CoinVello

io.github.CoinVelloPublished by GitHub account CoinVellov0.1.4Updated Nov 1, 2026

Non-custodial crypto payments: checkout sessions, invoices, webhooks and test payments. No KYC.

VerifiedStreamable HTTPWeb executableFinanceDeveloper ToolsBusiness & Commerce

Overview

AI-generated overview

CoinVello's MCP server lets an assistant create crypto checkout sessions, inspect invoices and payments, register wallets and webhooks, and export bookkeeping…

What you can do
  • Create and inspect checkout sessions, invoices and on-chain payments, with status and filters
  • Register receiving wallets and webhook endpoints, and verify webhook signatures locally
  • Check prepaid credit balance, list credit bundles and start crypto credit purchases
  • Read the book of record, get period summaries and build CSV, Excel or JSON exports
  • Look up mid-market rates and supported assets, and simulate test payments with test keys
When to use it
Useful when building or debugging a CoinVello crypto checkout integration: scaffolding a checkout route, a signed webhook handler, or reconciling payments and producing bookkeeping exports. Also handy for checking invoices, payments and credit balances from a chat client.
Requirements
Runs as a hosted remote endpoint or locally via npx (Node.js). Needs a CoinVello API key, passed as COINVELLO_API_KEY or an Authorization bearer header; test keys are recommended. Optional COINVELLO_API_BASE, COINVELLO_ALLOW_LIVE and COINVELLO_API_VERSION. Network access to the CoinVello API.
Before you install
The API key is a credential; the hosted server accepts test keys only, and live keys are refused unless COINVELLO_ALLOW_LIVE=1. create_webhook returns the whsec_ secret once and tool output includes it. create_wallet must never receive a private key or seed phrase. Credit purchases spend real crypto, and checkout sessions and webhooks create live objects. Self-hosted HTTP mode uses the environment key, so keep it behind authentication.

Installation

In SourceWeft

  1. Open CoinVello in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.CoinVello%2Fcoinvello/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "coinvello": {
      "type": "http",
      "url": "https://mcp.coinvello.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

@coinvello/mcp

Model Context Protocol server for the CoinVello API, the non-custodial crypto payment processor (no KYC, merchant keeps the keys, fees as prepaid credits, 11 networks).

Give Claude, Cursor, Windsurf, ChatGPT or any MCP client the ability to create checkout sessions, inspect invoices and payments, register webhooks, verify webhook signatures, manage credits and simulate test payments while it writes your integration.

bash
npx -y @coinvello/mcp            # stdio (what every desktop client uses)npx -y @coinvello/mcp --http 3333  # Streamable HTTP on http://127.0.0.1:3333/mcp
bash
# from a checkout of this repo insteadnpm install && npm run build && node dist/index.js

Hosted (nothing to install)

https://mcp.coinvello.com/mcp runs this server for you over Streamable HTTP. Send your own key with every request as Authorization: Bearer cv_test_... (or X-CoinVello-Api-Key, or an api_key setting in clients that only take query parameters). The hosted server stores nothing, accepts test keys only, and never logs keys. Run it yourself with npx -y @coinvello/mcp --http --hosted.

json
{ "mcpServers": { "coinvello": { "url": "https://mcp.coinvello.com/mcp", "headers": { "Authorization": "Bearer cv_test_..." } } } }

Documentation

Website and setup for AI assistantshttps://coinvello.com/ai
Complete integration guide (one file, written for LLMs)https://coinvello.com/llms-full.txt
Developer docs and SDKshttps://coinvello.com/developers
OpenAPI 3.1 referencehttps://coinvello.com/.well-known/openapi.yaml
MCP Registryio.github.CoinVello/coinvello
Sourcehttps://github.com/CoinVello/coinvello-ai (api/ai/mcp-server)
Support[email protected]

Configuration

VariableRequiredMeaning
COINVELLO_API_KEYyescv_test_... from https://coinvello.com/app/settings.php (Settings -> API keys). Any cv_test_ string works against the local mock.
COINVELLO_API_BASEnoDefault https://api.coinvello.com/v1. Use http://localhost:4242/v1 for the reference mock server.
COINVELLO_ALLOW_LIVEnoThe server refuses to start with a cv_live_ key unless this is 1. Agents should develop against test mode.
COINVELLO_API_VERSIONnoPins CoinVello-Version (default: account version, currently 2026-10-01).

