MCP.Market

Worldpay MCP server

by codespar·io.github.codespar/mcp-worldpay·v0.2.0-alpha.3·271 stars
No reviews yet

MCP server for Access Worldpay — enterprise processor: authorize, capture, refund, tokenize

B82/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
Established

271 stars24 downloads/wk

Reviews

Write one

Nobody has reviewed Worldpay yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Worldpay tools (22, 8 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • accept_dispute

    Accept a dispute (forfeit the chargeback). Use when you do not plan to defend.

  • authenticate_3ds

    Step 2 of 3DS2 — authenticate the cardholder. Returns either an authenticated payload (frictionless) or a challenge URL the user must complete. Pass the result into authorize_payment.customer.authentication.

  • authorize_payment

    Authorize a card payment. Returns an outcome plus HATEOAS action links (settle, cancel, refund, reverse). Extract the linkData from those links and pass it to capture_payment / cancel_payment / refund_payment / reverse_payment.

  • cancel_paymentwrite action

    Void an authorization that has not yet been captured. Pass linkData from _links.payments:cancel.href.

  • capture_payment

    Capture (settle) an authorized payment. Omit amount for a full settlement; pass amount+currency for a partial settlement. Pass linkData from the authorization's action link (_links.payments:settle.href segment) for HATEOAS-correct routing.

  • challenge_3ds

    Step 3 of 3DS2 — post the CReq back after the issuer challenge window closes, to retrieve the final authentication outcome.

  • create_tokenwrite action

    Tokenize a card for reuse (card-on-file). Returns a token you can pass as the paymentInstrument on subsequent authorizations.

  • defend_dispute

    Open a defence on a dispute — signals intent to defend before submit_dispute_evidence. Some reason codes require an explicit defence before evidence can be uploaded.

  • delete_tokenwrite action

    Delete a stored card token.

  • fraud_screenwrite action

    Run a standalone FraudSight assessment on a payment method (no authorization). Returns a score and recommendation.

  • get_dispute

    Retrieve a dispute's current state, evidence requirements, deadlines, and HATEOAS action links.

  • get_payment

    Retrieve the detail of a payment event by its Worldpay eventId.

  • get_reconciliation_batch

    Retrieve a reconciliation batch (daily settlement file equivalent) — lists all settled transactions, fees, and net amount for a given batch.

  • get_token

    Retrieve a stored card token's metadata (bin, scheme, last4, cardHolderName, expiryDate, etc.). Does not return the raw PAN.

  • list_payment_events

    List recent payment events for the configured merchant entity. Useful for transaction reports and reconciliation.

  • lookup_3ds

    Step 1 of 3DS2 — submit device-data-collection (DDC) output to Worldpay to determine whether a challenge is required. Returns either a frictionless result or a challenge lookup reference.

  • query_payment

    Look up a payment by the merchant-side transactionReference you assigned on authorize_payment. Returns the matching payment event(s).

  • refund_paymentwrite action

    Refund a captured payment. Omit amount for a full refund; pass amount+currency for a partial refund. Pass linkData from _links.payments:refund.href or _links.payments:partialRefund.href.

  • reverse_payment

    Reverse a payment atomically — voids if not yet captured, refunds if already captured. Pass linkData from _links.payments:reverse.href.

  • submit_dispute_evidencewrite action

    Submit evidence to defend a dispute. Pass the evidence payload (document references, rebuttal text, etc.) in the body.

  • update_tokenwrite action

    Update metadata on a stored card token (e.g. expiryDate after an account-updater refresh, cardHolderName, description).

  • verify_accountwrite action

    Run an AVS/CVC account verification on a card without charging it. Returns the verification outcome and a card-on-file or one-time verification record. merchant.entity is injected automatically.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 29 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Worldpay compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 63% of 48,255 servers
Tools
22
the typical server has 7
Tools that change things
36%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
271
more than 95% of 28,688 servers
Downloads a week
24
more than 10% of 12,191 servers with a package

What its tools let an agent do: 14 read · 1 create · 5 change · 2 delete

Install Worldpay in Claude Code, Cursor or VS Code

Runs npx -y @codespar/mcp-worldpay on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-worldpay -- npx -y @codespar/mcp-worldpay
Add to Cursor

What the publisher says

From the Worldpay repository's README, as published. We do not edit it. Read it on GitHub

MCP Dev LATAM 🌎 Every commerce API your AI agent needs to run a business in Latin America. Brazil 🇧🇷 · Mexico 🇲🇽 · Argentina 🇦🇷 · Colombia 🇨🇴 · Chile 🇨🇱 · Peru 🇵🇪 · plus 4 agentic payment protocols. MCP servers for LATAM commerce · live in the official MCP Registry · MIT License Machine-readable catalog: codespar.dev/api/servers Catalog · Quick Start · Agentic Protocols · All Servers · Contribute

The Problem

AI agents can write code, analyze data, and chat. But they can't operate a business — collect payments, issue invoices, ship products, or notify customers. Especially not in Latin America, where every service has its own API, auth pattern, and quirks (mTLS for BACEN Pix v2, JWT-RSA for STP-SPEI, AFIP web services, contract-gated developer portals, and on).

Meanwhile, four agentic payment protocols are shipping in parallel — checkout protocols (Stripe ACP, Google UCP), authorization layers (AP2), and micropayment rails (x402) — and none of them compose cleanly with each other or with the regional rails businesses actually run on.

MCP Dev LATAM bridges both gaps. Traditional LATAM services + the new agentic payment protocols, all accessible through a single MCP interface.

The Solution

Each MCP server in this repo wraps a real provider — payments, fiscal, logistics, messaging, banking, ERP, identity, fraud, crypto, and the agentic protocols — so your agent can operate a complete business workflow.

🛒 Customer places order
  → 💳 Agent charges via Pix (Asaas / Mercado Pago / Zoop)
  → 📄 Agent issues NFe (Nuvem Fiscal / Focus NFe / NFe.io)
  → 📦 Agent generates shipping label (Melhor Envio / Skydropx)
  → 📱 Agent sends tracking via WhatsApp (Z-API / WhatsApp Cloud)
  → 📊 Agent records in ERP (Omie / Bling / Tiny)
  → 🏦 Agent reconciles balance (Stark Bank / Itaú / BTG)

Six systems. Zero human intervention. One agent.

Agentic Payment Protocols

Four servers for the emerging agentic payment stack:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Worldpay: common questions

Is Worldpay MCP server safe?
Mostly: it is graded B (82/100). Read the Worldpay safety report
How do I install Worldpay?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Worldpay need an API key?
Yes. The registry entry asks for WORLDPAY_PASSWORD.
Is Worldpay maintained?
The last commit was 67 days ago (2026-08-29). The latest release is v0.2.0-alpha.3.
How does Worldpay compare with other MCP servers?
safety score 82/100 (higher than 63% of 48,255 servers); tools 22 (the typical server has 7); tools that change things 36% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from codespar →