate card numbers: Check if a card number passes the Luhn checksum (digits only, 8–19 digits).
Detect card type: Identify the card network (Visa, Mastercard, Amex, Discover, Diners Club, JCB) from the card number's prefix.
Validate IBANs: Check format, country-specific length, and ISO 13616 mod-97 checksum.
Access card network data: Fetch the static
card_networksresource listing supported networks and prefix ranges.Use the check-payment-details prompt: Invoke a prompt that instructs the model to run the relevant validation tools and summarize results.
Run over multiple transports: Connect via stdio or Streamable HTTP, and inspect tools/resources with a local web UI.
Provides card number validation and network identification for American Express cards, including Luhn checksum verification and IIN/BIN prefix recognition.
Provides card number validation and network identification for Diners Club cards, including Luhn checksum verification and IIN/BIN prefix recognition.
Provides card number validation and network identification for Discover cards, including Luhn checksum verification and IIN/BIN prefix recognition.
Provides card number validation and network identification for JCB cards, including Luhn checksum verification and IIN/BIN prefix recognition.
Provides card number validation and network identification for Mastercard cards, including Luhn checksum verification and IIN/BIN prefix recognition.
Provides card number validation and network identification for Visa cards, including Luhn checksum verification and IIN/BIN prefix recognition.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@payments-toolkit-mcpCheck if this card number is valid: 4111 1111 1111 1111"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
payments-toolkit-mcp
A minimal Model Context Protocol (MCP) server, built as a hands-on learning project (see PLAN.md for the full step-by-step walkthrough).
It exposes payments-related validation utilities as MCP tools, one static resource, and one prompt template — all local logic, no network calls, no API keys required.
Tools
validate_card_number— Luhn checksum validation for a card number (digits only, 8-19 length).detect_card_type— identifies the card network (Visa, Mastercard, American Express, Discover, Diners Club, JCB) from the IIN/BIN prefix. Bound to thecard-previewMCP App widget.validate_iban— format, country-specific length, and ISO 13616 mod-97 checksum validation for an IBAN. Bound to theiban-previewMCP App widget; its result also carries the country name and flag SVG.
Related MCP server: stripe-mcp-server
Resources
card_networks(payments-toolkit://card-networks) — static JSON listing of supported card networks and their prefix ranges.card-preview(ui://payments-toolkit/card-preview) — MCP App widget HTML rendered bydetect_card_type.iban-preview(ui://payments-toolkit/iban-preview) — MCP App widget HTML rendered byvalidate_iban; shows the grouped IBAN, its country and flag, and whether the checksum passed. Flags are vendored from flag-icons (MIT) bypnpm run vendor:flags.
Prompts
check_payment_details— takes an optionalcardNumberand/oribanargument and returns a message instructing the model to run the relevant tools and summarize the results. Unlike tools, prompts are invoked explicitly by the user (e.g. as a/mcp__payments-toolkit-mcp__check_payment_detailsslash command in Claude Code), not chosen autonomously by the model.
Prerequisites
Node.js 18+ (project developed against v24)
Setup
pnpm install
pnpm run buildUsage
The server supports two transports, chosen at startup.
Stdio (default — one client per process, e.g. Claude Code/Desktop):
pnpm run startStreamable HTTP (a single long-running server multiple clients can connect
to over POST/GET/DELETE /mcp, with sessions keyed by the Mcp-Session-Id
header):
pnpm run start:http # listens on PORT (default 3000)
PORT=4000 pnpm run start:httpInspect and call the tools/resource directly via a local web UI, without wiring up a client:
pnpm run inspectTesting
pnpm test # run the full suite once
pnpm run test:watch # re-run on file changes
pnpm run test:coverage # run once and print a coverage reportTests are split into two kinds, mirroring src/:
tests/unit/— pure logic (src/lib/*), no MCP or HTTP involved.tests/integration/—server.test.tswires the realMcpServerto a realClientover an in-memory transport and drives it throughtools/resources/prompts;http.test.tsdrives the Streamable HTTP transport's Express app directly with supertest to cover session creation/reuse/teardown.
Connect to Claude Code
Over stdio:
claude mcp add payments-toolkit-mcp -- node /path/to/payments-toolkit-mcp/dist/index.js
claude mcp listOver HTTP (start the server with pnpm run start:http first):
claude mcp add --transport http payments-toolkit-mcp http://localhost:3000/mcpInside a Claude Code session, run /mcp to confirm the connection and see
the discovered tools/resources/prompts. If you add or change a prompt after
the session already connected, reconnect via /mcp (or restart the
session) — the prompt list is enumerated at connection time.
