@rapay/mcp-server 1.2.5 β 1.2.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +343 -153
- package/dist/index.d.ts +1 -1
- package/dist/index.js +1 -1
- package/package.json +1 -1
- package/LICENSE +0 -21
package/README.md
CHANGED
|
@@ -1,153 +1,343 @@
|
|
|
1
|
-
# MCP
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
##
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
###
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
-
|
|
141
|
-
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
1
|
+
# Ra Pay MCP Server
|
|
2
|
+
|
|
3
|
+
MCP (Model Context Protocol) server for AI agent payment automation. Enables Claude Desktop, Claude API, and ChatGPT to execute payments via Ra Pay CLI.
|
|
4
|
+
|
|
5
|
+
**Status:** Perplexity Security Review APPROVED (98% confidence)
|
|
6
|
+
|
|
7
|
+
## Features
|
|
8
|
+
|
|
9
|
+
- 6 MVP tools for payment operations
|
|
10
|
+
- Subprocess isolation (credentials never leave keyring)
|
|
11
|
+
- Response sanitization (prevents prompt injection)
|
|
12
|
+
- Rate limiting (1 payment/min, 10 queries/min)
|
|
13
|
+
- Audit logging
|
|
14
|
+
|
|
15
|
+
## Installation
|
|
16
|
+
|
|
17
|
+
### Prerequisites
|
|
18
|
+
|
|
19
|
+
- Node.js 18+
|
|
20
|
+
- Ra Pay CLI installed and authenticated (`ra link-bank`)
|
|
21
|
+
|
|
22
|
+
### Setup
|
|
23
|
+
|
|
24
|
+
```bash
|
|
25
|
+
cd rapay/mcp-server
|
|
26
|
+
npm install
|
|
27
|
+
npm run build
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
### Claude Desktop Configuration
|
|
31
|
+
|
|
32
|
+
**macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
|
|
33
|
+
|
|
34
|
+
```json
|
|
35
|
+
{
|
|
36
|
+
"mcpServers": {
|
|
37
|
+
"rapay": {
|
|
38
|
+
"command": "node",
|
|
39
|
+
"args": ["/Users/yourname/rapay/mcp-server/dist/index.js"]
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
**Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
|
|
46
|
+
|
|
47
|
+
```json
|
|
48
|
+
{
|
|
49
|
+
"mcpServers": {
|
|
50
|
+
"rapay": {
|
|
51
|
+
"command": "node",
|
|
52
|
+
"args": ["C:\\Users\\yourname\\rapay\\mcp-server\\dist\\index.js"]
|
|
53
|
+
}
|
|
54
|
+
}
|
|
55
|
+
}
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
**With custom CLI path:**
|
|
59
|
+
|
|
60
|
+
```json
|
|
61
|
+
{
|
|
62
|
+
"mcpServers": {
|
|
63
|
+
"rapay": {
|
|
64
|
+
"command": "node",
|
|
65
|
+
"args": ["/path/to/rapay/mcp-server/dist/index.js"],
|
|
66
|
+
"env": {
|
|
67
|
+
"RAPAY_CLI_PATH": "/custom/path/to/ra"
|
|
68
|
+
}
|
|
69
|
+
}
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
After adding, restart Claude Desktop. You should see "rapay" in the MCP servers list.
|
|
75
|
+
|
|
76
|
+
## Tools
|
|
77
|
+
|
|
78
|
+
### Payment Operations (SENSITIVE)
|
|
79
|
+
|
|
80
|
+
| Tool | Description |
|
|
81
|
+
|------|-------------|
|
|
82
|
+
| `ra_send` | Execute a payment transaction |
|
|
83
|
+
| `ra_subscribe` | Create a subscription for a customer |
|
|
84
|
+
| `ra_refund` | Open Stripe Dashboard for refunds |
|
|
85
|
+
|
|
86
|
+
### Query Operations
|
|
87
|
+
|
|
88
|
+
| Tool | Description |
|
|
89
|
+
|------|-------------|
|
|
90
|
+
| `ra_balance` | Check available balance |
|
|
91
|
+
| `ra_history` | Get transaction history |
|
|
92
|
+
| `ra_whoami` | Check account status |
|
|
93
|
+
|
|
94
|
+
## Security
|
|
95
|
+
|
|
96
|
+
### Subprocess Isolation
|
|
97
|
+
|
|
98
|
+
MCP server spawns Ra Pay CLI as subprocess. Credentials remain in OS keyring - MCP server never sees them directly.
