Skip to main content
Glama

india-payments-mcp

npm version npm downloads CI license

On npm: india-payments-mcp · npm install india-payments-mcp (SDK) or npx -y india-payments-mcp (MCP server)

One MCP server and TypeScript SDK for Indian payment gateways: Razorpay, PayU, Cashfree, CCAvenue, Paytm, PhonePe, Stripe, Dodo Payments, Skydo and Infinity. You get one set of tools (payments_create_payment, payments_verify_payment, payments_refund, ...) and one set of types. Amounts are always integers in the minor unit of the currency (paise for INR, cents for USD), every gateway's checkout is described by four shapes, and webhooks normalize to one event model. Adapters handle the per-gateway hashes, encodings and amount formats. The server tells you, and your agent, which features each gateway actually lacks instead of pretending otherwise. It's built for developers wiring up checkout, vibecoders who want an agent to do it, and AI agents that need to check payment status or issue a refund safely.

Status: 0.4.1. Eight gateways have API adapters, including Dodo Payments (Merchant of Record for digital products, docs/dodo.md; new in 0.4.0, with its own independent doc check and adversarial review). Skydo and Infinity have no public API, so their adapters automate their Zoho Books integrations or hand out your receiving-account details (and, for Infinity, a QuickLink) with a ledger (docs/skydo.md, docs/infinity.md). The seven API adapters and Skydo have been through three independent verification rounds against official docs plus adversarial reviews; Infinity reuses Skydo's reviewed Zoho and ledger code and had its own adversarial review (see Verification status). Infinity's Zoho integration is not publicly documented, so confirm it with one real invoice. 759 tests pass, but no adapter has been run against a live gateway sandbox yet, and some CCAvenue details remain UNVERIFIED. See Verification status. Check the per-gateway support level with payments_get_capabilities before relying on a feature. See Disclaimer.


60-second quickstart

You don't need any credentials. Mock mode simulates every gateway in memory and never touches the network.

Claude Code

claude mcp add india-payments -e PAYMENTS_MODE=mock -- npx -y india-payments-mcp

Claude Desktop / Cursor / any stdio MCP client (claude_desktop_config.json, .cursor/mcp.json, ...):

{
  "mcpServers": {
    "india-payments": {
      "command": "npx",
      "args": ["-y", "india-payments-mcp"],
      "env": { "PAYMENTS_MODE": "mock" }
    }
  }
}

More client configs are in examples/mcp-clients.

Then ask:

You: Which gateway should I use for a SaaS with monthly UPI Autopay subscriptions? Then create a ₹499 test payment on it for order ORD_1001.

Claude: (calls payments_recommend_gateway with needs ["subscriptions","upi"]) Razorpay comes out on top: subscriptions are implemented end to end (plans, mandate authorisation through Checkout, cancel). Stripe's are partial and Stripe is invite-only for Indian businesses. On Cashfree, PayU and PhonePe, subscriptions are still "Planned" in this project. (calls payments_create_payment provider=razorpay, order_ref=ORD_1001, amount=49900) Created mock_razorpay_order_1a2b3c4d with status created. In mock mode no checkout page exists, so I'll simulate the customer. (calls payments_mock_complete_payment outcome=success, then payments_verify_payment with the returned callback payload, order_ref and expected_amount) The signature is valid, the amount matches, and the status is captured.

You: Refund ₹100 of it.

Claude: (calls payments_refund refund_ref=RF_ORD_1001_1, amount=10000) Refund processed. The payment status is now partially_refunded. Re-sending the same refund_ref returns this same refund instead of creating a second one.

Check your setup any time:

npx india-payments-mcp doctor

Related MCP server: Paytm MCP Server

Gateway support matrix

Generated from each adapter's src/providers/<id>/capabilities.ts. Unsupported features fail with UNSUPPORTED and Planned ones with NOT_IMPLEMENTED, before any network call.

Feature

Razorpay

PayU India

Cashfree Payments

CCAvenue

Paytm Payment Gateway

PhonePe Payment Gateway

Stripe (India)

Skydo

Infinity

Dodo Payments

createPayment

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Partial

Partial

Yes

verifyPayment

Yes

Yes

Yes

Yes

Yes

Partial

Yes

Partial

Partial

Yes

paymentStatus

Yes

Yes

Yes

Partial

Yes

Yes

Yes

Partial

Partial

Yes

refund

Yes

Yes

Yes

Partial

Yes

Yes

Yes

No

No

Partial

refundStatus

Yes

Yes

Yes

Planned

Yes

Yes

Yes

No

No

Yes

webhooks

Yes

Partial

Yes

Partial

Partial

Partial

Yes

No

No

Yes

customers

Yes

No

Planned

No

No

No

Yes

No

No

Yes

subscriptions

Yes

Planned

Planned

Planned

Planned

Planned

Partial

No

No

Partial

settlements

Yes

Planned

Planned

Planned

Planned

Planned

Partial

No

No

Partial

payouts

Planned

Planned

Planned

Planned

Planned

No

Planned

No

No

No

paymentLinks

Planned

Planned

Planned

Planned

Planned

Planned

Planned

No

No

Planned

checkout

js_sdk, redirect

form_post

js_sdk

form_post

js_sdk, form_post

redirect

redirect, js_sdk

manual

manual

redirect

Yes = implemented here. Partial = implemented with caveats (see capability notes). Planned = the gateway offers it, this project does not yet. No = the gateway does not offer it.

payments_get_capabilities and the payments://matrix MCP resource return the same data with per-feature notes, hard constraints, env vars, official SDKs and Shopify/WooCommerce plugins. To refresh this table after changing a capability map:

npx tsx -e "import {supportMatrixMarkdown} from './src/codegen/matrix.ts'; import {allCapabilities} from './src/providers/index.ts'; console.log(supportMatrixMarkdown(allCapabilities()))"

For checkout types, amount units, signature schemes and onboarding notes per gateway, see docs/gateway-matrix.md.


MCP tools

Tool

What it does

Side effects

payments_list_providers

Lists every enabled gateway with its summary, whether it's configured, and its feature support levels

read-only

payments_get_capabilities

Returns one gateway's full capability map: features + notes, payment methods, env vars, constraints, SDKs, plugins

read-only

payments_check_config

Doctor: shows the mode, live-mutation flag, audit log path, and present/missing env vars per gateway. Never returns values

read-only

payments_recommend_gateway

Ranks gateways for needs such as subscriptions, international, shopify, exporter_collections

read-only

payments_create_payment

Creates an order/session and returns a checkout action (js_sdk / redirect / form_post / manual)

creates an order (no money moves)

payments_verify_payment

Verifies the browser callback payload, binding it to order_ref and expected_amount (both required; pass provider_order_id for Razorpay). Fulfil only when paid is true

read-only (may call the status API)

payments_get_status

Fetches the authoritative payment status from the gateway. Razorpay and Stripe need provider_order_id

read-only

payments_refund

Refunds all or part of a payment. refund_ref is the idempotency key. Razorpay, PayU, Paytm, CCAvenue and Stripe need provider_payment_id. Live mode needs a double gate