Client setup

Claude Desktop

claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\):

json
{  "mcpServers": {    "coinvello": {      "command": "npx",      "args": ["-y", "@coinvello/mcp"],      "env": { "COINVELLO_API_KEY": "cv_test_..." }    }  }}

Claude Code

bash
claude mcp add coinvello -e COINVELLO_API_KEY=cv_test_... -- npx -y @coinvello/mcp

or in .mcp.json at the project root (shared with the team, key via env):

json
{  "mcpServers": {    "coinvello": {      "command": "npx",      "args": ["-y", "@coinvello/mcp"],      "env": { "COINVELLO_API_KEY": "${COINVELLO_API_KEY}" }    }  }}

Cursor

.cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

json
{  "mcpServers": {    "coinvello": {      "command": "npx",      "args": ["-y", "@coinvello/mcp"],      "env": { "COINVELLO_API_KEY": "cv_test_..." }    }  }}

Windsurf

~/.codeium/windsurf/mcp_config.json:

json
{  "mcpServers": {    "coinvello": {      "command": "npx",      "args": ["-y", "@coinvello/mcp"],      "env": { "COINVELLO_API_KEY": "cv_test_..." }    }  }}

VS Code (Copilot agent mode)

.vscode/mcp.json:

json
{  "servers": {    "coinvello": { "type": "stdio", "command": "npx", "args": ["-y", "@coinvello/mcp"], "env": { "COINVELLO_API_KEY": "cv_test_..." } }  }}

Remote / HTTP clients (ChatGPT connectors, hosted agents)

Run coinvello-mcp --http 3333 behind your own HTTPS reverse proxy and point the client at https://your-host/mcp. The HTTP mode is stateless (one server instance per request) and binds to 127.0.0.1 by default (MCP_HTTP_HOST=0.0.0.0 to change). It uses the key from the environment, so put it behind authentication: it is meant for your own agents, not the public.

Tools

ToolDoes
create_checkout_sessionPOST /checkout-sessions: hosted payment page; returns url to redirect to and invoice_id
get_invoiceGET /invoices/{id} (or GET /checkout-sessions/{cs_id}?expand=invoice)
list_invoicesGET /invoices with status / order_id / email filters
list_paymentsGET /payments with invoice_id / status / chain / tx_hash filters
create_walletPOST /wallets (xpub for BTC, address for EVM/Solana/Tron). Refuses xprv locally.
list_walletsGET /wallets
create_webhookPOST /webhooks; returns the whsec_ secret once
verify_webhook_signatureLocal HMAC check of a CoinVello-Signature header against a raw body (no API call)
get_credits_balanceGET /credits/balance
list_credit_bundlesGET /credits/bundles
create_credit_purchasePOST /credits/purchases; returns payment options + checkout_url
get_ratesGET /rates
list_assetsGET /assets (optional chain filter)
simulate_test_paymentPOST /test/simulate_payment (test keys only)
list_recordsGET /records: the book of record (payments, fees, credit purchases) valued when they happened; filters type / asset / chain / invoice / order / tx / dates / currency
get_records_summaryGET /records/summary: sales, market value received, refunds, fees, net received for a period, optionally grouped
create_exportPOST /exports: CSV, Excel or JSON file of records or any dataset (QuickBooks, Xero, Koinly, CoinTracker, CoinLedger presets); returns the export with download_url
get_exportGET /exports/{id}: poll status until ready, read file.sha256 and download_url

Every tool returns the raw API JSON (also as structuredContent). API errors come back as tool errors containing http_status, the CoinVello error envelope (type, code, message, request_id) and a hint.

Resources

URIContent
coinvello://docs/llms-full.txtComplete single-file integration guide (auth, checkout, redirect, webhook verification, polling, credits, errors, examples in curl/Node/Python/PHP)
coinvello://docs/llms.txtShort llms.txt index
coinvello://openapi.yamlOpenAPI 3.1 specification

Documents are bundled at build time; if missing they are fetched from coinvello.com.

Prompts

integrate-coinvello-into-<framework> for nextjs, express, fastapi, flask, django, laravel, rails, sinatra, go, woocommerce, shopify, generic, plus integrate-coinvello-into-framework with a free-form framework argument. Optional arguments: currency, assets. Each prompt tells the agent to read the guide resource, add a checkout route, a raw-body webhook route with signature verification and event.id dedupe, and to verify end to end with simulate_test_payment.

Typical agent session

  1. list_assets -> pick assets the merchant can accept.
  2. create_webhook with the app's /webhooks/coinvello URL -> store the secret in the env file.
  3. Write the code (see the integrate-coinvello-into-* prompt or api/ai/cookbook).
  4. create_checkout_session -> simulate_test_payment on invoice_id with enough confirmations.
  5. get_invoice shows paid; the app's webhook handler was called with a real signed event.
  6. verify_webhook_signature to debug a handler that rejects deliveries.
  7. Bookkeeping: list_records (with include_simulated: true in test mode) -> get_records_summary for a period -> create_export (format: "xlsx") -> get_export until ready -> download the download_url and check file.sha256.

