IMBA Agent Spend

com.imbawalletPublished by imbawallet.comOfficial publisherv0.1.4Updated Oct 26, 2026

IMBA spend MCP: USDT TRC-20 deposit and catalog buy with your key. No withdraw.

VerifiedStreamable HTTPWeb executableFinanceSecurity & MonitoringBusiness & Commerce

Overview

AI-generated overview

IMBA Agent Spend lets an assistant fund an agent's USDT TRC-20 balance and spend it on prepaid cards, gift codes, eSIM plans and address screens.

What you can do
  • Check spend policy, deposit address and USDT balance for the authenticated agent
  • List prepaid card products, the agent's cards, gift offers and travel eSIM plans
  • Issue and top up Visa/MasterCard prepaid cards, buy gift codes and eSIM plans
  • Retrieve card details, including PAN/CVV as an encrypted JWE when a public key is registered
  • Poll notifications for 3-D Secure codes, and set the callback URL or rotate the HMAC secret
  • Quote, run and review paid crypto-address (KYT) screens
When to use it
Use it when an agent needs to pay merchants that only accept cards, or to buy gift codes and travel eSIM plans from a USDT balance, and when you want sanctions or mixer screening of a TRON, ETH or BTC address before accepting a transfer.
Requirements
Runs as a remote endpoint or as a local npm package over stdio. Requires an agent client_id and an Ed25519 private key, supplied as IMBA_AGENT_CLIENT_ID and IMBA_AGENT_PRIVATE_KEY, or as the X-IMBA-Agent-Client-Id and X-IMBA-Agent-Private-Key headers. A funded USDT TRC-20 deposit address is needed to spend; a public HTTPS callback URL is needed for webhooks and HMAC rotation.
Before you install
The private key is a spending credential: anyone holding it can move the agent's funds. Purchases, card issuance, top-ups and KYT checks spend real USDT from the agent balance, and KYT checks debit about 0.99 USDT. Card details can expose PAN/CVV. HMAC plaintext is shown only once, and rotating it invalidates the previous one immediately. There is no withdraw function, and deposit addresses should be re-fetched rather than cached.

Installation

In SourceWeft

  1. Open IMBA Agent Spend in the dashboard and add it to a workspace.
  2. Connect Custom headers credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.imbawallet%2Fagent/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "imba-agent-spend": {
      "type": "http",
      "url": "https://imbawallet.com/mcp/spend",
      "headers": {
        "X-IMBA-Agent-Client-Id": "<VALUE>",
        "X-IMBA-Agent-Private-Key": "<VALUE>"
      }
    }
  }
}

README

This repository has no README.

Tools

19

get_spend_policy

Spend policy

Forbidden rails and tier rules. Allowed catalog: Visa prepaid, travel eSIM, gift cards, paid KYT address screen. Read-only.

Takes no parameters.

get_deposit_address

USDT TRC-20 deposit address

POST /api/deposit_address blockchain=tron. Address is issued for the authenticated agent only. Always re-fetch before send. Do not cache. USDT TRC-20 only. 24h unfunded hold.

Takes no parameters.

get_balance

Ledger 2401 balance

GET /api/balance. USDT is the spendable catalog currency.

Takes no parameters.

list_cards

List cards

POST /api/cards for the authenticated agent. No client_id argument.

Takes no parameters.

list_card_products

List card products

POST /api/card_products. Use id as imba_product_id for create_card (Visa prepaid). Space catalog calls ~1s apart.

Takes no parameters.

list_gift_offers

List gift offers

POST /api/offers. Live gift catalog (~20k positions / ~2k unique: Apple, Google Play, Steam, games, travel, retail). Optional query string. Then purchase_gift with offer_id + ext_id. Space catalog calls ~1s apart. Do not assume a SKU.

Parametersquery

list_esim_plans

List eSIM plans

POST /api/esim/plans. Travel/data eSIM. esim_provider=yesim. Optional country ISO2. Use plan id with purchase_esim. Space catalog calls ~1s apart (agent catalog_gap).

Parameterscountryesim_provider

create_card

Buy a virtual card

Issue a Visa/MasterCard prepaid from this agent 2401 USDT so the agent can pay merchants that require a card (airlines, hotels, SaaS, datacenter/GPU clouds). POST /api/pin/create_card. ext_id required. imba_product_id is core.card_product.id. Never payment_source=stars. Never pass client_id. IMBA does not create the booking.

Parametersemailphoneext_idrequiredcountrylast_namebirth_datefirst_nameimba_product_idrequired

topup_card

Top up a card

POST /api/pin/topup_card from this agent 2401 USDT. card_id must belong to the same agent (SQL owner guard). ext_id required. Never Stars.

Parametersamountrequiredext_idrequiredcard_idrequired

purchase_gift

Buy a gift card

POST /api/purchase. Buy a brand gift code (Apple, Steam, Google Play, … — live list). ext_id required. Never payment_source=stars.

Parametersext_idrequiredoffer_idrequiredexpected_pricepayment_sourcerequired_fields

purchase_esim

Buy an eSIM plan

POST /api/esim/new_plan5. Buy a travel/data eSIM plan from this agent 2401. Omit blank/null iccid so SQL takes the new-eSIM path. A set iccid must already belong to this agent. ext_id required. Never Stars.

Parametersiccidext_idrequiredplan_idrequiredpayment_source

get_card_details

Card payment credentials

POST /api/pin/get_card_details for a card this agent owns. Needed to present PAN at merchant checkout (airline, datacenter, SaaS). PAN/CVV arrive as card_encrypted JWE when jwe_public_key is registered (PATCH webhook). Without that key the number is masked. Never logs raw PAN. cvv defaults true. Never pass client_id.

Parameterscvvcard_idrequired

list_notifications

Inbox and 3DS OTP

POST /api/notifications. Poll this when a Visa payment asks for 3-D Secure. Agents keep payload.code (never SMS, never Telegram). category=codes for 3-D Secure OTP. Also delivered on webhook field otp if callback_url is set, and optional email. Space catalog calls ~1s apart.

Parameterslimitprev_idprev_tscategory

set_webhook

Set callback URL / JWE / OTP email

PATCH /auth/v1/agent/webhook. Sets https callback_url (required before hmac/rotate), optional X25519 jwe_public_key for card_encrypted, optional email for 3DS OTP. Not SMS. HMAC plaintext is shown once when a URL is first accepted.

Parametersemailcallback_urljwe_public_key

rotate_hmac

Rotate webhook HMAC

POST /auth/v1/agent/hmac/rotate. Previous HMAC dies immediately. Requires an existing callback_url (400 callback_url required before rotate otherwise). Pass callback_url here to PATCH webhook first. Plaintext HMAC is returned once — store it; never a Wallet JWT.

Parametersemailcallback_urljwe_public_key

kyt_quote

KYT price

POST /api/kyt_quote. Price for a paid crypto-address screen (Didit). Debit is on kyt_check (~0.99 USDT from 2401), not on quote. Off unless didit.enabled and didit.agent_api. Does not gate TRON deposit. Not /api/client/kyt_* and not partner. Space ~1s.

Takes no parameters.

kyt_check

Paid KYT check

Screen a crypto address for dirt (sanctions / mixer exposure). Use BEFORE you accept a TRC-20 send, or AFTER a wallet is blocked and the reason is unclear. POST /api/kyt_check. Body: network (tron_usdt | eth | btc) + address. Debits ~0.99 USDT from 2401. Returns a report — does not gate deposit, does not ban or unblock. TON is not in this catalog. Never pass client_id. Space ~1s.

Parametersaddressrequirednetworkrequiredrefresh

kyt_check_get

KYT check by id

POST /api/kyt_check_get. Poll until the report is ready. Own check only (404 otherwise). Use after kyt_check when a wallet was blocked and you need the dirt report. Never pass client_id.

Parametersidrequired

kyt_checks

KYT history

POST /api/kyt_checks. Own KYT history plus quote fields. Use to find a past address check. Space ~1s. Never pass client_id.

Parameterslimitlast_id

Version history

1
  1. v0.1.4LatestSep 16, 2026

Score

75% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.

Other Imbawallet integrations

IMBA Agent Docs

com.imbawalletOfficial publisher

Read-only documentation server for the IMBA Agent API, giving assistants canonical facts, use-case playbooks, tier policy and public doc URLs.

Streamable HTTPWeb executable
Finance6 toolsOct 28, 2026