moves money

payments_get_refund_status

Fetches refund status (the ids each gateway needs are in the tool description; CCAvenue has none)

read-only

payments_verify_webhook

Verifies a webhook against its raw body and normalizes it to a common event

read-only

payments_simulate_webhook

Builds a correctly signed webhook (plus an optional curl command) for local testing. Disabled in live mode

none

payments_create_customer

Creates a customer on gateways that have them

creates a record

payments_create_subscription

Creates a recurring subscription and returns the mandate-authorisation checkout

creates a mandate request

payments_cancel_subscription

Cancels now or at cycle end. Live mode needs a double gate

stops billing

payments_list_settlements

Lists settlements for reconciliation

read-only

payments_generate_integration

Generates server routes, client checkout, env template and test checklist for a framework

read-only (returns files)

payments_skydo_record_payment

Skydo ledger mode only. Records a receipt a human has checked in the Skydo dashboard (minor units of the invoice currency). Needs receipt_id (idempotent per receipt) and, in sandbox and live alike (Skydo has no sandbox), the double gate with confirm: true; partial receipts keep the order pending

can mark an order paid

payments_skydo_outstanding

Skydo ledger mode. Lists orders still waiting for money, oldest first

read-only

payments_infinity_record_payment

Infinity ledger mode only. Records a receipt a human has checked in the Infinity dashboard (bank transfer or QuickLink). Same rules as the Skydo tool: receipt_id, minor units of the invoice currency, and the double gate in sandbox and live alike (Infinity documents no sandbox)

can mark an order paid

payments_infinity_outstanding

Infinity ledger mode. Lists orders still waiting for money, oldest first

read-only

payments_mock_complete_payment

Mock mode only. Simulates the customer paying or failing and returns a signed callback payload

mock state only

That is 21 tools. The server also exposes resources (payments://matrix, payments://providers/{provider}) and a prompt (integrate_payments). The full argument and return schemas are in docs/architecture.md, and example payloads are in docs/payloads.md.


SDK usage

npm install india-payments-mcp

The package is ES modules with a default export condition, so both import and require('india-payments-mcp') work on Node versions that can require() ES modules (20.19+ and 22.12+). On older Node 20 releases, CommonJS code needs await import('india-payments-mcp').

import express from 'express';
import { PaymentsClient, createWebhookHandler, PaymentError } from 'india-payments-mcp';

// Reads PAYMENTS_MODE and gateway credentials from process.env.
const payments = new PaymentsClient();

const app = express();

// 1. Create an order. Persist orderRef + providerOrderId, then hand `checkout` to the frontend.
app.post('/api/orders', express.json(), async (req, res) => {
  const order = await payments.createPayment('razorpay', {
    orderRef: 'ORD_1001',          // 3-40 chars, [A-Za-z0-9_-]
    amount: 49900,                 // paise: Rs 499.00
    customer: { name: 'Asha', email: 'asha@example.com', phone: '9876543210' },
    returnUrl: 'https://shop.example.com/pay/return',
  });
  res.json({ providerOrderId: order.providerOrderId, checkout: order.checkout });
});

// 2. Verify what the browser sends back, bound to YOUR stored order and amount.
//    Fulfil only when paid === true. paid is true only when the callback is genuine, the status is
//    captured or partially_refunded (authorized-only and fully refunded are NOT paid), AND you passed
//    orderRef + expectedAmount. valid alone means "genuine": a genuine failure is valid too.
//    For Razorpay also pass the order_... id you stored as providerOrderId; Razorpay reports captured
//    only once the order is fully paid, so turn on auto-capture.
app.post('/api/payments/verify', express.json(), async (req, res) => {
  const result = await payments.verifyPayment('razorpay', {
    orderRef: 'ORD_1001',
    expectedAmount: 49900,
    providerOrderId: 'order_...',  // the id you stored at step 1
    payload: req.body,
  });
  res.status(result.paid ? 200 : 402).json({ paid: result.paid, status: result.status });
});

// 3. Webhooks: verify the raw body -> dedupe by event id -> your handler.
//    express.raw() MUST run before any JSON parser on this route.
const onRazorpayWebhook = createWebhookHandler({
  client: payments,
  provider: 'razorpay',
  onEvent: async (event) => {
    if (event.type === 'payment.succeeded') {
      // Fulfil idempotently, then check event.amount against your stored amount. A thrown error
      // returns 500 so the gateway retries. Razorpay: subscribe to order.paid, which carries
      // event.orderRef; payment.* events carry only event.providerOrderId.
    }
  },
});
app.post('/webhooks/razorpay', express.raw({ type: '*/*' }), async (req, res) => {
  const out = await onRazorpayWebhook({ headers: req.headers, rawBody: req.body.toString('utf8') });
  res.status(out.status).json(out.body);
});

// Errors are typed: err.code is one of VALIDATION, UNSUPPORTED, NOT_IMPLEMENTED, AUTH, TIMEOUT,
// OUTCOME_UNKNOWN, LIVE_MUTATION_BLOCKED, IDEMPOTENCY_CONFLICT, ... err.retryable is true only when a
// blind retry is safe. OUTCOME_UNKNOWN means "may have happened": look it up before retrying.
app.use((err: unknown, _req: express.Request, res: express.Response, _next: express.NextFunction) => {
  if (err instanceof PaymentError) return void res.status(400).json(err.toJSON());
  res.status(500).json({ error: 'INTERNAL' });
});

A complete runnable version is in examples/express-checkout. For production, pass your own idempotencyStore (Redis/Postgres) and auditSink to new PaymentsClient({...}), plus a shared dedupe store to createWebhookHandler. The defaults are in-memory and per-process.


Skydo

Skydo (cross-border collections for Indian exporters and freelancers) has no public developer API or webhooks; an API has been on its roadmap since December 2025, and its Terms of Use prohibit automated access to the platform. This project never contacts Skydo. Instead the Skydo adapter automates the two paths Skydo supports:

  • Zoho Books bridge (set all six ZOHO_* variables): payments_create_payment creates a Zoho Books invoice with your order reference. Skydo documents syncing Zoho invoices and, when the money arrives, marking them paid with the FIRA attached; whether it imports API-created invoices is not documented, so confirm it with your first invoice during setup. payments_get_status / payments_verify_payment read the invoice back.

  • Receiving accounts + ledger (set SKYDO_RECEIVING_ACCOUNTS): payments_create_payment returns bank-transfer instructions for your Skydo account in the client's currency, with the order reference, and tracks the payment in a local JSON ledger. You confirm each receipt with payments_skydo_record_payment (a receipt_id plus confirm: true) after checking it in the Skydo dashboard. The ledger file can be shared by your app and the MCP server on the same local disk (file lock).

Skydo payments are foreign currency only (INR is rejected), at least USD 50 (or the equivalent), and have no refunds, webhooks, recurring payments or API payment links. Skydo documents its Zoho sync but not API-created invoices specifically, so confirm the first invoice appears in your Skydo dashboard. Setup, the full flow and troubleshooting are in docs/skydo.md.


Dodo Payments

Dodo Payments is a Merchant of Record for digital products (SaaS, AI tools, apps, templates, e-books): Dodo is the legal seller and handles VAT, GST and sales tax worldwide. Indian buyers pay with UPI, RuPay or cards; payouts are in USD, GBP or EUR. Physical goods and human-delivered services are not allowed.

  • Products first. Dodo has no ad-hoc prices: pass provider_options.productId or set DODO_PAYMENTS_DEFAULT_PRODUCT_ID. The adapter reads the product and refuses one whose fixed price differs from amount; a pay-what-you-want product (USD/GBP/EUR) takes any amount above its minimum.

  • Hosted checkout (redirect). The return to return_url is unsigned, so payments_verify_payment re-reads the payment. It needs provider_order_id (the checkout session you created), then checks order_ref, amount and currency. Tax Dodo adds on top of a tax-exclusive price still matches. Discount codes and currency switching are turned off on our sessions, and another currency never counts as paid.

  • Standard Webhooks, refunds (with a lookup by refund_ref first, since Dodo has no idempotency key), customers, subscriptions for recurring products, and payouts as settlements.

Dodo also ships its own MCP server (dodopayments-mcp); this one is the cross-gateway interface. Setup, India notes and troubleshooting: docs/dodo.md.


Infinity

Infinity (infinityapp.in; cross-border collections for freelancers, agencies and exporters) publishes no developer API docs or webhooks. Its Terms mention an API, but nothing is public, and they forbid reverse engineering or incorporating the Services into other systems, so this project never contacts Infinity. The Infinity adapter offers three modes:

  • Zoho Books bridge (all INFINITY_ZOHO_* variables): Infinity's dashboard has a Zoho Books integration (Connect tab). payments_create_payment creates a Zoho invoice with your order reference, using the same reviewed code as Skydo's bridge, and the status is read back from Zoho. An order is paid only when Zoho records payments covering the total. What Infinity's integration syncs is not publicly documented, so confirm with one real invoice that Infinity marks it paid in Zoho.

  • Bank transfer (INFINITY_RECEIVING_ACCOUNTS): your Infinity account details for the client's currency, with the order reference.

  • QuickLink (provider_options.quickLinkUrl): a payment link you create in the Infinity dashboard, which the client pays by card or bank transfer. Only https links on Infinity's domain (INFINITY_QUICKLINK_HOSTS) are accepted, so a pasted look-alike link is refused.

Without Zoho, the payment is tracked in a ledger and an admin records the receipt with payments_infinity_record_payment after checking the Infinity dashboard. Foreign currency only (INR is rejected); no refunds, webhooks or recurring charges. Setup, flow and troubleshooting: docs/infinity.md.


Verification status

  • Three independent verification rounds against official docs, plus adversarial reviews of the money-safety rules and the Skydo bridge; 759 tests. The reports, with the doc URL behind each check and the fixes they caused, are in docs/research/verification (round 3: round3-project.md, round3-skydo.md); the summary is in docs/design-review.md. The Skydo API search is in skydo-api-search.md.

  • Dodo Payments: facts from the official docs and per-endpoint OpenAPI blocks (dodo-api-facts.md), an independent line-by-line check of the adapter against those docs (dodo-doc-verification.md) and an adversarial review (dodo-review.md). The webhook verifier matches the Standard Webhooks reference vector and the official standardwebhooks library.

  • Infinity: sources for every fact used, and the API search, are in infinity-api-search.md. Its Zoho and ledger logic is the shared Skydo code (src/providers/shared/); a before/after comparison showed Skydo's results, errors and Zoho requests are unchanged by the move. Infinity's own QuickLink, gate and mode rules had a separate adversarial review (infinity-review.md); its one medium and nine low findings are fixed, with regression tests.

  • Not yet run against live gateway sandboxes. Tests use recorded request/response shapes from the docs. npm run sandbox:smoke (see scripts/sandbox-smoke.ts) creates small unpaid orders against the sandboxes of the gateways you have test keys for; results from contributors are welcome.

  • Facts the docs do not settle are marked in the capability notes (UNVERIFIED, "confirm in sandbox"). CCAvenue publishes no public API reference, so its status and refund calls rely on integration kits and third-party implementations.


Claude Skill and ChatGPT kit

  • Claude Skill: skills/india-payments/SKILL.md. It teaches Claude the integration workflow (capabilities first, integer minor units, verify before fulfil, raw-body webhooks, human approval for refunds). Install it alongside the MCP server.

  • ChatGPT: chatgpt/custom-gpt-instructions.md covers a Custom GPT / connector setup. ChatGPT connectors need a remote server, so run india-payments-mcp http behind TLS. See deployment.

  • Other agents: AGENTS.md holds conventions for coding agents working in this repo.


Modes

Mode

Network

Credentials

Use it for

mock

none

none

Learning the API, demos, CI, agent experiments. Keeps each gateway's real capability map and mirrors its input rules (ids such as provider_order_id / provider_payment_id where the real gateway needs them, INR only on PayU/Paytm/PhonePe, duplicate-refund behaviour, refused webhook simulations), so a call that would fail against the real gateway fails in mock too. Skydo, Cashfree, PhonePe and Stripe verify by status lookup, as in real mode. Callbacks and webhooks are HMAC-signed with a fixed mock secret, so tampering is still detected

sandbox (default)

gateway test hosts

test keys

Integration testing against real gateway behaviour

live

gateway production hosts

live keys

Real money. Refunds and cancellations are double-gated (see below)

Set the mode with PAYMENTS_MODE. Adapters cross-check key prefixes where the gateway has them. For example, the Razorpay adapter refuses rzp_live_ keys in sandbox and rzp_test_ keys in live. Skydo and Infinity are the exception: they have no sandbox, so sandbox works on real data (with the ZOHO_* / INFINITY_ZOHO_* variables set it creates real Zoho Books invoices, and the ledger is your real ledger). Receipt recording is therefore gated in sandbox as well as live. Use mock to try them.


Safety rails

  • Live mutations are double-gated in the MCP server. In live mode, payments_refund, payments_cancel_subscription payments_skydo_record_payment and payments_infinity_record_payment (for Skydo and Infinity also in sandbox, since Skydo has no sandbox and Infinity documents none) fail with LIVE_MUTATION_BLOCKED unless the server runs with PAYMENTS_ALLOW_LIVE_MUTATIONS=true and the call passes confirm: true. Agents are told to get human approval before setting confirm. The gate is on because the MCP server creates its client with guardLiveMutations: true; SDK users, whose apps have their own authorisation, are not gated unless they pass that option. Webhook simulation is disabled in live mode.

  • Refunds are idempotent by refund_ref. Within one process (the default idempotency cache is in memory, 24 h for refunds) the same refund_ref with the same request returns the stored result, and with a different request fails with IDEMPOTENCY_CONFLICT. When a refund ends in OUTCOME_UNKNOWN, or the gateway rejects the refund_ref as a duplicate, the client looks the refund up by refund_ref and returns it if it exists (Razorpay needs provider_payment_id for that lookup). PayU and CCAvenue have no lookup by refund_ref, so there the error stands: check the dashboard before retrying, and never retry with a new refund_ref. Across restarts, pass a shared idempotencyStore.

