Mcp Worldpay

io.github.codespar由 GitHub 账号 codespar 发布v0.2.0-alpha.3更新于 Oct 25, 2026

MCP server for Access Worldpay — enterprise processor: authorize, capture, refund, tokenize

已验证STDIO仅桌面金融商业与电商

概览

AI 生成的概览

面向 Access Worldpay 的本地 MCP 服务器，让助手完成授权、请款、退款、撤销、卡令牌管理、3DS2 验证及争议处理等支付操作。

可以做什么
授权、请款、取消、退款和撤销银行卡支付，按事件 ID 或交易参考号查询支付，并列出近期支付事件与对账批次。执行 AVS/CVC 账户验证，以及不产生扣款的独立 FraudSight 风险筛查。创建、读取、更新和删除用于卡存档的卡令牌。完成 3DS2 三步流程：设备数据采集查询、持卡人认证和挑战应答。获取争议详情、发起抗辩、提交证据或接受拒付。
适用场景
适合需要从桌面客户端操作 Access Worldpay 支付流程的场景，例如在沙箱中测试授权与请款、管理已存卡令牌，或处理争议与对账。主要面向已接入 Access Worldpay 的开发者或商户。
运行要求
通过 npm 包以 stdio 在本地运行，需要 Node.js。需要 Worldpay 签发的 Basic Auth 凭据，放在 WORLDPAY_USERNAME 和 WORLDPAY_PASSWORD 中，并在 WORLDPAY_ENTITY 中提供商户实体 ID。WORLDPAY_ENV 选择 sandbox（默认）或 production，WORLDPAY_API_VERSION 默认 v7。需要能访问 Worldpay 接口的网络。
安装前请注意
该服务器涉及真实资金：授权、请款、退款、撤销和争议操作都会产生财务后果，production 模式会连接正式 Worldpay 接口。它需要 WORLDPAY_USERNAME 和 WORLDPAY_PASSWORD 中的 API 凭据，这些凭据拥有支付权限，应避免出现在日志和共享配置中。令牌工具可删除已存卡令牌。该包为 alpha 版本，接口路径和媒体类型可能变动。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Mcp Worldpay，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

@codespar/mcp-worldpay

MCP server for Access Worldpay — global enterprise payment processor.

Worldpay is one of the largest card acquirers in the world and a default rail for EU/UK/US enterprise merchants. This server targets the modern Access Worldpay REST surface, not the legacy FIS/WPG XML gateway.

Status: 0.1.0-alpha.1 — Access Worldpay uses HATEOAS action links (linkData) for lifecycle operations. Exact endpoint paths and media-type versions have been validated against the public docs (v7 payments, v4 verifications, v3 tokens, v1 fraudsight/disputes) but are moving targets. See Stability below.

Tools (22)

ToolPurpose
verify_accountRun an AVS/CVC account verification on a card without charging it.
authorize_paymentAuthorize a card payment.
capture_paymentCapture (settle) an authorized payment.
cancel_paymentVoid an authorization that has not yet been captured.
refund_paymentRefund a captured payment.
reverse_paymentReverse a payment atomically — voids if not yet captured, refunds if already captured.
get_paymentRetrieve the detail of a payment event by its Worldpay eventId.
create_tokenTokenize a card for reuse (card-on-file).
get_tokenRetrieve a stored card token's metadata (bin, scheme, last4, cardHolderName, expiryDate, etc.).
update_tokenUpdate metadata on a stored card token (e.g.
delete_tokenDelete a stored card token.
query_paymentLook up a payment by the merchant-side transactionReference you assigned on authorize_payment.
list_payment_eventsList recent payment events for the configured merchant entity.
lookup_3dsStep 1 of 3DS2 — submit device-data-collection (DDC) output to Worldpay to determine whether a challenge is...
authenticate_3dsStep 2 of 3DS2 — authenticate the cardholder.
challenge_3dsStep 3 of 3DS2 — post the CReq back after the issuer challenge window closes, to retrieve the final authent...
get_disputeRetrieve a dispute's current state, evidence requirements, deadlines, and HATEOAS action links.
defend_disputeOpen a defence on a dispute — signals intent to defend before submit_dispute_evidence.
get_reconciliation_batchRetrieve a reconciliation batch (daily settlement file equivalent) — lists all settled transactions, fees,...
accept_disputeAccept a dispute (forfeit the chargeback).
submit_dispute_evidenceSubmit evidence to defend a dispute.
fraud_screenRun a standalone FraudSight assessment on a payment method (no authorization).

Install

bash
npm install @codespar/mcp-worldpay@alpha

Environment

bash
WORLDPAY_USERNAME="..."    # API username (Basic Auth)WORLDPAY_PASSWORD="..."    # API password (Basic Auth)WORLDPAY_ENTITY="..."      # Merchant entity id; injected as merchant.entityWORLDPAY_ENV="sandbox"     # sandbox | production; default sandboxWORLDPAY_API_VERSION="v7"  # Payments API version; default v7

Authentication

HTTP Basic auth with your Worldpay-issued credentials:

Authorization: Basic base64(username:password)

Each API family uses its own versioned media type. The server sets the correct Content-Type / Accept headers per call:

FamilyMedia type
paymentsapplication/vnd.worldpay.payments-v7+json
verificationsapplication/vnd.worldpay.verifications.accounts-v4+json
tokensapplication/vnd.worldpay.tokens-v3.hal+json
fraudsightapplication/vnd.worldpay.fraudsight-v1.hal+json
disputesapplication/vnd.worldpay.disputes-v1.hal+json

HATEOAS and linkData

Access Worldpay is HATEOAS-driven. After authorize_payment, the response contains _links such as payments:settle, payments:partialSettle, payments:cancel, payments:refund, payments:partialRefund, and payments:reverse. Each href ends in an opaque segment we call linkData, e.g.:

/payments/settlements/eyJrIjoiazNhYjYzMiJ9                       ^^^^^^^^^^^^^^^^^^^ linkData

Extract that segment and pass it as linkData to capture_payment / cancel_payment / refund_payment / reverse_payment. When omitted, the server POSTs to the bare resource path; this only works for onboardings configured for transactionReference-addressable settlements.

Run

bash
# stdio (default — for Claude Desktop, Cursor, etc.)npx @codespar/mcp-worldpay
# HTTP (for server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-worldpay

Stability

  • Published as 0.1.0-alpha.1 until we validate end-to-end against a real sandbox account.
  • Global Payments acquired Worldpay in January 2026. Base URLs (try.access.worldpay.com / access.worldpay.com) remain valid as of this writing, but Global Payments has publicly signalled platform consolidation. Expect URL and media-type rebranding over the next 12–18 months. Pin the WORLDPAY_API_VERSION env var and watch the release notes.
  • This server does not cover: Worldpay Total (US CNP-API legacy), the WPG/FIS XML gateway, Disputes Direct (separate from Access Disputes), or Worldpay for Platforms. Those are separate surfaces and would be separate packages.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

来源：packages/payments/worldpay/README.md，提交 d0a519a

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.2.0-alpha.3最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分