@rapay/mcp-server 1.2.6 → 1.3.1

package/dist/handlers.js

@@ -38,6 +38,7 @@ const MAX_OUTPUT_SIZE = 1024 * 1024; // 1MB
 const RATE_LIMITS = {
     ra_send: { windowMs: 60000, maxCalls: 1 },
     ra_refund: { windowMs: 60000, maxCalls: 5 },
+    ra_add_card: { windowMs: 60000, maxCalls: 5 },
     ra_balance: { windowMs: 60000, maxCalls: 10 },
     ra_history: { windowMs: 60000, maxCalls: 10 },
     ra_whoami: { windowMs: 60000, maxCalls: 20 },
@@ -268,6 +269,9 @@ export async function handleToolCall(toolName, args) {
             case "ra_send":
                 result = await executeSend(args);
                 break;
+            case "ra_add_card":
+                result = await executeAddCard();
+                break;
             case "ra_refund":
                 result = await executeRefund();
                 break;
@@ -335,24 +339,35 @@ function parseCliError(error) {
             retryable: false,
         };
     }
-    // Account not linked
-    if (message.includes("not linked") || message.includes("link-bank")) {
-        return {
-            error: "account_not_linked",
-            code: "ACCOUNT_NOT_LINKED",
-            message: "Stripe account not linked. Run 'ra link-bank' first.",
-            retryable: false,
-        };
-    }
     // Session expired or invalid (from server-side session management)
-    // Tightened 401 regex to avoid false positives (e.g., matching "401 Main St")
+    // MUST be checked BEFORE "no payment method" and "account not linked" blocks,
+    // because session-expired messages can mention "ra add-card" and "ra link-bank"
+    // which would cause misclassification if checked after those blocks.
     const is401Error = /(?:status|code|http)[^0-9]{0,10}401/i.test(message) ||
         /401[^a-z]{0,10}(?:unauthorized|unauthenticated)/i.test(message);
     if (message.includes("session expired") || message.includes("SESSION_EXPIRED") || message.includes("session invalid") || is401Error) {
         return {
             error: "session_expired",
             code: "SESSION_EXPIRED",
-            message: "Session expired. Run 'ra link-bank' to re-authenticate.",
+            message: "Session expired. Run 'ra link-bank' or 'ra add-card' to re-authenticate.",
+            retryable: false,
+        };
+    }
+    // No payment method configured (card or bank)
+    if (message.includes("No payment method") || message.includes("No card saved")) {
+        return {
+            error: "no_payment_method",
+            code: "NO_PAYMENT_METHOD",
+            message: "No payment method configured. The user needs to run `ra add-card` to save a credit card, or `ra link-bank` to connect a bank account.",
+            retryable: false,
+        };
+    }
+    // Account not linked (legacy)
+    if (message.includes("not linked") || message.includes("link-bank")) {
+        return {
+            error: "account_not_linked",
+            code: "ACCOUNT_NOT_LINKED",
+            message: "No payment method configured. Run 'ra add-card' to save a card, or 'ra link-bank' to connect a bank account.",
             retryable: false,
         };
     }
@@ -548,6 +563,19 @@ async function executeSend(args) {
     ];
     return executeCliCommand(cliArgs);
 }
+/**
+ * Execute ra add-card command
+ * This requires browser interaction — the AI agent should prompt the user
+ */
+function executeAddCard() {
+    return JSON.stringify({
+        status: "user_action_required",
+        message: "Saving a credit card requires browser interaction. " +
+            "Please ask the user to run `ra add-card` in their terminal. " +
+            "This will open Stripe Checkout where they can securely save their card.",
+        command: "ra add-card",
+    }, null, 2);
+}
 /**
  * Execute ra refund command (opens Stripe Dashboard)
  */

package/dist/index.d.ts

@@ -13,5 +13,5 @@
  * - Privacy preserved (dumb pipe model intact)
  * - No blockers
  */
-export declare const SERVER_VERSION = "1.2.6";
+export declare const SERVER_VERSION = "1.3.1";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -23,7 +23,7 @@ import { checkForUpdates } from "./version-check.js";
  * Server metadata
  */
 const SERVER_NAME = "rapay-mcp";
-export const SERVER_VERSION = "1.2.6";
+export const SERVER_VERSION = "1.3.1";
 /**
  * Initialize MCP server
  */

package/dist/tools.d.ts

@@ -1,8 +1,9 @@
 /**
  * Ra Pay MCP Server - Tool Definitions
  *
- * 7 Tools:
+ * 8 Tools:
  * - 2 Payment Operations (SENSITIVE)
+ * - 1 Account Setup Operation
  * - 5 Query/Navigation Operations (Read-only)
  *
  * Note: ra_subscribe removed in v1.2.0 for compliance (Session 53)
@@ -11,7 +12,7 @@
  */
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
 /**
- * All 7 tools combined
+ * All 8 tools combined
  */
 export declare const TOOLS: Tool[];
 /**

package/dist/tools.js

@@ -1,8 +1,9 @@
 /**
  * Ra Pay MCP Server - Tool Definitions
  *
- * 7 Tools:
+ * 8 Tools:
  * - 2 Payment Operations (SENSITIVE)
+ * - 1 Account Setup Operation
  * - 5 Query/Navigation Operations (Read-only)
  *
  * Note: ra_subscribe removed in v1.2.0 for compliance (Session 53)
@@ -87,6 +88,30 @@ const PAYMENT_TOOLS = [
         },
     },
 ];
+/**
+ * Account setup operations
+ */
+const SETUP_TOOLS = [
+    {
+        name: "ra_add_card",
+        description: "Save a credit card for sending payments. This requires the user to interact with a browser " +
+            "— the AI agent should prompt the user to run `ra add-card` in their terminal. " +
+            "The user's card is saved securely via Stripe Checkout (Ra Pay never sees card data). " +
+            "After saving a card, the user can send payments with `ra send` without needing a full Stripe Connect account.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+            required: [],
+        },
+        annotations: {
+            title: "Save Card",
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    },
+];
 /**
  * Query operations - Read-only, no SENSITIVE marker needed
  */
@@ -186,9 +211,9 @@ const QUERY_TOOLS = [
     },
 ];
 /**
- * All 7 tools combined
+ * All 8 tools combined
  */
-export const TOOLS = [...PAYMENT_TOOLS, ...QUERY_TOOLS];
+export const TOOLS = [...PAYMENT_TOOLS, ...SETUP_TOOLS, ...QUERY_TOOLS];
 /**
  * Tool names that require user confirmation (SENSITIVE operations)
  */
@@ -216,7 +241,7 @@ export function isSensitiveTool(toolName) {
  *
  * Last updated: 2026-02-08 (Session 64 added annotations to hash)
  */
-const EXPECTED_TOOL_HASH = "f5d8adb129c9c36d";
+const EXPECTED_TOOL_HASH = "4c1b95d9b088c1ec";
 /**
  * Compute the integrity hash of the tool definitions
  * Hash is based on tool names, input schemas, and annotations (deterministic)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rapay/mcp-server",
-  "version": "1.2.6",
+  "version": "1.3.1",
   "mcpName": "ai.rapay/mcp-server",
   "description": "Ra Pay MCP Server for Claude Desktop and Claude Code - AI Agent Payment Infrastructure",
   "type": "module",