  • Order creation is idempotent by idempotency_key (default: order_ref) for 10 minutes in process, because cached results carry short-lived checkout data (Paytm txnToken, PhonePe redirect URL).

  • Money-moving POSTs are never retried blindly. Only GETs and requests the gateway de-duplicates are retried. When a non-retry-safe request times out or gets a 5xx, the error is OUTCOME_UNKNOWN: it may or may not have happened, so look the payment or refund up before retrying.

  • Verification binds to your order. paid is true only when the callback is genuine, the money is collected (captured or partially_refunded; authorized-only and fully refunded payments are not paid) and you passed both order_ref and expected_amount. A valid signature for a different order or amount is rejected. For Razorpay, pass the order_… id you stored as provider_order_id.

  • provider_options cannot override core fields or route money. A baseline list (amount, currency, order id, credentials, hashes, redirect URLs: for example amount, key, hash, surl, order_id, merchantUrls, success_url, line_items) plus each gateway's own list for payments and subscriptions (splits, transfers, connected accounts, manual capture, partial payments, binding keys such as Stripe metadata and Razorpay subscription notes) is rejected with VALIDATION before any network call. The per-gateway lists are in docs/security.md. metadata cannot override the order_ref binding key.

  • Secrets never leave the server. check_config reports env var names only. Logs (stderr, JSON) and the audit log redact secret-looking keys. Checkout options contain only publishable values.

  • Audit trail. Set PAYMENTS_AUDIT_LOG to append every create, refund, subscription and Skydo/Infinity receipt action, including blocked ones, as JSON Lines.

  • HTTP transport requires a bearer token (MCP_HTTP_TOKEN, 24+ chars) and binds to 127.0.0.1 by default. It serves the exact path /mcp (plus public /healthz), validates MCP_HTTP_PORT, evicts sessions idle for 30 minutes and refuses new sessions beyond 1,000 (HTTP 503).

Details, PCI-DSS scope and the threat model for agents are in docs/security.md.


Project structure

src/
  core/          types, errors, capability model, config, HTTP client, idempotency, audit, logger, money, crypto
  providers/     one folder per gateway: capabilities.ts (facts) + adapter.ts (code)
  mock/          network-free gateway used in PAYMENTS_MODE=mock
  webhooks/      framework-agnostic verify -> dedupe -> handle endpoint logic
  mcp/           MCP server: tools, resources, prompts
  codegen/       integration code generator, gateway recommender, support matrix
  client.ts      PaymentsClient: validation, feature gating, idempotency, audit, live rails
  cli.ts         stdio server, `http` transport, `doctor`
test/            vitest suites + fake fetch helpers
docs/            architecture, gateway matrix, payloads, skydo, webhooks, security, testing, reliability, risks, roadmap
  research/      gateway-api-facts.md: sourced facts with VERIFIED / PARTIAL / UNVERIFIED tags
    verification/  line-by-line checks of each adapter against official docs
scripts/         sandbox-smoke.ts: smoke test against real gateway sandboxes
examples/        express-checkout, mcp-clients
skills/          Claude Skill
chatgpt/         ChatGPT setup kit

The full layout is in docs/architecture.md.


Documentation

Doc

Contents

architecture.md

Design, team responsibilities, tool schema, adapter design, deployment, repo layout

gateway-matrix.md

Per-gateway checkout, units, signatures, webhooks, refunds, constraints, plugins, onboarding

payloads.md

Example request/response for every tool, including errors

skydo.md

Skydo: status, Zoho Books bridge and ledger setup, flow, limits, troubleshooting, FAQ

dodo.md

Dodo Payments: Merchant of Record fit, products-first setup, tax and currency rules, refunds, India notes, troubleshooting

infinity.md

Infinity: status, Zoho Books bridge, bank transfer and QuickLink setup, flow, limits, troubleshooting

webhooks.md

Verification per gateway, normalized events, dedupe, ordering, raw-body pitfalls

security.md

Secrets, live rails, audit, PCI-DSS scope, RBI rules, agent threat model

testing.md

Mock mode, sandbox setup, contract tests, webhook simulation, CI

reliability.md

Retries, idempotency, timeouts, reconciliation, failure playbooks

risks.md

Known risks and mitigations

roadmap.md

What's next

design-review.md

Reviewer critique and the changes it caused


Contributing

Gateway APIs drift, and much Indian gateway documentation is incomplete. The most valuable contributions are:

  1. Fact corrections. Each one needs a link to the official doc. Use the API drift issue template.

  2. Planned features made real, such as Cashfree subscriptions or PayU settlements.

  3. Sandbox confirmations of facts marked UNVERIFIED, especially for CCAvenue.

Read CONTRIBUTING.md first. It has the add-a-provider checklist and the verification standard.

npm install
npm run typecheck && npm test
PAYMENTS_MODE=mock npm run inspect   # MCP Inspector against the local server

Disclaimer

  • This project is not affiliated with, endorsed by, or sponsored by Razorpay, PayU, Cashfree, CCAvenue (Infibeam Avenues), Paytm (One97 / Paytm Payments Services), PhonePe, Stripe, Dodo Payments, Skydo, Infinity (Scalifi Wealth), Shopify or any other company named here. All trademarks belong to their owners.

  • This is not financial, legal, tax or compliance advice. You remain responsible for PCI-DSS, RBI and other regulatory obligations, and for your agreements with each gateway.

  • Gateway behaviour changes without notice. Verify every flow against the gateway's official documentation and in its sandbox before going live. Facts in this repo carry a lastVerified date and VERIFIED / PARTIAL / UNVERIFIED tags in docs/research/gateway-api-facts.md; the doc-by-doc checks are in docs/research/verification.

  • The software is provided "as is" under the MIT License, without warranty of any kind.

Available Tools

17 tools
payments_cancel_subscriptionCancel subscriptionA
Destructive

Cancel a subscription now or at cycle end. Live mode requires confirm=true after human approval.

NameRequiredDescriptionDefault
confirmNo
providerYesGateway id
at_cycle_endNo
provider_subscription_idYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint and openWorldHint, so the safety bar is partially covered, but the description adds genuinely new behavioral context: immediate vs end-of-cycle cancellation and a mandatory human-approval + confirm=true gate for live mode. It does not state whether an immediate cancel is irreversible or what happens on a failed/unknown subscription id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, with the action and timing front-loaded and the safety gate second. Nothing to trim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive mutation with no output schema, the description covers the critical decision points (timing, live-mode confirmation, human approval). Return-value behavior after success and failure modes are left unstated, which is the only real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 25%, so the description must carry the load. It does explain confirm (required true in live mode) and at_cycle_end (now vs cycle end), but adds nothing about provider beyond the enum's 'Gateway id' and nothing about provider_subscription_id format or where to obtain it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Cancel a subscription') plus the scope choice ('now or at cycle end'), which cleanly separates it from the sibling payments_create_subscription. No sibling is named explicitly, so it lands at 4 rather than 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete prerequisite: live mode requires confirm=true after human approval, and clarifies the two timing modes. It stops short of naming alternatives or when-not-to-use conditions (e.g. use payments_get_status first to verify the subscription exists).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_check_configCheck configurationA
Read-only

Doctor: shows the mode and which environment variables are present or missing per gateway. Never returns secret values.