|
|
99
|
+
|
|
100
|
+
### Response Sanitization
|
|
101
|
+
|
|
102
|
+
All CLI output is sanitized to prevent prompt injection:
|
|
103
|
+
- ANSI escape sequences removed
|
|
104
|
+
- System markers filtered (`[SYSTEM]`, `[USER]`, etc.)
|
|
105
|
+
- Control characters stripped
|
|
106
|
+
|
|
107
|
+
### Rate Limiting
|
|
108
|
+
|
|
109
|
+
Defense-in-depth layer at MCP level:
|
|
110
|
+
|
|
111
|
+
| Tool | Limit |
|
|
112
|
+
|------|-------|
|
|
113
|
+
| `ra_send` | 1 per 60 seconds |
|
|
114
|
+
| `ra_subscribe` | 1 per 60 seconds |
|
|
115
|
+
| `ra_refund` | 5 per 60 seconds |
|
|
116
|
+
| `ra_balance` | 10 per 60 seconds |
|
|
117
|
+
| `ra_history` | 10 per 60 seconds |
|
|
118
|
+
| `ra_whoami` | 20 per 60 seconds |
|
|
119
|
+
|
|
120
|
+
Note: Backend also enforces velocity controls (account-tier daily limits).
|
|
121
|
+
|
|
122
|
+
## Privacy & Data Storage
|
|
123
|
+
|
|
124
|
+
Ra Pay is designed as a "dumb pipe" to Stripe:
|
|
125
|
+
|
|
126
|
+
**What Ra Pay stores:**
|
|
127
|
+
- Your user ID
|
|
128
|
+
- Your Stripe account ID (encrypted)
|
|
129
|
+
- Action logs: "payment sent", "balance checked" (no amounts)
|
|
130
|
+
- Transaction audit trail with Stripe transfer IDs
|
|
131
|
+
|
|
132
|
+
**What Ra Pay does NOT store:**
|
|
133
|
+
- Your payment amounts
|
|
134
|
+
- Recipient details
|
|
135
|
+
- Payment descriptions
|
|
136
|
+
- Your account balance
|
|
137
|
+
- Any personally identifiable information (Stripe handles KYC)
|
|
138
|
+
|
|
139
|
+
**What MCP server adds:**
|
|
140
|
+
- Client type tracking ("called via Claude Desktop")
|
|
141
|
+
- Tool call audit logs (same privacy level as above)
|
|
142
|
+
- No new PII storage
|
|
143
|
+
|
|
144
|
+
## Configuration
|
|
145
|
+
|
|
146
|
+
### Environment Variables
|
|
147
|
+
|
|
148
|
+
| Variable | Description | Default |
|
|
149
|
+
|----------|-------------|---------|
|
|
150
|
+
| `RAPAY_CLI_PATH` | Path to Ra Pay CLI executable | `ra` |
|
|
151
|
+
|
|
152
|
+
### Audit Logging
|
|
153
|
+
|
|
154
|
+
Logs are written to `~/.rapay/mcp-audit.log` with 7-day retention:
|
|
155
|
+
- Tool name, timestamp, duration
|
|
156
|
+
- Result (success/error/rate_limited)
|
|
157
|
+
- Sanitized inputs (amounts redacted, emails masked)
|
|
158
|
+
|
|
159
|
+
## Error Handling
|
|
160
|
+
|
|
161
|
+
### Error Codes
|
|
162
|
+
|
|
163
|
+
| Code | Description | Retryable |
|
|
164
|
+
|------|-------------|-----------|
|
|
165
|
+
| `RATE_LIMIT_EXCEEDED` | MCP rate limit hit | No (wait) |
|
|
166
|
+
| `CLI_NOT_FOUND` | Ra Pay CLI not installed | No |
|
|
167
|
+
| `TOS_ACCEPTANCE_REQUIRED` | ToS not accepted | No |
|
|
168
|
+
| `ACCOUNT_NOT_LINKED` | Stripe account not linked | No |
|
|
169
|
+
| `VELOCITY_EXCEEDED` | Daily limit exceeded | No |
|
|
170
|
+
| `TIMEOUT` | Request timed out | Yes |
|
|
171
|
+
| `NETWORK_ERROR` | Network connectivity issue | Yes |
|
|
172
|
+
| `EXECUTION_FAILED` | Generic CLI error | No |
|
|
173
|
+
|
|
174
|
+
### Rate Limit Error
|
|
175
|
+
|
