Skip to main content
Glama
sebastienrousseau

ap2-iso20022

by sebastienrousseau
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

ap2-iso20022: Agent-payment mandates → wire-valid ISO 20022

Bridge AP2 (Google's Agent Payments Protocol) and x402 (Coinbase's HTTP-402) mandates into ISO 20022 pain.001 / pacs.008 records — with spending-cap, expiry and authorisation guardrails, and an MCP server. These agentic-payment protocols authorise a payment; this library turns that authorisation into the bank-rail message that actually settles it — the rail the card networks and stablecoins don't cover.

Latest release: v0.0.1 — 5 MCP tools over stdio, pure-Python (only mcp), 100% branch coverage, for Python 3.10+. Output feeds straight into pain001 / pacs008 to generate wire-valid XML. Part of the ISO 20022 MCP suite.

Why

An agent with a signed AP2 mandate (or an x402 payment authorisation) can prove it's allowed to pay — but nothing in those protocols emits the pain.001 a bank needs to move the money. ap2-iso20022 is that missing hop. And because moving money is consequential, it only transforms and validates — producing the ISO record is deliberately separate from generating and sending it, so the actual payment stays an explicit, guarded step.

Related MCP server: acmt001-mcp

Install

pip install ap2-iso20022
# or run the MCP server without installing:
uvx ap2-iso20022

MCP client config (e.g. Claude Desktop):

{
  "mcpServers": {
    "ap2-iso20022": {
      "command": "ap2-iso20022-mcp"
    }
  }
}

Flow: normalise → guardrail → convert

from ap2_iso20022 import bridge

# 1. Normalise the protocol payload into a canonical mandate.
mandate = bridge.from_ap2({
    "intent_id": "AP2-CoffeeRun-7",
    "payer": "Alice's Shopping Agent",
    "payer_account": "DE89370400440532013000",
    "merchant_name": "Blue Bottle Coffee",
    "payee_account": "GB29NWBK60161331926819",
    "amount": "12.50", "currency": "EUR", "memo": "oat latte",
    "spending_limit": "50.00",
    "signature": "eyJ...", "signature_type": "jws",
})

# 2. Guardrail before it becomes a payment.
check = bridge.check_mandate(mandate, as_of="2026-03-02T09:00:00")
assert check["ok"]          # required fields ok, within cap, not expired, signed

# 3. Convert to a pain.001 record that feeds pain001 -> wire-valid XML.
record = bridge.to_pain001(mandate)   # exact pain001 field names + JSON number amounts

Tools

  • normalize_ap2 — AP2 mandate payload → canonical mandate.

  • normalize_x402 — x402 payment payload → canonical mandate.

  • check_mandate — Guardrail: required fields, spending cap, expiry (with as_of), authorisation proof.

  • to_pain001 — Canonical mandate → pain.001 record (customer credit transfer).

  • to_pacs008 — Canonical mandate → pacs.008 record (FI-to-FI).

The output field names and types match what pain001 / pacs008 expect (validated against their JSON schemas), so to_pain001(mandate) → pain001 generate_message → XSD-valid pain.001 with no glue.

Guardrails

check_mandate returns {ok, violations, warnings}:

  • required fields — payer/payee name + account, amount, currency

  • spending cap — amount <= max_amount when a cap is present

  • expiry — refuses an expired mandate when you pass as_of

  • authorisation proof — warns when no proof_type/proof_value is present

It never moves money; it tells you whether the mandate is safe to act on.

The suite

Part of a family of vendor-neutral, Python-native ISO 20022 MCP servers:

Development

git clone https://github.com/sebastienrousseau/ap2-iso20022
cd ap2-iso20022
python -m venv .venv && . .venv/bin/activate
pip install -e . && pip install pytest pytest-cov ruff black mypy
pytest                      # 100% branch coverage gate
ruff check ap2_iso20022 tests && black --check ap2_iso20022 tests && mypy ap2_iso20022

Licence

Licensed under the Apache License, Version 2.0.

mcp-name: io.github.sebastienrousseau/ap2-iso20022

Available Tools

5 tools
check_mandateA
Read-onlyIdempotent

Guardrail a mandate before it becomes a payment: check required fields, the spending cap (amount <= max_amount), expiry (when 'as_of' is supplied), and whether an authorisation proof is present. Returns ok plus any violations and warnings. Run this before converting.

ParametersJSON Schema
NameRequiredDescriptionDefault
as_ofNoISO date/datetime to evaluate expiry against.
mandateYesA canonical mandate object (see normalize_ap2/normalize_x402 output): payer_/payee_ name+account_iban, amount, currency, plus optional reference, execution_date, max_amount, expiry, proof_type/proof_value.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description details what is checked (fields, cap, expiry, proof) and that output includes 'ok plus violations and warnings.' Annotations already declare readOnly and idempotent, so description adds behavioral context without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: purpose, output, usage instruction. No wasted words, front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given parameter complexity (mandate object with many fields) and existence of output schema, description sufficiently covers when and how to use. Mentions return format and prerequisite step.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. Description adds meaning by explaining 'as_of' is for expiry check and 'mandate' is the canonical object from normalize tools, providing context beyond schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool checks a mandate before payment conversion, listing specific checks (fields, cap, expiry, proof). It distinguishes from sibling normalize and convert tools by positioning as a guardrail step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Run this before converting,' indicating it should be used before to_pain001 or to_pacs008. Does not exclude other uses but provides clear context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

normalize_ap2A
Read-onlyIdempotent

Normalise a Google AP2 (Agent Payments Protocol) mandate payload into a canonical mandate the other tools accept.

ParametersJSON Schema
NameRequiredDescriptionDefault
payloadYesAn AP2 mandate payload.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, and destructiveHint, which the description does not contradict. The description adds behavioral context by explaining the transformation to a canonical format and its consumption by other tools.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that efficiently conveys the tool's purpose without any extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema and annotations covering safety, the description adequately completes the context for a transformation tool. It lacks some detail on the canonical mandate format but the output schema likely fills that gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a clear description for the only parameter 'payload'. The description does not add significant additional meaning beyond what the schema already provides, so it meets the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'normalise', the specific resource 'Google AP2 mandate payload', and the outcome 'canonical mandate the other tools accept'. It effectively distinguishes from sibling tools like 'normalize_x402' by specifying the AP2 format.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates the tool is for AP2 payloads, which helps differentiate it from sibling normalizer 'normalize_x402'. However, it does not explicitly state when not to use it or provide alternatives beyond the implied sibling context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

normalize_x402A
Read-onlyIdempotent

Normalise a Coinbase x402 (HTTP-402) payment requirement/receipt into a canonical mandate the other tools accept.

ParametersJSON Schema
NameRequiredDescriptionDefault
payloadYesAn x402 payment payload.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, indicating no side effects. The description adds that the output is a canonical mandate, which is useful context but does not disclose error handling or validation behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, well-structured sentence with no redundancy. Front-loads the action and outcome.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the open input schema (additionalProperties: true) and existence of an output schema, the description provides a high-level transformation purpose. However, it lacks details on what constitutes a valid x402 payload, which an agent might need to construct inputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents the single parameter. The description adds only 'An x402 payment payload.', which is generic and adds minimal semantic value beyond the parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (normalize), the source format (Coinbase x402 payment requirement/receipt), and the output (canonical mandate). It distinguishes itself from sibling normalize_ap2 by naming the specific source protocol.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is a prerequisite for other tools like check_mandate, to_pain001, etc., by mentioning 'the other tools accept'. However, it does not explicitly state when to use this over normalize_ap2 or provide any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

to_pacs008A
Read-onlyIdempotent

Convert a canonical mandate into a pacs.008 record (FI-to-FI credit transfer) using the field names pacs008 expects, for interbank settlement of an agent-authorised payment.

ParametersJSON Schema
NameRequiredDescriptionDefault
mandateYesA canonical mandate object (see normalize_ap2/normalize_x402 output): payer_/payee_ name+account_iban, amount, currency, plus optional reference, execution_date, max_amount, expiry, proof_type/proof_value.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is clear. The description adds valuable context about the output format (using pacs.008 field names) and business purpose, which goes beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the main action. Every word serves a purpose, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of a detailed input schema and output schema, the description is adequately complete. It explains the tool's purpose and output format. The only minor gap is a lack of explicit prerequisite reference (e.g., mandate must be canonical from normalize tools), but this is covered in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage for the mandate parameter, so baseline is 3. The tool description does not add new information about the parameter itself; it focuses on the output. No additional semantics provided beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'convert' and the resource 'canonical mandate into a pacs.008 record', explaining its use for interbank settlement of an agent-authorised payment. This distinguishes it from siblings like to_pain001 (which produces pain.001) and normalize tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for converting a canonical mandate to a pacs.008 record for interbank settlement, providing clear context. However, it does not explicitly mention when not to use this tool or compare it to alternatives beyond the implicit purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

to_pain001A
Read-onlyIdempotent

Convert a canonical mandate into a pain.001 record (customer credit transfer initiation) using the exact field names pain001 expects, so it feeds straight into pain001 generate_message for wire-valid XML.

ParametersJSON Schema
NameRequiredDescriptionDefault
mandateYesA canonical mandate object (see normalize_ap2/normalize_x402 output): payer_/payee_ name+account_iban, amount, currency, plus optional reference, execution_date, max_amount, expiry, proof_type/proof_value.

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool performs a conversion using 'exact field names pain001 expects', which adds behavioral context beyond the annotations. Annotations already indicate readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description's transformation nature aligns with these. No contradictions observed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the action, and contains no extraneous words. Every part serves a purpose: defining the conversion, specifying the output format, and indicating the downstream use.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple parameter set (1 required parameter with full schema coverage), the description adequately explains the tool's purpose and workflow integration. It mentions the output format and downstream tool, which is helpful. The existence of an output schema (not shown) further reduces the need to describe return values. Minor gap: no mention of error handling or validation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description for the 'mandate' parameter is comprehensive, listing expected fields and referencing normalization tools. The description adds value by stating 'using the exact field names pain001 expects', which clarifies the mapping goal beyond the schema's listing of fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the verb 'Convert', the resource 'canonical mandate into a pain.001 record', and the intended use case 'for wire-valid XML'. It differentiates from siblings by mentioning the specific output format (pain.001) and the expected input (canonical mandate as from normalize_ap2/normalize_x402), making it distinct from to_pacs008 and others.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by stating the output 'feeds straight into pain001 generate_message', indicating a downstream tool. Sibling tools like to_pacs008 and normalize_* steps suggest different stages in a workflow, but no explicit 'when to use' or 'when not to use' guidance is provided, though the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.1/5.0
Disambiguation5/5

Each tool targets a distinct operation: two normalization for different input formats, one validation, and two conversions to different ISO 20022 messages. No overlap in purpose.

Naming Consistency4/5

Most tools follow a verb_noun pattern (normalize_ap2, normalize_x402, check_mandate), but to_pain001 and to_pacs008 use 'to' instead of a verb. Still consistent and readable.

Tool Count5/5

Five tools cover the core pipeline—normalization, validation, and two output formats—without being excessive or insufficient for the stated domain.

Completeness4/5

The set covers the main workflow: input normalization, mandate validation, and conversion to two common ISO 20022 messages. Minor gaps like reverse conversion or a generic normalize could exist but are not essential.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Related MCP Connectors

Related MCP Servers

  • acmt001-mcp

    sebastienrousseau
    F
    license
    A
    quality
    A
    maintenance
    MCP server for ISO 20022 acmt.001 Account Opening (and companion acmt.* messages): message-type discovery, required-field lookup, JSON Schema introspection, IBAN/BIC/LEI validation, flat-record validation, and validated acmt XML generation.
    6
    1

  • pacs008-mcp

    sebastienrousseau
    F
    license
    A
    quality
    A
    maintenance
    An MCP server that exposes the pacs008 ISO 20022 FI-to-FI Customer Credit Transfer library as tools for AI agents and assistants, enabling generation, validation, and parsing of pacs.008 credit transfer XML messages.
    16
    1

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/sebastienrousseau/ap2-iso20022'

If you have feedback or need assistance with the MCP directory API, please join our Discord server