NameRequiredDescriptionDefault
providerNoGateway id

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so safety is partly covered, but the description adds genuinely useful behavioral context beyond that: it discloses exactly what is reported (mode and per-gateway env var presence) and guarantees that secret values are never returned. It stops short of describing output shape or what happens if a gateway is misconfigured.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence that front-loads the core behavior and ends with the most important safety guarantee. The 'Doctor:' label is slightly jargony but functions as a fast cue rather than waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-only diagnostic with no output schema, the description covers what it reads, what it reports, per-gateway scoping, and a secrecy guarantee. Nothing material is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single 'provider' parameter has an enum of gateway ids documented as 'Gateway id'. The phrase 'per gateway' weakly implies that the parameter scopes the check to one gateway, but it never states what happens when the optional parameter is omitted (presumably all gateways), which is the one piece of semantics the schema cannot convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete diagnostic operation (reporting mode plus present/missing environment variables per gateway), which is clearly distinct from the transactional siblings like payments_create_payment or payments_refund. It does not explicitly contrast itself with the nearest informational sibling, payments_list_providers, but the resource is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Doctor:' framing implies the tool is for diagnosing configuration problems, which gives an implicit usage context. However, there is no explicit when-to-use guidance, no mention of when to prefer payments_list_providers or payments_get_capabilities instead, and no note about when to pass a provider versus omitting it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_create_customerCreate customerC

Create a customer record on gateways that have one (Razorpay, Stripe).

NameRequiredDescriptionDefault
nameNo
emailNo
phoneNo
metadataNo
providerYesGateway id

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare openWorldHint=true, so the description carries nearly the full burden. It doesn't say whether the call is idempotent, what happens on duplicate email, whether an error is returned for unsupported providers (payu, cashfree, etc.), or whether auth/credentials per gateway are required — all material for an external write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the supported-gateway qualifier is placed immediately after the action. It is arguably too terse for the information load, but that is an omission issue rather than verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 5 parameters, a nested metadata object, no output schema, and no documented return value (e.g., customer id needed for later payments/subscriptions), the description is too thin. An agent cannot tell what it gets back or how to use the result in follow-on calls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 20% (only 'provider' is documented), so the description must compensate and does not: name, email, phone, and the nested metadata map are entirely unannotated in both places. The one added value is clarifying which provider values actually support customer creation, which partially offsets the gap but leaves four parameters unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb + resource ('Create a customer record') and it adds a genuinely distinguishing qualifier: only gateways that support customers (Razorpay, Stripe) are viable. This differentiates it from sibling write tools like payments_create_payment or payments_create_subscription, though it doesn't explicitly contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical implies when the tool is usable (only on Razorpay/Stripe), which is useful, but there is no explicit when-to-use vs. alternatives guidance and no statement of what happens if an unsupported provider from the 8-value enum is passed. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_create_paymentCreate paymentA
Idempotent

Create an order / payment session. Returns checkout, which tells the frontend what to do: js_sdk (load script + options), redirect (send the browser to url), form_post (auto-submit a form with fields), or manual. Persist orderRef + providerOrderId.

NameRequiredDescriptionDefault
amountYesInteger minor units (paise). Rs 499.00 = 49900
currencyNoISO 4217, default INR
customerNo
metadataNo
providerYesGateway id
order_refYesMerchant reference: 3-40 chars, letters/digits/_/-
notify_urlNoServer-to-server notification URL where the gateway takes it per request
return_urlNoBrowser redirect after payment (required for PayU, CCAvenue, Paytm, PhonePe, Stripe Checkout)
descriptionNo
include_rawNoInclude the untouched provider response (verbose).
idempotency_keyNoDefaults to order_ref
provider_optionsNoProvider-specific fields merged into the request

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare openWorldHint, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds genuine value beyond that: the four concrete frontend handling modes for `checkout` (js_sdk, redirect, form_post, manual) and the obligation to persist orderRef + providerOrderId. It stops short of covering failure modes or how provider errors surface.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, zero filler, front-loaded with the verb+resource and then the return-shape enumeration. Every clause carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 12 parameters, a nested customer object, an open provider enum, and no output schema, the description does the essential work of explaining the response envelope (`checkout` modes), which is the non-obvious part. Remaining gaps — error behavior, provider-specific requirements beyond the schema's return_url note — are minor because the schema is fairly rich.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75% and the schema itself documents amount units, order_ref pattern, notify_url/return_url semantics, and idempotency_key default. The description mentions only `checkout` and providerOrderId persistence and adds no meaning to `provider_options`, `include_raw`, or `metadata` beyond what the schema states, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create an order / payment session') and immediately clarifies the return contract via the `checkout` discriminator. The action is unambiguously distinct from the sibling set (verify, refund, get_status, cancel_subscription), so an agent can route here without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the initiation context and gives an operational instruction ('Persist orderRef + providerOrderId'), but never states when to prefer this over `payments_recommend_gateway` (gateway selection), `payments_mock_complete_payment` (testing), or `payments_create_subscription` (recurring). Usage is implied rather than prescribed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_create_subscriptionCreate subscriptionB

Create a recurring subscription (UPI Autopay / card e-mandate). Returns a checkout action the customer must complete to authorise the mandate.

NameRequiredDescriptionDefault
planNo
customerNo
metadataNo
providerYesGateway id
return_urlNo
include_rawNoInclude the untouched provider response (verbose).
total_countNoBilling cycles (Razorpay requires it)
provider_optionsNo
provider_plan_idNo
subscription_refYesMerchant reference: 3-40 chars, letters/digits/_/-
provider_customer_idNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only carry openWorldHint=true, so the description does real work by disclosing the two-step nature of the flow — a checkout action is returned and the mandate is not authorised until the customer completes it. That is valuable context absent from structured fields. Beyond it, nothing is said about idempotency of subscription_ref, retry behavior, provider-specific failure modes, or permissions, so the behavioral picture remains thin for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler: the first front-loads what the tool creates, the second immediately delivers the most consequential return behavior. Nothing is repeated from the title or the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter, nested, open-world mutation with no output schema and only a single openWorldHint annotation, the description is under-built. It names the returned checkout action but omits prerequisites, provider-specific constraints, what happens on duplicate subscription_ref, and any notion of what a successful response contains beyond the action.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 36% across 11 parameters with nested objects, so the description is expected to compensate — and it adds nothing about plan, provider, return_url, provider_plan_id, provider_customer_id, provider_options, or metadata. The one genuinely consequential note (total_count being required by Razorpay) lives only in the schema, and the description does not surface the provider-specific requirements an agent would trip over.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb plus resource ('Create a recurring subscription') and names the mandate mechanisms (UPI Autopay / card e-mandate), which is more detail than the title alone. It does not explicitly contrast with siblings such as payments_cancel_subscription or payments_create_payment, though the create/cancel distinction is reasonably self-evident from the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to choose this tool versus payments_create_payment or the other subscription-adjacent sibling, and no preconditions (provider configuration, prior customer creation, or whether a plan must exist first) are given. The only usage signal is implicit: the customer must complete a checkout action, which is described as an outcome rather than as guidance for selecting the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_generate_integrationGenerate integration codeA
Read-only

Generate a working, production-shaped integration for a project: server routes (create order, verify callback, webhook), client checkout code, env template and a test checklist. Returns files with paths and contents for the agent to write.

NameRequiredDescriptionDefault
featuresNoDefault: checkout + webhooks
providerYesGateway id
frameworkYesTarget stack

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes beyond the readOnlyHint annotation by clarifying the side-effect model: it 'returns files with paths and contents for the agent to write', i.e. nothing is written to disk or to a gateway. That is exactly the disambiguation an agent needs for a generator. It stops short of stating idempotency, cost, or whether generated code is validated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler. The deliverables list is front-loaded and the return contract follows immediately, so an agent gets scope and output shape in one pass.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly compensates by describing the return as files with paths and contents, which is the essential fact for a generator. Minor gap: it doesn't say whether generated files are complete, framework-idiomatic, or require the agent to fill placeholders for API keys.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both enums are self-describing (gateway id, target stack), so the schema carries the parameter burden. The description only loosely echoes the `features` enum values (checkout, webhooks) and never maps provider/framework to their role in output. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and artifact ('Generate a working, production-shaped integration') and enumerates exactly what is produced: server routes, client checkout code, env template, test checklist. No sibling tool does code generation, so the agent can distinguish it immediately from verify/create/refund tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for a project' implies scaffolding at setup time, but there is no explicit when-to-use, no exclusions, and no routing to siblings like payments_recommend_gateway (which presumably picks the provider) or payments_check_config. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_get_capabilitiesGateway capabilitiesA
Read-only

Full capability map for one gateway: features (supported / partial / not_implemented / unsupported), payment methods, required env vars, hard constraints, official SDKs and platform plugins (Shopify, WooCommerce).

NameRequiredDescriptionDefault
providerYesGateway id

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so safety is covered, and the description adds real value by disclosing the shape of what comes back: feature statuses, payment methods, env vars, constraints, SDKs and platform plugins. It stops short of saying whether the data is static/cached or how large the payload is.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that identifies the resource first, then the enumerated contents. The parenthetical list is dense but each item is a distinct disclosed return field, so nothing reads as padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the field enumeration is exactly what an agent needs to know what the call yields, and the single-param schema is trivial. The only real gap is the lack of routing guidance against the many sibling tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter, fully documented in the schema with a type and enum of gateway ids, giving 100% schema coverage. The description adds no extra meaning about the provider argument (e.g. that it must be a supported id from payments_list_providers), so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource and scope: a full capability map for exactly one gateway, and enumerates what the map contains. It does not differentiate itself from near-siblings like payments_check_config or payments_list_providers, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance is given; the agent must infer that this is the discovery call to make before integrating a specific gateway. Nothing tells it why to pick this over payments_check_config or payments_list_providers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_get_refund_statusRefund statusC
Read-only

Fetch refund status from the gateway.

NameRequiredDescriptionDefault
providerYesGateway id
order_refNoMerchant reference: 3-40 chars, letters/digits/_/-
refund_refYesMerchant reference: 3-40 chars, letters/digits/_/-
include_rawNoInclude the untouched provider response (verbose).
provider_refund_idNo
provider_payment_idNo

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The phrase 'from the gateway' merely restates the open-world hint and adds nothing about what happens with an unknown refund_ref, whether statuses are normalized across providers, or the cost of include_raw round-trips.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no waste, but its brevity is under-specification rather than economy — it omits information an agent needs for a six-parameter, multi-provider call.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description says nothing about the return shape (status values, per-provider normalization) or how the optional identifiers change the result. For a cross-gateway lookup tool with six params, this leaves meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Six parameters at 67% schema coverage, and the description mentions none of them. Two parameters (provider_refund_id, provider_payment_id) have no schema description at all, and the description does nothing to explain when those alternatives to refund_ref should be supplied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (fetch refund status) plus the source (gateway), which separates it from payments_get_status (payment status) and payments_refund (create refund). It stops short of naming siblings explicitly, so an agent must infer the distinction from the refund vs payment wording.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this instead of payments_get_status, payments_refund, or payments_verify_payment, and no prerequisites. The agent must infer that this is the read-side counterpart of payments_refund purely from the name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_get_statusPayment statusA
Read-only

Fetch the authoritative payment status from the gateway (source of truth for reconciliation).

NameRequiredDescriptionDefault
providerYesGateway id
order_refYesMerchant reference: 3-40 chars, letters/digits/_/-
include_rawNoInclude the untouched provider response (verbose).
provider_order_idNo

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and external-call profile is covered. The description adds that this is the authoritative gateway source for reconciliation, which is useful context beyond annotations. It still does not describe error behavior, latency, auth needs, or return details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. It states the action and the reconciliation context immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only status lookup with annotations covering safety and external access, the description is minimally adequate. However, with no output schema and a reconciliation-critical purpose, it is thin on what status data is returned and how optional parameters like include_raw and provider_order_id should be used.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, with provider, order_ref, and include_raw documented in the schema. The description adds no parameter-level semantics and does not compensate for provider_order_id being undocumented. A 3 reflects adequate schema coverage with a remaining gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: fetching payment status from the gateway. The phrase 'source of truth for reconciliation' gives useful scope. It does not explicitly differentiate from siblings such as payments_verify_payment or payments_get_refund_status, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The reconciliation/source-of-truth framing implies when this tool is useful, but it gives no explicit when-not guidance or named alternatives. An agent must infer that verification and refund-status checks belong to other sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_list_providersList payment gatewaysA
Read-only

List every supported gateway with a one-line summary, whether credentials are configured, and the feature support matrix.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already tells the agent this is a safe read. The description contributes beyond the annotation by enumerating the returned content (one-line summary, credential configuration status, feature support matrix), which matters since there is no output schema. It does not mention ordering or whether the list can change, but the added disclosure is substantive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that front-loads the action and scope, then lists what is returned. Every clause carries information an agent would otherwise have to discover by calling the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters, no output schema, and a read-only annotation, the description must carry the return-shape burden, and it does by naming the three payload elements. Only the relative positioning against overlapping sibling tools is left unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4; there are no arguments whose meaning the description could clarify. The schema is empty and fully documented, so nothing more is needed on this dimension.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list) and resource (every supported gateway), plus what each entry contains. It is clear on its own, but it never contrasts itself with close siblings such as payments_get_capabilities or payments_check_config, which appear to overlap with the feature-matrix and credential-status information it returns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use guidance and no named alternative. The overview/discovery use case is implied by 'list every supported gateway', which is enough for an agent to infer intent but leaves ambiguity against payments_get_capabilities and payments_check_config unresolved.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_list_settlementsList settlementsA
Read-only

List settlements (payouts from the gateway to your bank) for reconciliation.

NameRequiredDescriptionDefault
toNoYYYY-MM-DD
fromNoYYYY-MM-DD
countNo
providerYesGateway id

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety profile is covered. The description adds domain semantics (settlements are gateway-to-bank payouts) but says nothing about pagination limits, default date range when from/to are omitted, or the shape/volume of results — relevant given an open-world listing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence, front-loaded with the action and resource, with the parenthetical definition earning its space. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description could describe what a settlement record contains (amount, fee, settlement date, status) or that results are date-bounded. As written it is sufficient to select the tool but thin for interpreting the response in a reconciliation workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%: from/to carry YYYY-MM-DD formats and provider carries a gateway-id description plus an 8-value enum. The description adds no parameter-level meaning beyond the resource itself, and 'count' has no schema description at all, so the one genuinely ambiguous parameter (page size? max results?) is left unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List settlements') and immediately defines the term as 'payouts from the gateway to your bank', which an agent needs since 'settlement' is ambiguous in payments contexts. It does not distinguish itself from siblings explicitly, but the siblings are almost all different resources (payments, refunds, subscriptions, providers), so confusion risk is low.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'for reconciliation' implies the use case but names no alternative tool, no when-not condition, and no prerequisite. It is enough for an agent to know this is a reporting/reconciliation read rather than a lookup-by-id operation, but nothing more.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_mock_complete_paymentMock: complete paymentA

MOCK MODE ONLY. Simulate the customer finishing checkout. Returns a signed callback payload (feed it to payments_verify_payment) and the updated payment.

NameRequiredDescriptionDefault
methodNo
outcomeYes
providerYesGateway id
order_refYesMerchant reference: 3-40 chars, letters/digits/_/-

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only supply readOnlyHint=false, so the description usefully adds that this is simulation-only and that it returns a signed callback payload plus the updated payment — context an agent cannot get from the schema. It omits whether mock mode must be enabled, whether the order must already exist, and any side effects on the stored payment.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero filler, and the most important constraint ('MOCK MODE ONLY') is front-loaded. Every clause carries new information: mode, action, return payload, and the required follow-up tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the necessary work of describing the return value (signed callback payload + updated payment), which is exactly what an agent needs to chain calls. The remaining gap is parameter-level behavior, especially how 'outcome' alters the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% (provider and order_ref are described, outcome and method are not), so the description needs to compensate — but it mentions no parameter at all. In particular the critical 'outcome' switch (success/failure) that determines the simulated result is left entirely undocumented, and the optional 'method' field is unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Simulate the customer finishing checkout') on a specific resource, and the 'MOCK MODE ONLY' prefix immediately separates it from the real payment siblings like payments_create_payment. It also names the downstream sibling payments_verify_payment, so an agent can place the tool in a workflow without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'MOCK MODE ONLY' is an explicit usage constraint, and 'feed it to payments_verify_payment' tells the agent the required next step. It stops short of saying when to pick this over payments_simulate_webhook or that a payment must exist first, so there is no full when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_recommend_gatewayRecommend a gatewayB
Read-only

Rank gateways for a use case using the capability map (e.g. subscriptions, international payments, Shopify, lowest integration effort).

NameRequiredDescriptionDefault
needsYesRequirements, most important first
businessNoFree-text description of the business, for the explanation only

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already tells the agent this is a safe read. The description adds the useful detail that rankings come from the capability map, but it does not say what the response contains (ordered list plus generated explanation), whether results are deterministic, or how ties are resolved. Adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler, and the action verb comes first. It is slightly over-compressed given the missing return-value information, but nothing in it is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only two parameters, one required, and no output schema, the description should carry the burden of describing the return shape and how 'business' is used. It hints at an explanation but never states that an explanation is returned or that 'business' is ignored for ranking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented in the schema. The description echoes the example needs but adds nothing about ordering semantics of 'needs' (most important first) or whether 'business' influences ranking versus only the explanation text. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Rank gateways') plus the mechanism ('using the capability map'), and the parenthetical examples pin down the kind of use case. It is distinguishable from payments_list_providers and payments_get_capabilities because it produces a ranking rather than a listing, though the description never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical examples ('subscriptions, international payments, Shopify, lowest integration effort') imply when to reach for this tool, but there is no explicit statement of when to use it versus payments_get_capabilities or payments_list_providers, and no exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_refundRefund paymentA
DestructiveIdempotent

Refund all or part of a captured payment. refund_ref is the idempotency key: re-sending it after a success returns the same refund. If a call fails with OUTCOME_UNKNOWN, check payments_get_refund_status / payments_get_status BEFORE retrying. In live mode this moves real money: ask the human first, then pass confirm=true.

NameRequiredDescriptionDefault
speedNo
amountNoOmit for full refund
reasonNo
confirmNoRequired (true) in live mode, after human approval
providerYesGateway id
order_refYesMerchant reference: 3-40 chars, letters/digits/_/-
refund_refYesMerchant reference: 3-40 chars, letters/digits/_/-
include_rawNoInclude the untouched provider response (verbose).
provider_payment_idNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructive, idempotent and openWorld, so the safety bar is partly met by structured data; the description nonetheless adds the key semantics: refund_ref as idempotency key with replay-returns-same-refund behavior and the OUTCOME_UNKNOWN non-retry rule. It does not say what a partial refund does to subsequent refundable balance or whether instant speed carries extra cost.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each with a distinct job: what it does, idempotency, failure recovery, money-movement safety. The safety-critical instruction is last-sentence prominent and nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, open-world money-movement tool with 9 params and no output schema, it covers purpose, idempotency, uncertain-outcome recovery and approval gating. An agent has enough to invoke correctly and to avoid a duplicate refund.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% and the description supplies the two most consequential semantics not fully in the schema: refund_ref is an idempotency key for safe resends and confirm=true is gated on human approval in live mode. It leaves speed, reason, include_raw and provider_payment_id unexplained, so it doesn't fully compensate for the remaining coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource+scope: 'Refund all or part of a captured payment.' It also distinguishes itself from sibling retrieval tools by naming payments_get_refund_status and payments_get_status as recovery paths rather than refund paths.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit routing: on OUTCOME_UNKNOWN, check the two status tools BEFORE retrying, and in live mode ask the human first, then pass confirm=true. This gives when-to-use, when-not-to-retry, and the prerequisite gate in three compact sentences.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_simulate_webhookSimulate webhookA
Read-only

Produce a correctly signed webhook (headers + raw body) for local testing. In sandbox mode it uses the provider's real signing scheme and your webhook secret; replay it with curl against your LOCAL endpoint. Disabled in live mode. Never reuse sandbox webhook secrets in production.