Project structure
src/
index.ts # entry point: picks a transport from argv/env
server.ts # factory: builds an McpServer with tools/resources/prompts registered
transports/
stdio.ts # single-session stdio transport
http.ts # StreamableHTTPServerTransport, one server instance per session
lib/ # pure validation/lookup logic (no MCP dependency)
luhn.ts
card-networks.ts
iban.ts
flags.ts # loads one vendored country flag SVG on demand
schemas.ts
tools/ # one file per registered MCP tool
validate-card-number.ts
detect-card-type.ts
validate-iban.ts
resources/ # one file per registered MCP resource
card-networks.ts
card-preview.ts # serves the detect_card_type widget HTML
iban-preview.ts # serves the validate_iban widget HTML
prompts/ # one file per registered MCP prompt
check-payment-details.ts
ui/ # MCP App widgets, bundled to one HTML file each by Vite
card-preview/
iban-preview/ # includes flags/ — vendored, served by validate_iban
scripts/
vendor-flags.mjs # regenerates src/ui/iban-preview/flags from flag-icons
copy-flags.mjs # copies those flags into dist/ during build
tests/
unit/lib/ # unit tests for src/lib, mirrored 1:1
integration/
server.test.ts # McpServer <-> Client over an in-memory transport
http.test.ts # Streamable HTTP transport, via supertestNotes
Never
console.login this server — over stdio, stdout is reserved for the JSON-RPC protocol stream. Useconsole.errorfor any debug output (harmless but kept consistent for the HTTP transport too).Each MCP server instance can only be
connect()-ed to one transport, so the HTTP transport creates a freshMcpServerper session (keyed byMcp-Session-Id) rather than sharing one across clients.
Available Tools
3 toolsdetect_card_typeDetect Card TypeA
Identifies the card network (Visa, Mastercard, American Express, Discover, Diners Club, JCB) from the card number's IIN/BIN prefix. Accepts digits only (spaces/dashes should be stripped by the caller).
| Name | Required | Description | Default |
|---|---|---|---|
| cardNumber | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| network | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the core behavior (uses the IIN/BIN prefix) and the input requirement (digits only, caller must strip spaces/dashes). However, it does not describe what happens for invalid inputs (e.g., unknown prefix, out-of-specified length) or clarify that it performs no validation (suggested by sibling). There is no mention of side effects, but none are expected. It provides some transparency but leaves gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences that pack essential information: purpose, network list, and input preprocessing instruction. There is no extraneous text. It front-loads the core action and follows with important input guidance. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and an output schema, so description need not explain return values. It covers purpose, input format, and the IIN/BIN mechanism. It lacks explicit caveats (e.g., handling of unknown networks, validation not performed) but given complexity and annotations, it is reasonably complete. The lack of usage guidance vs. siblings is a minor gap, but overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds value beyond the schema: it clarifies the parameter is the full card number and explicitly states that spaces/dashes should be removed, which complements the pattern '^\d{8,19}$'. It also explains the number's use (IIN/BIN prefix) that the schema doesn't convey. However, it does not mention the parameter name by name or provide additional format details (e.g., maximum length, examples). Given the schema has strong constraints, the description provides marginal extra semantics but not complete coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Identifies the card network (Visa, Mastercard, American Express, Discover, Diners Club, JCB) from the card number's IIN/BIN prefix.' It specifies the resource (card number) and the action (detect card type), and lists the distinct networks. This distinguishes it from siblings like 'validate_card_number' (validation) and 'validate_iban' (IBAN), making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes an input precondition: 'Accepts digits only (spaces/dashes should be stripped by the caller).' This is a clear usage instruction on formatting, but it does not provide guidance on when to choose this tool versus the sibling tools (validate_card_number, validate_iban). The usage is implied by the tool's name and purpose, but no explicit alternatives or exclusions are given. As such, it is adequate but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_card_numberValidate Card NumberA
Checks whether a card number passes the Luhn checksum algorithm. Accepts digits only (spaces/dashes should be stripped by the caller).
