IMBA Agent Spend MCP server

• create_cardwrite actionFree

  Issue a Visa/MasterCard prepaid from this agent 2401 USDT so the agent can pay merchants that require a card (airlines, hotels, SaaS, datacenter/GPU clouds). POST /api/pin/create_card. ext_id required. imba_product_id is core.card_product.id. Never payment_source=stars. Never pass client_id. IMBA does not create the booking.

• get_balanceFree

  GET /api/balance. USDT is the spendable catalog currency.

• get_card_detailswrite actionFree

  POST /api/pin/get_card_details for a card this agent owns. Needed to present PAN at merchant checkout (airline, datacenter, SaaS). PAN/CVV arrive as card_encrypted JWE when jwe_public_key is registered (PATCH webhook). Without that key the number is masked. Never logs raw PAN. cvv defaults true. Never pass client_id.

• get_deposit_addresswrite actionFree

  POST /api/deposit_address blockchain=tron. Address is issued for the authenticated agent only. Always re-fetch before send. Do not cache. USDT TRC-20 only. 24h unfunded hold.

• get_spend_policyFree

  Forbidden rails and tier rules. Allowed catalog: Visa prepaid, travel eSIM, gift cards, paid KYT address screen. Read-only.

• kyt_checkFree

  Screen a crypto address for dirt (sanctions / mixer exposure). Use BEFORE you accept a TRC-20 send, or AFTER a wallet is blocked and the reason is unclear. POST /api/kyt_check. Body: network (tron_usdt | eth | btc) + address. Debits ~0.99 USDT from 2401. Returns a report — does not gate deposit, does not ban or unblock. TON is not in this catalog. Never pass client_id. Space ~1s.

• kyt_check_getwrite actionFree

  POST /api/kyt_check_get. Poll until the report is ready. Own check only (404 otherwise). Use after kyt_check when a wallet was blocked and you need the dirt report. Never pass client_id.

• kyt_checkswrite actionFree

  POST /api/kyt_checks. Own KYT history plus quote fields. Use to find a past address check. Space ~1s. Never pass client_id.

• kyt_quotewrite actionFree

  POST /api/kyt_quote. Price for a paid crypto-address screen (Didit). Debit is on kyt_check (~0.99 USDT from 2401), not on quote. Off unless didit.enabled and didit.agent_api. Does not gate TRON deposit. Not /api/client/kyt_* and not partner. Space ~1s.

• list_card_productswrite actionFree

  POST /api/card_products. Use id as imba_product_id for create_card (Visa prepaid). Space catalog calls ~1s apart.

• list_cardswrite actionFree

  POST /api/cards for the authenticated agent. No client_id argument.

• list_esim_planswrite actionFree

  POST /api/esim/plans. Travel/data eSIM. esim_provider=yesim. Optional country ISO2. Use plan id with purchase_esim. Space catalog calls ~1s apart (agent catalog_gap).

• list_gift_offerswrite actionFree

  POST /api/offers. Live gift catalog (~20k positions / ~2k unique: Apple, Google Play, Steam, games, travel, retail). Optional query string. Then purchase_gift with offer_id + ext_id. Space catalog calls ~1s apart. Do not assume a SKU.

• list_notificationswrite actionFree

  POST /api/notifications. Poll this when a Visa payment asks for 3-D Secure. Agents keep payload.code (never SMS, never Telegram). category=codes for 3-D Secure OTP. Also delivered on webhook field otp if callback_url is set, and optional email. Space catalog calls ~1s apart.

• purchase_esimwrite actionFree

  POST /api/esim/new_plan5. Buy a travel/data eSIM plan from this agent 2401. Omit blank/null iccid so SQL takes the new-eSIM path. A set iccid must already belong to this agent. ext_id required. Never Stars.

• purchase_giftwrite actionFree

  POST /api/purchase. Buy a brand gift code (Apple, Steam, Google Play, … — live list). ext_id required. Never payment_source=stars.

• rotate_hmacwrite actionFree

  POST /auth/v1/agent/hmac/rotate. Previous HMAC dies immediately. Requires an existing callback_url (400 callback_url required before rotate otherwise). Pass callback_url here to PATCH webhook first. Plaintext HMAC is returned once — store it; never a Wallet JWT.

• set_webhookwrite actionFree

  PATCH /auth/v1/agent/webhook. Sets https callback_url (required before hmac/rotate), optional X25519 jwe_public_key for card_encrypted, optional email for 3DS OTP. Not SMS. HMAC plaintext is shown once when a URL is first accepted.

• topup_cardwrite actionFree

  POST /api/pin/topup_card from this agent 2401 USDT. card_id must belong to the same agent (SQL owner guard). ext_id required. Never Stars.

• Code scan5 source files scanned20/25
• Live reliabilityremote reachable in 1127ms20/20
• Tool poisoning19 tool descriptions checked15/15
• Auth qualityAPI key sent as a header8/15
• Maintenancerepository not readable: repo not found3/15
• Maintainer identityendpoint served from the registry-verified namespace domain8/10

Safety score

74/100

higher than 43% of 4,460 AI and agents servers

Tools

19

the typical AI and agents server has 6

Tools that change things

84%

typical: 0%. Fewer write tools means less an agent can break

Uptime

96%

of our recent checks; the typical remote AI and agents server answers 100%

Response time

974 ms

faster than 10% of 2,331 AI and agents servers

Downloads a week

116

more than 66% of 1,538 AI and agents servers with a package

IMBA Agent Spend: common questions

Is IMBA Agent Spend MCP server safe?

Mostly: it is graded B (74/100). Read the IMBA Agent Spend safety report

How do I install IMBA Agent Spend?

It runs remotely at imbawallet.com. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.

Does IMBA Agent Spend need an API key?

Yes. The registry entry asks for IMBA_AGENT_PRIVATE_KEY, X-IMBA-Agent-Private-Key.

Is IMBA Agent Spend maintained?

The latest release is v0.1.4.

Is IMBA Agent Spend up?

96% of our last 28 checks got an answer. We check remote servers about four times a day.

What can I use instead of IMBA Agent Spend?

Servers from other publishers that do the same job: WaveSpeed MCP server, Spotifyscraper MCP server and Mnemoverse Memory MCP server.

How does IMBA Agent Spend compare with other AI and agents MCP servers?

safety score 74/100 (higher than 43% of 4,460 AI and agents servers); tools 19 (the typical AI and agents server has 6); tools that change things 84% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.