NameRequiredDescriptionDefault
typeYes
amountYesInteger minor units (paise). Rs 499.00 = 49900
currencyNo
providerYesGateway id
order_refYesMerchant reference: 3-40 chars, letters/digits/_/-
refund_refNoMerchant reference: 3-40 chars, letters/digits/_/-
target_urlNoIf given, the response includes a ready-to-run curl command
provider_payment_idNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real behavioral context beyond readOnlyHint: the payload is signed with the provider's real scheme and the caller's webhook secret, the tool is disabled in live mode, and secrets must not be reused in production. Return shape is sketched ('headers + raw body') rather than fully specified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with what the tool produces, followed by mode constraints and a safety note. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only generator with no output schema, the description covers what it emits, the sandbox-only constraint, and the security caveat. The main remaining gap is parameter guidance for the 8 inputs, which the description leaves entirely to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description names no parameters at all despite 8 inputs, 4 required, and only 63% schema coverage. It never explains the relationship between the event type and refund_ref, nor what target_url does (the curl output is documented only in the schema), so it adds no meaning over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and product ('Produce a correctly signed webhook (headers + raw body) for local testing'), which cleanly separates it from the verify_webhook sibling that consumes rather than emits a webhook. The scope (signed payload generation) is unambiguous without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear context: sandbox mode, local endpoint, replay with curl. It does not name the alternative tool for consuming webhooks (payments_verify_webhook) or state what to do when you need a live endpoint, so exclusions are only partially covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_verify_paymentVerify payment callbackA
Read-only

Verify the payload the browser/app received after checkout (Razorpay handler response, PayU/CCAvenue/Paytm POST-back, etc.). Fulfil ONLY when paid=true. valid=true just means the callback is genuine; a genuine failure is still valid. For gateways that do not sign callbacks it confirms through the status API.

NameRequiredDescriptionDefault
payloadYesCallback fields exactly as received
providerYesGateway id
order_refYesThe order you expect this callback to be for (from your own database)
include_rawNoInclude the untouched provider response (verbose).
expected_amountYesThe amount you stored for that order, in paise

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, but the description adds behavior the annotations cannot convey: the outcome semantics (valid vs paid) that drive downstream fulfillment, and the fact that for gateways that do not sign callbacks it resolves verification through the status API — i.e. an outbound network call, not a purely local computation. Those are exactly the traits an agent needs to interpret the result correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with what is being verified, then the fulfilment rule, then the valid/paid distinction, then the unsigned-gateway fallback. No filler and no repetition of schema or annotation content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the hard parts of a nested-payload verification tool with no output schema: it explains what the two key result flags mean, which is the main ambiguity. It leaves gaps around amount-mismatch handling and what the response contains beyond valid/paid, but the critical decision logic is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so provider, payload, order_ref, expected_amount and include_raw are all documented in the schema itself. The description adds nothing about the two highest-risk parameters — order_ref as an anti-replay binding and expected_amount in paise — so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (verify) and resource (the checkout callback payload) and scopes it to what the browser/app received, which implicitly but clearly separates it from payments_verify_webhook (server-side webhook). The parenthetical examples (Razorpay handler response, PayU/CCAvenue/Paytm POST-back) make the target artifact unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete decision rule with a hard constraint: fulfill ONLY when paid=true, and warns that valid=true is not a fulfilment signal because a genuine failure is still valid. That is strong when-to-act guidance. It does not name sibling tools (e.g. verify_webhook vs this one) or state what to do on an invalid callback, so it stops short of full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

payments_verify_webhookVerify webhookA
Read-only

Verify a webhook signature and normalise it into a common event (payment.succeeded, refund.processed, ...). Pass the RAW body string exactly as received.

NameRequiredDescriptionDefault
headersYes
providerYesGateway id
raw_bodyYes
include_rawNoInclude the untouched provider response (verbose).

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true is consistent with a verification operation, and the description adds real behaviour beyond the annotations: the output is normalised into named common events (with examples), and the input must be the untouched raw body or the signature check will fail. It omits the failure path (what happens on an invalid signature) and whether any state is recorded, which keeps it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, zero waste, with the primary action front-loaded and the critical input constraint as a distinct imperative sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully sketches the return value as a normalised event, which is the key thing an agent needs. But for a 4-parameter tool with a required nested object, it leaves the headers parameter and error behaviour unexplained — the agent cannot predict what an invalid signature yields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50% (provider and include_raw documented; headers and raw_body have no schema description). The description compensates well for raw_body by mandating the exact raw string, but says nothing about the required nested `headers` object — the agent must infer that it is the provider's request headers verbatim.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Verify a webhook signature') plus a second concrete outcome ('normalise it into a common event (payment.succeeded, refund.processed, ...)'), so the agent knows exactly what it gets back. It does not name the nearest sibling (payments_simulate_webhook), so differentiation is only implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the nature of the tool — you call it on an incoming provider webhook before acting on it — and 'Pass the RAW body string exactly as received' prevents the classic failure mode of verifying a re-serialised body. However, there is no explicit when/when-not statement and no pointer to payments_simulate_webhook or payments_verify_payment as alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 17 tool updatesv0.1.0
    • First observedpayments_cancel_subscription
    • First observedpayments_check_config
    • First observedpayments_create_customer
    • First observedpayments_create_payment
    • First observedpayments_create_subscription
    • First observedpayments_generate_integration
    • First observedpayments_get_capabilities
    • First observedpayments_get_refund_status
    • First observedpayments_get_status
    • First observedpayments_list_providers
    • First observedpayments_list_settlements
    • First observedpayments_mock_complete_payment
    • First observedpayments_recommend_gateway
    • First observedpayments_refund
    • First observedpayments_simulate_webhook
    • First observedpayments_verify_payment
    • First observedpayments_verify_webhook

TDQS

A3.6/5.0

Scored across 17 tools

Disambiguation4/5

Most tools target a distinct resource+action (create_payment, refund, verify_webhook, simulate_webhook, mock_complete_payment are clearly separated by mode/purpose). There is mild overlap among the four introspective tools — list_providers vs get_capabilities vs check_config vs recommend_gateway all describe gateway metadata/env vars, and get_status vs verify_payment require reading the descriptions carefully to distinguish authoritative fetch from callback validation.

Naming Consistency5/5

Every tool uses the same payments_ prefix followed by a consistent snake_case verb_noun pattern (payments_get_status, payments_create_subscription). No mixing of conventions or vague one-word verbs.

Tool Count4/5

17 tools is slightly above the ideal 3-15 band but justifiable given multi-gateway support plus subscription, webhook, settlement and scaffolding flows. Each tool maps to a real integration step rather than padding.

Completeness4/5

Core lifecycle is well covered: create/verify/status, refund + refund status, webhooks (verify/simulate), subscriptions create/cancel, customers, settlements and integration generation. Gaps remain for read/list operations — no list_payments/orders, get_subscription, list_subscriptions, or capture of authorised payments — which would be needed for full reconciliation and subscription management.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    Not graded
    maintenance
    Enables AI agents to interact with multiple payment providers (Stripe, Paystack) through a unified API. Supports payment initialization, verification, refunds, customer management, and invoicing without requiring knowledge of specific provider implementations.
    2
    -
  • A
    license
    A
    quality
    D
    maintenance
    A unified MCP server for West African payment providers, enabling AI agents and REST clients to initiate payments, payouts, refunds, and manage webhooks across 10 providers with a single API.
    8
    1 npm
    MIT