
Allowance MCP
com.useallowancePublished by useallowance.comOfficial publisherv0.1.2Updated Oct 24, 2026
Secure agent purchasing with human-approved virtual cards, receipts, and audit trails.
Overview
Hosted MCP server that lets an AI agent request human-approved, scoped virtual cards and complete purchases with an audit trail.
- What you can do
- Create, poll, wait on, list and cancel allowance requests for specific purchases
- Retrieve approved contact, shipping and billing details needed for checkout
- Issue scoped virtual cards, complete purchase authentication and report purchase success or failure with receipts
- List purchase attempts and allowances, and pause or revoke an allowance
- Check supported merchants and merchant details, and handle remote fulfillment messages
- When to use it
- Use it when an agent should be able to buy things online but the human wants to approve each purchase on their phone and keep the agent away from the real card. It suits checkout flows where spend limits, receipts and an audit trail matter.
- Requirements
- Remote streamable-HTTP endpoint at mcp.useallowance.com; no local package. An Allowance account and completion of the Allowance OAuth flow in the MCP client, after which the client sends the issued bearer token in the Authorization header. Network access to the hosted server.
Installation
In SourceWeft
- Open Allowance MCP in the dashboard and add it to a workspace.
- Connect the required credentials. They are stored privately and never shown on public pages.
- Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.useallowance%2Fallowance-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Other MCP clients
Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.
{
"mcpServers": {
"allowance": {
"type": "http",
"url": "https://mcp.useallowance.com/"
}
}
}README
Allowance MCP
Allowance is a payment security layer for AI agents. It lets humans approve scoped purchases on their phone while agents complete checkout with limited-use payment credentials instead of the human's real card.
Allowance MCP exposes that flow to MCP clients: agents can request approval for a specific purchase, receive a scoped virtual card after approval, complete checkout, and report receipts and final charged amounts back into an audit trail.
This repository is the public listing and configuration home for the hosted Allowance MCP server. The implementation repository is private.
[Allowance MCP social preview]
Hosted Server
- Server URL:
https://mcp.useallowance.com - Transport:
streamable-http - Official registry name:
com.useallowance/allowance-mcp - Official registry URL:
https://registry.modelcontextprotocol.io/v0.1/servers/com.useallowance%2Fallowance-mcp/versions/latest - Company site:
https://useallowance.com - Discovery metadata:
https://useallowance.com/.well-known/mcp.json - Product docs:
https://useallowance.com/mcp
Authentication
Allowance MCP uses OAuth. Connect your MCP client to https://mcp.useallowance.com and complete the Allowance OAuth flow when prompted.
After OAuth completes, MCP clients send the issued bearer token on tool calls. Users should not create or paste standalone API keys for normal MCP use. Do not commit tokens, card credentials, or checkout PII.
Core Flow
- The agent creates an allowance request for a specific purchase.
- The human approves, denies, or lets the request expire on their phone.
- If approved, the agent completes checkout with scoped payment credentials or waits for Allowance remote fulfillment.
- The agent reports success or failure, including receipt and charged amount details when available.
Human phone approval is the spending authorization. After approval, agents should not ask for another final confirmation unless the realized total exceeds the approved cap, checkout requires unavailable information, or the item materially differs from the approved request.
What Allowance Controls
- Spend scope: merchant, amount cap, purchase reason, and expiration.
- Payment exposure: agents get limited payment credentials instead of the human's real card.
- Checkout data: approved contact, shipping, and billing fields are available only when needed for checkout.
- Auditability: requests, approvals, card issuance, purchase attempts, receipts, and failures are recorded.
- Revocation: humans can pause or revoke allowances instead of leaving broad payment access with an agent.
Tools
send_allowance_requestpoll_allowance_requestwait_for_allowance_requestget_allowance_requestlist_allowance_requestscancel_allowance_requestget_contact_detailsget_allowance_shipping_addressget_allowance_billing_addressissue_allowance_cardcomplete_purchase_authreport_purchase_successreport_purchase_failurelist_allowance_purchase_attemptsget_allowancewait_for_remote_fulfillmentreply_to_remote_fulfillment_messagelist_allowancespause_allowancerevoke_allowancelist_supported_merchantscheck_merchant
Security Model
Allowance is designed so agents spend with scoped authorization instead of receiving the human's real card. Approvals, limits, receipts, and audit trails are enforced by Allowance.
If you find a security issue, email [email protected].
Source: README.md at commit 62e8bfb
Tools
0Version history
1- v0.1.2LatestSep 16, 2026
Score
75% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 daysRequired25 pts
- Auth declaredRequired10 pts
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts
Declare a license in the repository or the registry entry.