Development

bash
npm installnpm run build          # copies docs into dist/docs and compiles TypeScriptnpm test               # smoke test against the mock: needs api/reference-server running on :4242npm run dev            # tsx src/index.ts (stdio)

Smoke test: cd api/reference-server && npm install && npm start, then COINVELLO_API_BASE=http://localhost:4242/v1 npm test here. It exercises all 18 tools, the three resources and the prompts, verifies a real signed delivery captured by the mock's webhook sink, and checks the xprv guard. The mock does not implement wallet CRUD, so create_wallet / list_wallets are expected to return a clean 404 tool error there.

Security notes

  • Keep the server on test keys while an agent is writing code. COINVELLO_ALLOW_LIVE=1 is a deliberate opt-in.
  • The server never logs the API key or webhook secrets. Tool output does include secret from create_webhook because that is the only time the API returns it.
  • create_wallet rejects anything that looks like an extended private key before it leaves the machine.
  • Nothing here moves funds: CoinVello is non-custodial, and the API has no "send" operation.

License MIT. Source: https://github.com/CoinVello/coinvello-ai (mirror). Issues: https://github.com/CoinVello/coinvello-ai/issues or [email protected]

Source: api/ai/mcp-server/README.md at commit a298437

Tools

18

create_checkout_session

Create a hosted checkout session

Create a CoinVello hosted checkout session (an invoice plus a payment page at pay.coinvello.com). Redirect the customer to the returned `url`. Amounts are decimal strings. `currency` is an ISO code (USD, EUR...) or an asset id to price in crypto. Fulfil orders from the invoice.paid webhook, never from the redirect.

Parameterstaxamountrequiredlocalebrandingcurrencyrequiredcustomermetadataorder_idcancel_urlexpires_inline_itemsdescription+5 more

get_invoice

Get an invoice

Retrieve an invoice (inv_...) with its status, payment_options (address, amount, payment_uri, qr_payload) and paid summary. Use for polling or reconciliation. Accepts a checkout session id (cs_...) too and returns the session with the invoice expanded.

Parametersidrequired

list_invoices

List invoices

List invoices, newest first, filterable by status, order_id or customer_email. Returns { object: 'list', data, has_more, next_cursor }.

Parameterslimitcursorstatusorder_idcreated_gtecreated_ltecustomer_email

list_payments

List payments

List on-chain payments (pay_...) with tx_hash, confirmations, amount and status (detected, confirming, confirmed, failed). Filter by invoice_id, status, chain or tx_hash.

Parameterschainlimitcursorstatustx_hashinvoice_id

create_wallet

Register a merchant wallet

Register a receiving wallet the merchant controls. type=xpub for bitcoin (CoinVello derives a fresh address per invoice from the extended PUBLIC key); type=address for ethereum, base, arbitrum, optimism, polygon, bnb, avalanche, robinhood, solana, tron. Never pass a private key or seed phrase. The wallet is usable at once in live and test mode; addresses are validated strictly (format, checksum, network, no token contracts). For xpubs, show the returned first_address so the merchant can compare it with their wallet's first receive address. Signed-message verification (POST /wallets/{id}/verification then /verify) is optional and never required.

Parameterstyperequiredxpubchainrequiredlabelrequiredassetsaddressenabledmetadatastart_indexaddress_typederivation_path

list_wallets

List wallets

List registered wallets with chain, type, status (active/verified/archived) and accepted assets. Use it to see which assets can be offered on an invoice.

Parameterschainlimitcursorstatus

create_webhook

Create a webhook endpoint

Register a webhook endpoint. The response contains `secret` (whsec_...) ONCE: store it as COINVELLO_WEBHOOK_SECRET. Live endpoints must be HTTPS; test endpoints may be http://localhost. Use events ["*"] for everything or a list such as ["invoice.paid","invoice.expired"].

Parametersurlrequiredeventsrequiredenabledmetadatadescription

verify_webhook_signature

Verify a CoinVello-Signature header

Verify a webhook delivery locally (no API call). Pass the exact raw request body, the CoinVello-Signature header (t=...,v1=...) and the endpoint secret (whsec_...). Implements the spec: HMAC-SHA256 over "<t>.<raw body>", 300 s tolerance, constant-time compare against any v1. Returns valid=true/false with the reason and the parsed event. Set ignore_timestamp=true when checking an old captured delivery.

Parameterssecretrequiredraw_bodyrequiredignore_timestampsignature_headerrequiredtolerance_seconds

get_credits_balance

Get processing-credit balance

Return the merchant's prepaid processing-credit balance: balance (= available + reserved, never negative), available (free to spend), reserved (estimated fees of open invoices paid with credits), low_balance_threshold, estimated_payments_remaining, auto_topup. There are no free live credits. 1 credit = $0.01 nominal; a confirmed payment consumes about 30 bps of its fiat value (floor 2, cap 2000).

