Mcp Worldpay

io.github.codesparPublished by GitHub account codesparv0.2.0-alpha.3Updated Oct 25, 2026

MCP server for Access Worldpay — enterprise processor: authorize, capture, refund, tokenize

VerifiedSTDIODesktop onlyFinance Business & Commerce

Server details

Identifier: io.github.codespar/mcp-worldpay
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account codespar for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.codespar%2Fmcp-worldpay.svg)](https://sourceweft.com/mcp/io.github.codespar%2Fmcp-worldpay?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server for Access Worldpay that lets an assistant authorize, capture, refund and reverse card payments, manage card tokens, run 3DS2 steps, handle and

What you can do: Authorize, capture, cancel, refund and reverse card payments, and look up payments by event ID or transaction reference, plus list recent payment events and reconciliation batches. Verify accounts with AVS/CVC checks and run standalone FraudSight screening without charging. Create, read, update and delete stored card tokens for card-on-file reuse. Walk through the three 3DS2 steps: device-data collection lookup, cardholder authentication and challenge response. Retrieve disputes, open a defence, submit evidence or accept a chargeback.
When to use it: Useful when an assistant needs to drive Access Worldpay payment operations from a desktop client, such as testing authorize and capture flows in the sandbox, managing stored card tokens, or handling disputes and reconciliation. Best suited to developers or merchants already onboarded with Access Worldpay.
Requirements: Runs locally over stdio via the npm package, so Node.js is needed. Requires Worldpay-issued Basic Auth credentials in WORLDPAY_USERNAME and WORLDPAY_PASSWORD, plus the merchant entity ID in WORLDPAY_ENTITY. WORLDPAY_ENV selects sandbox (default) or production, and WORLDPAY_API_VERSION defaults to v7. Network access to the Worldpay endpoints is required.

Before you install

This server moves real money: authorize, capture, refund, reverse and dispute actions are financially binding, and production mode points at the live Worldpay endpoint. It needs API credentials in WORLDPAY_USERNAME and WORLDPAY_PASSWORD, which grant payment access and should be kept out of logs and shared configs. Token tools can delete stored card tokens. The package is an alpha release whose endpoints and media types may change.

Installation

In SourceWeft

Open Mcp Worldpay in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-worldpay

MCP server for Access Worldpay — global enterprise payment processor.

Worldpay is one of the largest card acquirers in the world and a default rail for EU/UK/US enterprise merchants. This server targets the modern Access Worldpay REST surface, not the legacy FIS/WPG XML gateway.

Status: 0.1.0-alpha.1 — Access Worldpay uses HATEOAS action links (linkData) for lifecycle operations. Exact endpoint paths and media-type versions have been validated against the public docs (v7 payments, v4 verifications, v3 tokens, v1 fraudsight/disputes) but are moving targets. See Stability below.

Tools (22)

Tool	Purpose
`verify_account`	Run an AVS/CVC account verification on a card without charging it.
`authorize_payment`	Authorize a card payment.
`capture_payment`	Capture (settle) an authorized payment.
`cancel_payment`	Void an authorization that has not yet been captured.
`refund_payment`	Refund a captured payment.
`reverse_payment`	Reverse a payment atomically — voids if not yet captured, refunds if already captured.
`get_payment`	Retrieve the detail of a payment event by its Worldpay eventId.
`create_token`	Tokenize a card for reuse (card-on-file).
`get_token`	Retrieve a stored card token's metadata (bin, scheme, last4, cardHolderName, expiryDate, etc.).
`update_token`	Update metadata on a stored card token (e.g.
`delete_token`	Delete a stored card token.
`query_payment`	Look up a payment by the merchant-side transactionReference you assigned on authorize_payment.
`list_payment_events`	List recent payment events for the configured merchant entity.
`lookup_3ds`	Step 1 of 3DS2 — submit device-data-collection (DDC) output to Worldpay to determine whether a challenge is...
`authenticate_3ds`	Step 2 of 3DS2 — authenticate the cardholder.
`challenge_3ds`	Step 3 of 3DS2 — post the CReq back after the issuer challenge window closes, to retrieve the final authent...
`get_dispute`	Retrieve a dispute's current state, evidence requirements, deadlines, and HATEOAS action links.
`defend_dispute`	Open a defence on a dispute — signals intent to defend before submit_dispute_evidence.
`get_reconciliation_batch`	Retrieve a reconciliation batch (daily settlement file equivalent) — lists all settled transactions, fees,...
`accept_dispute`	Accept a dispute (forfeit the chargeback).
`submit_dispute_evidence`	Submit evidence to defend a dispute.
`fraud_screen`	Run a standalone FraudSight assessment on a payment method (no authorization).

Install

Environment

bash

WORLDPAY_USERNAME="..."    # API username (Basic Auth)WORLDPAY_PASSWORD="..."    # API password (Basic Auth)WORLDPAY_ENTITY="..."      # Merchant entity id; injected as merchant.entityWORLDPAY_ENV="sandbox"     # sandbox | production; default sandboxWORLDPAY_API_VERSION="v7"  # Payments API version; default v7

WORLDPAY_USERNAME="..."    # API username (Basic Auth)WORLDPAY_PASSWORD="..."    # API password (Basic Auth)WORLDPAY_ENTITY="..."      # Merchant entity id; injected as merchant.entityWORLDPAY_ENV="sandbox"     # sandbox | production; default sandboxWORLDPAY_API_VERSION="v7"  # Payments API version; default v7

Authentication

HTTP Basic auth with your Worldpay-issued credentials:

Each API family uses its own versioned media type. The server sets the correct Content-Type / Accept headers per call:

Family	Media type
payments	`application/vnd.worldpay.payments-v7+json`
verifications	`application/vnd.worldpay.verifications.accounts-v4+json`
tokens	`application/vnd.worldpay.tokens-v3.hal+json`
fraudsight	`application/vnd.worldpay.fraudsight-v1.hal+json`
disputes	`application/vnd.worldpay.disputes-v1.hal+json`

HATEOAS and `linkData`

Access Worldpay is HATEOAS-driven. After authorize_payment, the response contains _links such as payments:settle, payments:partialSettle, payments:cancel, payments:refund, payments:partialRefund, and payments:reverse. Each href ends in an opaque segment we call linkData, e.g.:

Extract that segment and pass it as linkData to capture_payment / cancel_payment / refund_payment / reverse_payment. When omitted, the server POSTs to the bare resource path; this only works for onboardings configured for transactionReference-addressable settlements.

Run

bash

# stdio (default — for Claude Desktop, Cursor, etc.)npx @codespar/mcp-worldpay
# HTTP (for server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-worldpay

# stdio (default — for Claude Desktop, Cursor, etc.)npx @codespar/mcp-worldpay
# HTTP (for server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-worldpay

Stability

Published as 0.1.0-alpha.1 until we validate end-to-end against a real sandbox account.
Global Payments acquired Worldpay in January 2026. Base URLs (try.access.worldpay.com / access.worldpay.com) remain valid as of this writing, but Global Payments has publicly signalled platform consolidation. Expect URL and media-type rebranding over the next 12–18 months. Pin the WORLDPAY_API_VERSION env var and watch the release notes.
This server does not cover: Worldpay Total (US CNP-API legacy), the WPG/FIS XML gateway, Disputes Direct (separate from Access Disputes), or Worldpay for Platforms. Those are separate surfaces and would be separate packages.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/payments/worldpay/README.md at commit d0a519a

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.2.0-alpha.3LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts