PayCraft · MCP Server

Let an agent read your billing
— and sync it, carefully.

A Model Context Protocol server over the PayCraft management API. Point any MCP client at it and an assistant can answer "can we test payments yet", explain what is blocking a provider, and run a product sync — with exactly the permissions the key you give it carries.

Endpoint https://mcp.paycraft.mobilebytesensei.com/

Connect

Create a key under Settings → Developer API and grant it only the scopes the agent needs. Transport is Streamable HTTP; authentication is a bearer token.

Claude Code

claude mcp add --transport http paycraft https://mcp.paycraft.mobilebytesensei.com/ \
  --header "Authorization: Bearer $PAYCRAFT_KEY"

Claude Desktop — claude_desktop_config.json

{
  "mcpServers": {
    "paycraft": {
      "command": "npx",
      "args": [
        "-y", "mcp-remote", "https://mcp.paycraft.mobilebytesensei.com/",
        "--header", "Authorization: Bearer ${PAYCRAFT_KEY}"
      ],
      "env": { "PAYCRAFT_KEY": "pcsk_your_key_here" }
    }
  }
}

Any client — raw JSON-RPC

curl -X POST https://mcp.paycraft.mobilebytesensei.com/ \
  -H "Authorization: Bearer $PAYCRAFT_KEY" \
  -H "content-type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tools

15 tools, mapped onto the REST API. Each one requires a scope; a key without it gets a clear refusal rather than silence.

Tool	Effect	What it answers
`paycraft_readiness`	read-only	Provider readiness
`paycraft_tenant`	read-only	Tenant and key info
`paycraft_products`	read-only	List products
`paycraft_product`	read-only	Get one product
`paycraft_providers`	read-only	List provider connections
`paycraft_sync_report`	read-only	Drift report (read-only)
`paycraft_sync_run`	writes live	Run the sync drain (writes to live providers)
`paycraft_sync_product`	writes live	Sync one product (writes to live providers)
`paycraft_sync_events`	read-only	Sync run events
`paycraft_subscribers`	read-only	List subscriptions
`paycraft_entitlements`	read-only	List entitlements
`paycraft_coupons`	read-only	List coupons
`paycraft_paywall`	read-only	Paywall configuration
`paycraft_webhooks`	read-only	Inbound webhook deliveries
`paycraft_audit`	read-only	Audit trail

How it stays safe

The key decides everything

Tools call the same REST handlers as curl, so an agent has exactly the permissions its key carries. Connecting an assistant grants nothing extra.

Writes ask twice

A sync needs the confirm count from the report tool. An agent cannot bulk-write to live providers on a set nobody looked at.

Give it a read-only key

Grant only read scopes and the write tools refuse. The safest agent is one that cannot spend money.

Everything is attributable

Actions land in the audit trail as actor_type=api_key with the key id, readable through the audit tool.

What an agent cannot do here

Google Play and App Store test mode cannot be enabled by any tool. Neither store exposes an API for it. Those readiness rows carry ordered manual_steps for a person with a device, and turn green only when a real sandbox purchase reaches PayCraft. A good assistant relays those steps; it should never claim to have completed them.