# @payware/mcp-server payware A2A payments API for merchants, ISVs and payment institutions - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.3.1 - **Author:** io.github.payware - **License:** MIT - **npm:** @payware/mcp-server - **Source:** https://github.com/payware/mcp-server - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 6 days ## Security scan - **Status:** warnings - **Scanned:** 2026-09-18T00:13:41.663Z - **Version scanned:** 1.3.1 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `payware_generate_code_example` — Generate production-ready payware API integration code examples with authentication, error handling, and environment configuration for any operation across 16 s - `payware_generate_documentation` — Generate comprehensive documentation for payware API integration with quick start instructions, authentication flows, operation examples, error handling pattern - `payware_products_register_audio` — Register an audio file (soundbite) for a merchant's product (ISV operation). **Supported formats:** Most audio/video formats (up to 200MB) **Note:** For video f - `payware_products_get_audios` — Get all registered audio files for a merchant's product (ISV operation) - `payware_products_get_audio` — Get detailed information about a specific audio file (ISV operation) - `payware_products_update_audio` — Update audio information (title) or reassign audio to another product (ISV operation) - `payware_products_delete_audio` — Delete an audio file from a merchant's product (ISV operation). This action cannot be undone. - `payware_poi_cancel_price` — Cancel a pending price on a POI, resetting it to IDLE state. **ISV Authentication:** Uses ISV JWT with merchant partner ID and OAuth2 token. **Endpoint:** DELET - `payware_operations_cancel_transaction` — Cancel an ACTIVE transaction created by this merchant. Only the merchant who created the transaction can cancel it, and only before it has been processed. - `payware_utils_generate_code_example` — Generate code examples for different programming languages and scenarios - `payware_operations_create_transaction` - `payware_products_create_product` — Create a new product for inventory management and payment processing. **Product Structure:** 📦 **PRODUCT METADATA**: name, shortDescription, longDescription, s - `payware_deep_links_delete_product_link` — Delete an active deep link for a product. Once deleted, the deep link URL will no longer redirect to the payware mobile app. **Use Cases:** - Remove expired pro - `payware_products_delete_product` — Delete a product from a merchant account (ISV operation). This action cannot be undone. - `payware_deep_links_delete_transaction_link` — Delete an active deep link for a transaction. Once deleted, the deep link URL will no longer redirect to the payware mobile app. **Use Cases:** - Remove expired - `payware_data_export_report` — Export a READY report in a specific format (PDF, CSV, Excel, JSON). The report must be in READY status first. - `payware_operations_finalize_transaction` - `payware_utils_format_request` — Format and validate payware API requests with proper structure and headers - `payware_data_generate_report` — Generate an asynchronous data report for ISV data analysis and reporting on behalf of merchants. Production only - not supported in sandbox. - `payware_data_get_export_list` — Get all export attempts for a specific report request. Returns list of exports in various formats with their status and download information. Production only - - `payware_poi_get` — Get details of a specific POI (Point of Interaction). **ISV Authentication:** Uses ISV JWT with merchant partner ID and OAuth2 token. **Endpoint:** GET /poi/{po - `payware_products_get_product_image` — Generate a QR code or barcode image for a merchant's product (ISV operation). - `payware_deep_links_get_product_link` - `payware_products_get_product` — Get detailed information about a specific product by ID (ISV operation) - `payware_poi_get_qrcode` — Generate a QR code image for a POI that customers can scan. **Endpoint:** GET /poi/{poiId}/image **Authentication:** Public endpoint (no auth required) **Use Ca - `payware_data_get_report_requests` — Get all execution requests for a specific report type. Returns historical execution records with status and parameters. Production only - not supported in sandb - `payware_data_get_report_status` — Get the status of an asynchronous report generation request. Use this to monitor report progress. - `payware_poi_get_status` — Get current status of a POI including any pending payment. **ISV Authentication:** Uses ISV JWT with merchant partner ID and OAuth2 token. **Endpoint:** GET /po - `payware_operations_get_transaction_status` - `payware_authorization_oauth2_get_token_info` — Get information about an OAuth2 access token. This endpoint exposes information about access tokens, including their status. Only information about tokens reque - `payware_operations_get_transaction_history` - `payware_deep_links_get_transaction_link` - `payware_isv_create_invitation` - `payware_isv_list_invitations` - `payware_isv_get_invitation` — Get full details of one invitation, including its link and the merchant data it pre-fills. **Endpoint:** GET /isv/invitations/{invitationId} **This is how you r - `payware_isv_cancel_invitation` - `payware_reference_lookup` - `payware_data_get_export_status` — Get the status of a report export request. Use this to monitor export progress. - `payware_data_download_export` — Download a READY export file. The export must be in READY status. Returns binary data for the file. - `payware_data_cancel_report` — Cancel a running report generation. Only reports in QUEUED status can be cancelled. ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp-server\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@payware/mcp-server\"\n ],\n \"env\": {\n \"PAYWARE_OAUTH_CLIENT_SECRET\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `PAYWARE_OAUTH_CLIENT_SECRET` — Payware OAuth Client Secret (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Critical blast radius — deletes data; holds an oauth grant. - Floor 60, ceiling 60 (tier: critical) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40payware%2Fmcp-server - Install plan: https://forgeregistry.com/api/v1/packages/%40payware%2Fmcp-server/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40payware%2Fmcp-server - HTML page: https://forgeregistry.com/registry/%40payware%2Fmcp-server - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.