|
176
|
+
```json
|
|
177
|
+
{
|
|
178
|
+
"error": "rate_limit_exceeded",
|
|
179
|
+
"code": "RATE_LIMIT_EXCEEDED",
|
|
180
|
+
"message": "Too many requests. Please wait 60 seconds.",
|
|
181
|
+
"retry_after_seconds": 60,
|
|
182
|
+
"retryable": false
|
|
183
|
+
}
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
### CLI Not Found Error
|
|
187
|
+
|
|
188
|
+
```json
|
|
189
|
+
{
|
|
190
|
+
"error": "cli_not_found",
|
|
191
|
+
"code": "CLI_NOT_FOUND",
|
|
192
|
+
"message": "Ra Pay CLI not found. Please install it first.",
|
|
193
|
+
"retryable": false
|
|
194
|
+
}
|
|
195
|
+
```
|
|
196
|
+
|
|
197
|
+
### ToS Required Error
|
|
198
|
+
|
|
199
|
+
```json
|
|
200
|
+
{
|
|
201
|
+
"error": "tos_required",
|
|
202
|
+
"code": "TOS_ACCEPTANCE_REQUIRED",
|
|
203
|
+
"message": "Terms of Service must be accepted. Run 'ra accept-tos' first.",
|
|
204
|
+
"retryable": false
|
|
205
|
+
}
|
|
206
|
+
```
|
|
207
|
+
|
|
208
|
+
### For Claude API Callers: Exponential Backoff
|
|
209
|
+
|
|
210
|
+
If you receive `RATE_LIMIT_EXCEEDED`, implement exponential backoff:
|
|
211
|
+
|
|
212
|
+
```typescript
|
|
213
|
+
const maxRetries = 3;
|
|
214
|
+
let delay = 60; // seconds
|
|
215
|
+
|
|
216
|
+
for (let attempt = 0; attempt < maxRetries; attempt++) {
|
|
217
|
+
try {
|
|
218
|
+
return await mcp.callTool('ra_send', params);
|
|
219
|
+
} catch (error) {
|
|
220
|
+
if (error.code === 'RATE_LIMIT_EXCEEDED') {
|
|
221
|
+
console.log(`Rate limited. Waiting ${delay}s before retry...`);
|
|
222
|
+
await sleep(delay * 1000);
|
|
223
|
+
delay *= 2; // exponential backoff
|
|
224
|
+
} else {
|
|
225
|
+
throw error;
|
|
226
|
+
}
|
|
227
|
+
}
|
|
228
|
+
}
|
|
229
|
+
|
|
230
|
+
// DO NOT:
|
|
231
|
+
// - Retry immediately (wastes time, still rate limited)
|
|
232
|
+
// - Retry more than 3 times (indicates genuine rate limit)
|
|
233
|
+
// - Ignore retry_after_seconds field
|
|
234
|
+
```
|
|
235
|
+
|
|
236
|
+
Note: MCP rate limiting is client-side defense-in-depth. Backend also enforces velocity controls per account tier.
|
|
237
|
+
|
|
238
|
+
## Data Flow
|
|
239
|
+
|
|
240
|
+
```
|
|
241
|
+
You (Claude Desktop/API)
|
|
242
|
+
|
|
|
243
|
+
v
|
|
244
|
+
MCP Server (this package)
|
|
245
|
+
| - Logs tool calls (no amounts/PII)
|
|
246
|
+
| - Rate limits requests
|
|
247
|
+
| - Sanitizes responses
|
|
248
|
+
v
|
|
249
|
+
Ra Pay CLI (subprocess)
|
|
250
|
+
| - Credentials in OS keyring
|
|
251
|
+
| - Adds replay protection
|
|
252
|
+
v
|
|
253
|
+
Ra Pay Backend
|
|
254
|
+
| - Validates requests
|
|
255
|
+
| - Enforces velocity limits
|
|
256
|
+
v
|
|
257
|
+
Stripe API
|
|
258
|
+
| - Owns all PII
|
|
259
|
+
| - Processes payments
|
|
260
|
+
v
|
|
261
|
+
Recipient's Bank
|
|
262
|
+
```
|
|
263
|
+
|
|
264
|
+
All sensitive data flows directly to Stripe. Ra Pay only records that an action occurred.
|
|
265
|
+
|
|
266
|
+
## Security Model
|
|
267
|
+
|
|
268
|
+
This section documents the security posture of the published npm package.
|
|
269
|
+
|
|
270
|
+
### What's Published to npm
|
|
271
|
+
|
|
272
|
+
| Category | Included | Excluded |
|
|
273
|
+
|----------|----------|----------|
|
|
274
|
+
| Compiled JavaScript | Yes | - |
|
|
275
|
+
| TypeScript declarations | Yes | - |
|
|
276
|
+
| Source maps (.js.map) | No | Excluded for code privacy |
|
|
277
|
+
| Source code (src/) | No | Development only |
|
|
278
|
+
|
|
279
|
+
### Intentionally Public Information
|
|
280
|
+
|
|
281
|
+
| Metadata | Value | Rationale |
|
|
282
|
+
|----------|-------|-----------|
|
|
283
|
+
| Repository | github.com/Ra-Pay-AI/rapay | Open source by design |
|
|
284
|
+
| Author | Ra Pay | Company name |
|
|
285
|
+
| License | MIT | Standard permissive license |
|
|
286
|
+
| Keywords | mcp, payments, stripe, claude | Discoverability |
|
|
287
|
+
|
|
288
|
+
### Security Features Exposed (By Design)
|
|
289
|
+
|
|
290
|
+
These are documented for users and do not represent vulnerabilities:
|
|
291
|
+
|
|
292
|
+
- **Rate limiting rules** - Users need to know limits to implement backoff
|
|
293
|
+
- **Error codes** - Required for proper error handling
|
|
294
|
+
- **Tool schemas** - Required by MCP protocol specification
|
|
295
|
+
- **Audit log location** (~/.rapay/mcp-audit.log) - Users may need to inspect
|
|
296
|
+
|
|
297
|
+
### What Is NOT Exposed
|
|
298
|
+
|
|
299
|
+
| Category | Protection |
|
|
300
|
+
|----------|------------|
|
|
301
|
+
| API keys/secrets | Never in code (OS keyring only) |
|
|
302
|
+
| Backend URLs | Only public rapay.ai endpoints |
|
|
303
|
+
| User data | Subprocess isolation, never in MCP process |
|
|
304
|
+
| Payment amounts | Redacted as `[redacted]` in all logs |
|
|
305
|
+
| Email addresses | Masked (j***@example.com) in audit logs |
|
|
306
|
+
|
|
307
|
+
### Subprocess Isolation Model
|
|
308
|
+
|
|
309
|
+
```
|
|
310
|
+
βββββββββββββββββββββββ
|
|
311
|
+
β AI Agent (Claude) β
|
|
312
|
+
βββββββββββ¬ββββββββββββ
|
|
313
|
+
β MCP Protocol (stdio)
|
|
314
|
+
βΌ
|
|
315
|
+
βββββββββββββββββββββββ
|
|
316
|
+
β MCP Server (npm) β β No credentials here
|
|
317
|
+
β - Rate limiting β
|
|
318
|
+
β - Input validation β
|
|
319
|
+
β - Response sanitizeβ
|
|
320
|
+
βββββββββββ¬ββββββββββββ
|
|
321
|
+
β Spawns subprocess
|
|
322
|
+
βΌ
|
|
323
|
+
βββββββββββββββββββββββ
|
|
324
|
+
β Ra Pay CLI β β Credentials in OS keyring
|
|
325
|
+
β - Session tokens β
|
|
326
|
+
β - Stripe API calls β
|
|
327
|
+
βββββββββββββββββββββββ
|
|
328
|
+
```
|
|
329
|
+
|
|
330
|
+
The MCP server never has access to credentials. All sensitive operations are delegated to the CLI subprocess, which reads credentials directly from the OS keyring.
|
|
331
|
+
|
|
332
|
+
## Development
|
|
333
|
+
|
|
334
|
+
```bash
|
|
335
|
+
npm run dev # Watch mode
|
|
336
|
+
npm run build # Build
|
|
337
|
+
npm run lint # Lint
|
|
338
|
+
npm run test # Test
|
|
339
|
+
```
|
|
340
|
+
|
|
341
|
+
## License
|
|
342
|
+
|
|
343
|
+
MIT
|
package/dist/index.d.ts
CHANGED
package/dist/index.js
CHANGED
package/package.json
CHANGED
package/LICENSE
DELETED
|
@@ -1,21 +0,0 @@
|
|
|
1
|
-
MIT License
|
|
2
|
-
|
|
3
|
-
Copyright (c) 2025 MCP Contributors
|
|
4
|
-
|
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
-
in the Software without restriction, including without limitation the rights
|
|
8
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
-
furnished to do so, subject to the following conditions:
|
|
11
|
-
|
|
12
|
-
The above copyright notice and this permission notice shall be included in all
|
|
13
|
-
copies or substantial portions of the Software.
|
|
14
|
-
|
|
15
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
-
SOFTWARE.
|