| Name | Required | Description | Default |
|---|---|---|---|
| cardNumber | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| valid | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It states the algorithm (Luhn) and input requirements (digits only, spaces/dashes stripped by caller), which is useful. However, it does not disclose what happens on invalid input (e.g., return value or error behavior) or any other side effects, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose, and every sentence adds value. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, clear algorithm) and the presence of an output schema, the description is fairly complete. It covers the algorithm, input constraints, and caller responsibility. It could mention the return format (boolean) but the output schema likely covers that, so this is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, so the description must compensate. It explains that the cardNumber should be digits only and that spaces/dashes should be stripped, which adds meaning beyond the schema's pattern. However, it does not explain the expected format beyond digits (e.g., length range) or the meaning of the return value, so it only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Checks whether a card number passes the Luhn checksum algorithm.' It uses a specific verb ('checks') and resource ('card number'), and the mention of the Luhn algorithm distinguishes it from sibling tools like detect_card_type and validate_iban.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (to validate a card number via Luhn) and includes a usage note about stripping spaces/dashes. However, it does not explicitly state when not to use it or mention alternatives like validate_iban for other validation needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_ibanValidate IBANA
Validates an International Bank Account Number (IBAN): checks the country-specific length and the ISO 13616 mod-97 checksum. Spaces are stripped and letters are case-insensitive.
| Name | Required | Description | Default |
|---|---|---|---|
| iban | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| valid | Yes | |
| country | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations, the description carries full burden and does add useful non-obvious behaviors: spaces are stripped and letters are case-insensitive. However, it omits other behavioral traits like side-effect-free execution, error behavior on invalid input, or whether validation is local. Adds genuine context but doesn't fully cover the space.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences: the first states purpose and validation depth; the second covers input normalization edge cases. Zero wasted words, information density is excellent, and the most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter validation tool with an output schema, this description is nearly complete: it explains the validation logic (length + checksum) and accepted input forms. Annotations are absent, so a note on read-only/side-effect-free semantics would push it to 5, but the scope is fully appropriate for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate—and it does by explaining that the iban string tolerates spaces (stripped) and case variations. This meaningfully enriches the bare schema definition (string, 4-50 chars). Could go further by noting whether other whitespace (tabs) is stripped, but for one parameter it's well-handled.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb ('Validates') with a well-defined resource ('International Bank Account Number (IBAN)') and names the exact validation standard (ISO 13616) and checksum algorithm (mod-97). The IBAN domain is self-evidently distinct from sibling card tools, and the technical specificity makes the tool's scope unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clarifies what 'validates' means by specifying both length checks and checksum verification, giving agents a clear sense of this tool's validation depth. However, it provides no explicit when-to-use vs. alternatives (e.g., no contrast with validate_card_number or note that this is local-only validation).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.0.0- First observed
detect_card_type - First observed
validate_card_number - First observed
validate_iban
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose: validate_card_number checks Luhn, detect_card_type identifies network via prefix, and validate_iban validates IBAN. No overlap between card validation and IBAN validation, and card type detection is a separate concern.
All tools follow the verb_noun pattern (validate_*, detect_*), but there's a slight inconsistency: 'validate_card_number' uses 'card_number' while 'detect_card_type' uses 'card_type', but both are clear and consistent in style. Minor deviation from uniform noun usage.
With only 3 tools, the server is focused but feels slightly thin for a 'payments-toolkit'. The scope is narrow (validation/detection), but it could benefit from additional related tools like card expiry validation or payment amount validation. However, it's not egregiously under-scoped.
The server covers card number validation and type detection and IBAN validation, which are core payment validation tasks. However, it omits other common validations (e.g., CVV, expiry date, bank account routing numbers) and any operations beyond validation (e.g., formatting, masking). The gaps are notable but the main validation lifecycle is present.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for Modern Treasury — payment orders, transactions, counterparties and ledgers.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceAn MCP server for validating JSON against schemas, checking email deliverability, verifying URLs, assessing data quality, and validating API responses using RFC-compliant checks and heuristic analysis.6MIT
- AlicenseAqualityBmaintenanceA local MCP server for Stripe payment operations with 52 tools across 8 domains, featuring built-in PII redaction and strict input validation for safe AI-assisted development workflows.52371MIT
- AlicenseAqualityCmaintenanceAn MCP server that provides AI agents with tools to validate SWIFT MT and ISO 20022 MX payment messages, check BIC/IBAN correctness, and convert between MT and MX formats.715MIT
- FlicenseAqualityAmaintenanceA fully local, closed-world MCP server that manages, validates, and serves bank-specific ISO 20022 clearing profiles and rule packs, enabling AI agents to discover profiles, fetch them, lint payloads against them, and validate rule-pack definitions.41-