Takes no parameters.

list_credit_bundles

List credit bundles

List purchasable credit bundles with USD price, price_per_credit and indicative crypto_prices per asset. Bigger bundles cost less per credit (effective rate ~0.30% down to <0.10%).

Takes no parameters.

create_credit_purchase

Buy credits (creates a crypto invoice)

Create a crypto credit purchase (cpu_...). Returns payment.payment_options with the address/amount to pay (CoinVello's operator wallet) and a hosted checkout_url. Credits are added when the payment confirms. Card purchases and automatic top-up are set up by the merchant in the dashboard, not through this tool. In test mode credits are free, so this is mainly for exercising the flow (pay it with simulate_test_payment).

Parametersmetadatabundle_idrequiredpay_assetpay_chainexpires_inidempotency_key

list_records

List accounting records

List the account's book of record, newest first: one immutable row per movement of value (payment_received, fee_prepaid, credit_purchase, refund_sent, fee_onchain, conversion, offramp_payout...) valued when it happened. Each record has `value` (market value at the block time in the reporting currency, rate and source included), `value_usd`, `contract_value` (what the customer owed at the invoice's locked rate), `tax`, the on-chain proof (tx_hash, block_height, addresses, explorer_url) and an invoice snapshot. `currency` re-values from value_usd at the historical rate. With a test key, rows created by simulate_test_payment appear only with include_simulated=true. Returns { object: 'list', data, has_more, next_cursor }.

Parameterstypeassetchainlimitcursortx_hashcurrencyorder_idinvoice_idoccurred_gteoccurred_lteinclude_simulated

get_records_summary

Get totals for a period

Sales (invoiced at the locked rates), received_market_value (what the coins were worth when they landed), valuation_difference, tax_collected, refunds, fees_prepaid and credits_consumed, fees_onchain, network_fees, credit_purchases and net_received, with payment counts, over occurred_at in the given timezone and currency. period_start is inclusive and period_end exclusive (a date such as 2026-01-01, or a date-time). group_by returns the same totals per month, asset, chain, type or address in `groups`. With a test key, simulated rows count only with include_simulated=true.

Parameterscurrencygroup_bytimezoneperiod_endrequiredperiod_startrequiredinclude_simulated

create_export

Export records as CSV, Excel or JSON

Create an export of the records (default), another dataset, or `all` (the year-end package) for a period, or for the entire history when period is null or omitted. Returns the export object: small exports are already `ready` with `file` (name, content_type, bytes, sha256) and a signed `download_url` valid until `download_expires_at` (files are kept 7 days); while `queued` or `processing` call get_export. Vendor presets (quickbooks, xero, koinly, cointracker, coinledger) and journal need dataset=records and format=csv (otherwise 422). Verify the downloaded file against file.sha256. With a test key pass include_simulated=true to include simulated payments.

Parametersformatrequiredperiodpresetdatasetcurrencymetadatatimezoneidempotency_keyinclude_simulated

get_export

Get an export

Retrieve an export (exp_...): status (queued, processing, ready, failed, expired), rows, file { name, content_type, bytes, sha256 }, download_url and download_expires_at, failure_reason. Poll after create_export until ready.

Parametersidrequired

get_rates

Get indicative exchange rates

Mid-market rates for supported assets against a fiat base (default USD). Indicative only; invoices lock their own rate at creation.

Parametersbaseassets

list_assets

List supported assets

Every asset CoinVello accepts in the API key's mode: id (btc:bitcoin, usdc:polygon, eurc:base...), symbol, chain, kind (native/token), contract_address, decimals, required_confirmations, min_amount, testnet name and the wallet_type (xpub or address) needed to accept it. Tokens without a testnet contract (DAI, usdc:bnb, usdt on base/arbitrum/optimism/avalanche/solana, and the Bitcoin tokens wbtc/cbbtc/btcb) are live-only, so a test key does not list them.

Parameterschain

simulate_test_payment

Simulate a payment (test mode)

Create a synthetic on-chain payment for an invoice (inv_) or credit purchase (cpu_) and run it through the real state machine and webhook pipeline. Test keys only. confirmations=0 -> payment.detected / invoice.pending; confirmations >= required -> invoice.paid. Use a smaller/larger amount to simulate underpaid/overpaid. Reuse tx_hash to advance the same payment.

Parametersassetamounttx_hashinvoice_idrequiredfrom_addressconfirmationsdelay_seconds

Version history

2
  1. v0.1.4LatestNov 1, 2026
  2. v0.1.3Nov 1, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts