Mcp Pomelo

io.github.codesparPublished by GitHub account codesparv0.1.1Updated Oct 24, 2026

MCP server for Pomelo — pan-LATAM card issuing: users, virtual/physical cards, transactions

VerifiedSTDIODesktop onlyFinance Business & Commerce

Server details

Identifier: io.github.codespar/mcp-pomelo
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account codespar for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.codespar%2Fmcp-pomelo.svg)](https://sourceweft.com/mcp/io.github.codespar%2Fmcp-pomelo?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

MCP server for Pomelo card issuing: lets an assistant create card-holder users, issue virtual or physical cards, change card status and read transactions.

What you can do: Create, fetch and update card-holder users
Issue virtual or physical cards and look up cards by id or by user/status
Change card lifecycle status (active, blocked, disabled)
Search the card-transactions feed and fetch a single transaction
Mutating calls send an auto-generated idempotency key, overridable per call
When to use it: Useful when you manage Pomelo card programs in Latin America and want an assistant to onboard cardholders, issue or freeze cards, or look up card and transaction records without leaving the chat.
Requirements: Runs locally via npx from the npm package @codespar/mcp-pomelo (Node.js). Requires OAuth2 client credentials in POMELO_CLIENT_ID and POMELO_CLIENT_SECRET; POMELO_ENV selects sandbox (default) or production, and POMELO_BASE_URL, POMELO_AUTH_URL and POMELO_AUDIENCE can override defaults. Network access to Pomelo's API is needed.

Before you install

The credentials grant real card-issuing power: with POMELO_ENV set to production the assistant can create users, issue cards and block or disable them, which affects real cardholders and money. Keep the default sandbox setting until tested, and protect POMELO_CLIENT_ID and POMELO_CLIENT_SECRET. Full PAN and CVV are not returned by these tools.

Installation

In SourceWeft

Open Mcp Pomelo in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-pomelo

MCP server for Pomelo — pan-LATAM card issuing as a service: card-holder users, virtual and physical Visa/Mastercard issuance, lifecycle management, and the transactions feed. Argentina, Brazil, Mexico, Colombia, Peru, Chile.

[npm] [License: MIT]

Quick Start

Claude Desktop

Add to ~/.config/claude/claude_desktop_config.json:

json

{  "mcpServers": {    "pomelo": {      "command": "npx",      "args": ["-y", "@codespar/mcp-pomelo"],      "env": {        "POMELO_CLIENT_ID": "your-client-id",        "POMELO_CLIENT_SECRET": "your-client-secret",        "POMELO_ENV": "sandbox"      }    }  }}

{  "mcpServers": {    "pomelo": {      "command": "npx",      "args": ["-y", "@codespar/mcp-pomelo"],      "env": {        "POMELO_CLIENT_ID": "your-client-id",        "POMELO_CLIENT_SECRET": "your-client-secret",        "POMELO_ENV": "sandbox"      }    }  }}

Claude Code

Cursor / VS Code

Add to .cursor/mcp.json or .vscode/mcp.json:

json

{  "servers": {    "pomelo": {      "command": "npx",      "args": ["-y", "@codespar/mcp-pomelo"],      "env": {        "POMELO_CLIENT_ID": "your-client-id",        "POMELO_CLIENT_SECRET": "your-client-secret",        "POMELO_ENV": "sandbox"      }    }  }}

{  "servers": {    "pomelo": {      "command": "npx",      "args": ["-y", "@codespar/mcp-pomelo"],      "env": {        "POMELO_CLIENT_ID": "your-client-id",        "POMELO_CLIENT_SECRET": "your-client-secret",        "POMELO_ENV": "sandbox"      }    }  }}

Environment

Variable	Required	Description
`POMELO_CLIENT_ID`	yes	OAuth2 client id
`POMELO_CLIENT_SECRET`	yes	OAuth2 client secret
`POMELO_ENV`	no	`sandbox` (default) or `production`
`POMELO_BASE_URL`	no	API base override (default `https://api-stage.pomelo.la` in sandbox, `https://api.pomelo.la` in production)
`POMELO_AUTH_URL`	no	Auth base override; the token call is `{AUTH_URL}/oauth/token` (default: the same host as the API, per Pomelo's docs)
`POMELO_AUDIENCE`	no	OAuth2 audience override (defaults per env)

Authentication is OAuth2 client-credentials; the server exchanges and caches the Bearer token automatically.

Tools (9)

Tool	What it does
`create_user`	Create a card-holder identity (`POST /users/v1`)
`get_user`	Fetch a user by id
`update_user`	Patch user fields (status, contact, address)
`create_card`	Issue a `VIRTUAL` or `PHYSICAL` card (`POST /cards/v1`)
`get_card`	Fetch a card (masked PAN, status, program)
`list_cards`	List cards, filterable by user/status
`update_card_status`	`ACTIVE` / `BLOCKED` / `DISABLED` lifecycle changes
`list_transactions`	Search the card-transactions feed
`get_transaction`	Fetch one transaction by id

Mutating calls carry an x-idempotency-key (auto-generated, overridable per call via idempotency_key).

Example

"Issue a virtual card for the new contractor and freeze the old one."

The agent calls create_user (if needed) → create_card (card_type: "VIRTUAL") → update_card_status (status: "BLOCKED", status_reason: "CLIENT_INTERNAL_REASON").

Notes

Card credentials (full PAN/CVV) are never returned by these tools; Pomelo exposes sensitive data only through its PCI-scoped widgets.
Authorization decisioning (approving each swipe in real time) is a webhook you host, not an API call — pair this server with CodeSpar's governed authorizer if you want mandate checks per transaction.

Authentication

OAuth2 client-credentials: the server exchanges POMELO_CLIENT_ID / POMELO_CLIENT_SECRET for a Bearer token at {AUTH_URL}/oauth/token and caches it until shortly before expiry. Mutating calls carry an x-idempotency-key.

Enterprise

Need governance, budget limits, and audit trails for agent-driven card issuing on Pomelo? CodeSpar Enterprise adds a policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/banking/pomelo/README.md at commit d0a519a

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.1LatestSep 27, 2026
v0.1.0Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts