RevClamp MCP Server

com.revclamp由 revclamp.com 發布官方發布者v1.20.24更新於 Nov 7, 2026

Zero-take-rate Stripe 2025-03-31.basil, Visa CE 3.0 & EU/XI VIES VAT guardrails MCP server.

已驗證Streamable HTTP可網頁執行金融安全與監控商業與電商

概覽

AI 產生的概覽

以本機確定性運算為主的工具集,用來稽核 Stripe 營收漏損、準備 Visa CE 3.0 爭議證據、驗證歐盟加值稅號並對帳 B2B 帳期。

可以做什麼
  • 稽核 Stripe 訂閱、用量事件與未結爭議,評估營收漏損與拒付因應準備度
  • 依客戶評估未付費的幽靈用量,並以整數分為單位對帳 Net-15/30/60 訂金、部分付款與貸項通知單
  • 產生非破壞性的 Visa CE 3.0 爭議證據草稿,並依 18,000 個 UTF-16 單元上限檢查證據紀錄
  • 正規化並驗證歐盟 27 國及北愛爾蘭加值稅號,可選擇即時 VIES 查詢
  • 產生與驗證 Stripe、Shopify 和 RevClamp 的 webhook 簽章,並模擬亂序 webhook 重放
  • 比較按比例抽成的拒付代理費用,計算節省金額與方案適配度
適用情境
適合讓助理核對 Stripe 計費與爭議資料、準備 CE 3.0 證據、驗證歐盟/北愛爾蘭加值稅號,或在不更動線上 Stripe 紀錄的前提下測試 webhook 簽章與冪等邏輯。
執行需求
預設透過 npx 在本機以 Node.js 執行,不需要 API 金鑰。選用的 REVCLAMP_API_KEY 可連線 api.revclamp.com 的託管工作區,取得持久帳本、自動爭議操作與即時 VIES 查詢;REVCLAMP_MCP_URL 可覆寫端點。驗證簽章另需 webhook 密鑰。
安裝前請注意
設定 REVCLAMP_API_KEY 後,工具參數會經 TLS 傳送至 RevClamp 雲端,雲端可執行 Stripe 爭議更新與帶簽章的權益撤銷 webhook;此金鑰是正式工作區憑證。本機模式為唯讀並回傳 submit: false 草稿,但啟用雲端操作前應先確認。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 RevClamp MCP Server,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable,透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式,或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南,先向你展示發布者、端點和登入方式,經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.revclamp%2Frevclamp-mcp/install.md,並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前,先告訴我它的發布者、端點和登入方式,等我確認。不要把 API 金鑰寫進命令或我會提交的檔案;問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "revclamp": {
      "type": "http",
      "url": "https://revclamp.com/api/mcp"
    }
  }
}

README

RevClamp MCP Server & CLI (revclamp-mcp)

[RevClamp Enterprise — B2B Revenue & Compliance Guardrails]

[mcptry]

revclamp-mcp is a standalone, zero-dependency Open-Source Model Context Protocol (MCP) Server & CLI (index.mjs + local_engine.mjs) implementing 9 deterministic B2B FinOps, Stripe 2025-03-31.basil, Visa CE 3.0, EU/XI VIES VAT, Shopify Plus B2B Net-15/30/60, and Webhook Security tools in pure Node.js.

  • 100% Local In-Process Execution (Default — Zero Network / Zero API Key Required): All 9 MCP tools (initialize, tools/list, and tools/call) execute locally in-process inside local_engine.mjs using pure Node.js (node:crypto HMAC-SHA256 verification, integer-cent double-entry accounting, 72-hour webhook replay state machines, and 18,000 UTF-16 code unit CE 3.0 linting). Zero network calls are ever made unless REVCLAMP_API_KEY or REVCLAMP_MCP_URL is explicitly configured.
  • Optional Hosted Cloud Workspace Sync (REVCLAMP_API_KEY): When REVCLAMP_API_KEY (rg_live_...) is configured, revclamp-mcp connects to RevClamp Enterprise (https://api.revclamp.com/api/mcp) to unlock the 90-day durable transactional usage & audit ledger, 24/7 autonomous Stripe dispute & entitlement webhook outbox, and real-time EU Commission VIES SOAP gateway consultation numbers.

Local Open-Core (local_engine.mjs) vs. Hosted Cloud (REVCLAMP_API_KEY)

CapabilityLocal Open-Core Default (Zero API Key)Hosted Cloud (REVCLAMP_API_KEY)
Execution & Network100% in-process (local_engine.mjs), zero network callsHTTPS JSON-RPC to https://api.revclamp.com/api/mcp (redirect: "error")
Usage & Audit StorageStateless evaluation of caller-supplied JSON snapshotsPersistent 90-day durable transactional ledger + Stripe historical backfill
Dispute & Entitlement ActionReturns non-destructive submit: false draft & revoke_entitlement decision24/7 autonomous Stripe webhook outbox (disputes.update & signed revoke webhooks)
EU & XI B2B VAT (VIES)Deterministic syntax & GR -> EL normalization (FORMAT_ONLY default, valid: null)Live EU Commission VIES SOAP consultation IDs + circuit-breaker retry queue (viesMode: "LIVE" + REVCLAMP_API_KEY)
Monthly Event TiersUnlimited local in-process evaluations (0 network cost)Free Sandbox (5,000 events/mo) · Starter $19/mo (100k) · Growth $59/mo (1M) · Scale $199/mo (5M)
Data Minimization & PrivacyNothing ever leaves your machineOnly explicit tools/call arguments are sent over TLS after local live-secret scrubbing (blocks sk_live_, non-test whsec_, and shpat_ locally before any network request)

Open-Source MCP Tools Implemented in local_engine.mjs (9)

Tool NameDomainLocal In-Process Implementation (local_engine.mjs)Execution Mode
revclamp_audit_revenue_leakageStripe Billing & UsageEvaluates caller-supplied customer/usage arrays (demo: true for synthetic sample) and returns upgrade hooks when no workspace ledger is connectedLocal In-Process (or Optional Cloud Key)
revclamp_evaluate_ghost_usageStripe 2025-03-31.basilEvaluates multi-subscription customer snapshots (has_more: false enforced) and 0–14d dunning grace windows for unpaid API/LLM bleedLocal In-Process (or Optional Cloud Key)
revclamp_stage_stripe_dispute_ce3Visa 10.4 / CE 3.0Evaluates 120d–365d prior undisputed charges (ip_subnet/device_id overlap) against caller-supplied usageEvents (demo: true for sample) and stages a non-destructive submit: false draft (<= 18,000 UTF-16 code units)Local In-Process (or Optional Cloud Key)
revclamp_validate_eu_vat_viesEU & XI B2B VATNormalizes 27 EU member states + Northern Ireland (XI) VAT IDs (GR -> EL), supports split (buyerCountryCode + vatNumber including numeric VAT IDs) or combined (buyerVatId / vatId) aliases with fail-closed CONFLICTING_PARAMETER_ALIASES guards, checks syntax locally (FORMAT_ONLY, valid: null), simulates errorWrappers (demo: true), or queries live EU VIES (viesMode: "LIVE" + REVCLAMP_API_KEY)Local In-Process (or Optional Live VIES)
revclamp_reconcile_b2b_net_termsB2B Wholesale Net-30Reconciles Net-15/30/60 upfront deposits and credit notes using integer EUR-cent double-entry accountingLocal In-Process (or Optional Cloud Key)
revclamp_verify_webhook_signatureWebhook HMAC-SHA256Generates and verifies Stripe-Signature, X-Shopify-Hmac-Sha256, and X-RevClamp-Signature over raw UTF-8 bytes (node:crypto) with 300s replay checksLocal In-Process (or Optional Cloud Key)
revclamp_calculate_roi_and_plan_fit0% Take-Rate ROI & Plan FitCalculates monthly and annual B2B margin savings in integer USD cents vs. 25%–30% chargeback agencies and recommends the optimal tierLocal In-Process (or Optional Cloud Key)
revclamp_simulate_webhook_replayWebhook Replay & FSMSimulates subscription lifecycle webhooks against a 72h deduplication Set and monotonic createdSec guard vs. naive arrival-order handlersLocal In-Process (or Optional Cloud Key)
revclamp_lint_dispute_evidenceDispute Evidence UTF-16 & CE 3.0Lints evidence[access_activity_log] payloads against the 18,000 UTF-16 code unit ceiling, non-destructive CE 3.0 markers, and merchant note preservationLocal In-Process (or Optional Cloud Key)

Quick Start (Claude Desktop / Cursor / Windsurf)

Add revclamp-mcp to your claude_desktop_config.json or .cursor/mcp.json. By default, revclamp-mcp runs 100% locally in-process with zero network calls and zero API keys required:

json
{  "mcpServers": {    "revclamp": {      "command": "npx",      "args": ["-y", "github:lhphong09t2/revclamp-mcp"]    }  }}

(Optional) To connect to a live workspace on https://revclamp.com/dashboard, pass REVCLAMP_API_KEY in env or use the hosted Streamable HTTP endpoint (POST https://api.revclamp.com/api/mcp):

bash
curl -sS -X POST https://api.revclamp.com/api/mcp \  -H "Content-Type: application/json" \  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

CLI Usage & <60s Local Smoke Check (--self-test)

bash
# Run a <60s local CLI smoke check (verifies all 9 tool schemas & executes a local_engine.mjs sample audit with zero API key)npx -y github:lhphong09t2/revclamp-mcp#v1.20.24 --self-test
# Provision a free Cloud Workspace instantly (zero email required; saves to ~/.revclamp/credentials.json) or bind a work email via 6-digit OTPnpx -y [email protected] --init-workspacenpx -y [email protected] --init-workspace [email protected]
# Verify the 6-digit OTP using REVCLAMP_API_KEY from environmentREVCLAMP_API_KEY="rg_live_..." npx -y [email protected] --verify-otp [email protected] 123456
# List all 9 MCP tools and JSON schemas (runs locally in-process)node index.mjs --list-tools
# Validate an EU or Northern Ireland (XI) B2B VAT ID (auto-converts Greece GR -> EL)node index.mjs --check-vat GR123456789 DE
# Calculate 0% take-rate ROI and optimal flat-rate plan fit (runs locally in-process)node index.mjs --calc-roi 10000 600 25 250000
# Simulate out-of-order webhook replay and 72-hour deduplication state machine (runs locally)node index.mjs --sim-replay out_of_order_stale_update_after_cancel
# Lint Stripe dispute evidence UTF-16 code units and non-destructive CE 3.0 markers (runs locally)node index.mjs --lint-evidence valid_ce3_non_destructive
# Verify webhook HMAC-SHA256 using REVCLAMP_WEBHOOK_SECRET from environment (runs locally)REVCLAMP_WEBHOOK_SECRET="whsec_test_secret_revclamp_sandbox_2026" node index.mjs --verify-webhook stripe
# Invoke Visa CE 3.0 readiness staging locally (pass demo: true for synthetic sample or usageEvents for real logs)node index.mjs --call revclamp_stage_stripe_dispute_ce3 '{"disputeId":"du_1Qxyz01","customerId":"cus_ent_88","disputeReason":"fraudulent","demo":true}'

Architecture & Engineering Deep-Dives (7 Post-Mortems & 8 Interactive Browser Tools)

1. Stripe 2025-03-31.basil Entitlement Guard & Visa CE 3.0 Two-Tier Routing

[Stripe basil entitlement and CE 3.0 flowchart]

2. EU VIES HTTP 200 OK Soft-Failure Circuit Breaker & B2B Net-Terms Reconciliation

[EU VIES circuit breaker flowchart]

3. Webhook HMAC-SHA256 Raw-Body Security, 72h Replay FSM & 0% Take-Rate ROI

Golden Trio B2B Intelligence Companion MCP Suite

Companion MCP Server & Apify ActorPrimary B2B Intelligence SignalLocal MCP Stdio CommandApify Store & npm
RevClamp AdPulse (@revclamp/google-ads-transparency-mcp)Zero-browser Google Ads Transparency Center (AR... entity disambiguation, CR... creatives, static content.js ad copy, regional disclosures)npx -y @revclamp/google-ads-transparency-mcp --mcp-stdioApify Store · npm
RevClamp TalentPulse (@revclamp/unified-ats-jobs-mcp)Zero-browser 5-in-1 B2B ATS Job & Hiring Signal Feed across Greenhouse, Workday CXS, Ashby, Lever, and SmartRecruitersnpx -y @revclamp/unified-ats-jobs-mcp --mcp-stdioApify Store · npm
RevClamp ContactPulse (@revclamp/b2b-domain-contact-enricher-mcp)Zero-browser B2B Domain Contact, RFC 9116 /.well-known/security.txt, Schema.org ContactPoint, and DoH MX / SPF / _dmarc Enrichernpx -y @revclamp/b2b-domain-contact-enricher-mcp --mcp-stdioApify Store · npm

Security & Resource Bounds

  • Local-First Deterministic Execution: Runs all 9 tools locally in-process inside local_engine.mjs with zero external npm dependencies.
  • Strict Origin Pinning (Cloud Mode): When REVCLAMP_API_KEY is provided, only connects to https://api.revclamp.com/api/mcp or https://revclamp.com/api/mcp over TLS (redirect: "error").
  • Bounded Execution: Enforces a hard 10,000ms request timeout (AbortSignal.timeout) and a 32,768-byte request/response payload cap.
  • Full LLM Reference: https://revclamp.com/llms-full.txt

License

MIT © RevClamp Enterprise

來源:README.md,提交 3febf12

工具

9

revclamp_audit_revenue_leakage

Audit B2B Revenue Leakage & Dispute Readiness

Run a deterministic 90-day B2B revenue leakage and chargeback readiness audit across Stripe subscriptions, AI/API usage telemetry events, and open disputes. Executes as a 100% read-only, stateless diagnostic with zero external Stripe mutations. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, dunningGracePeriodDays, costPerEventCents, and audit (scannedCustomers, scannedEvents, ghostLeakEventsCount, affectedCustomersCount, estimatedBleedUsd, disputesEligibleForAutoEvidence). Use this tool for portfolio-wide multi-customer audits; use revclamp_evaluate_ghost_usage for single-customer entitlement checks or revclamp_stage_stripe_dispute_ce3 to build a single dispute's Visa CE 3.0 evidence bundle.

輸入參數demodisputescustomersusageEventscostPerEventCentsdunningGracePeriodDays

revclamp_evaluate_ghost_usage

Evaluate Single-Customer Stripe Basil Ghost Usage

Evaluate whether a specific customer's AI or API usage event constitutes unpaid ghost usage across multi-subscription Stripe 2025-03-31.basil state, enforcing fail-closed pagination (has_more must be explicitly false) and configurable 0-14 day dunning grace windows. Executes as a stateless, read-only entitlement evaluator with zero side effects. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, and evaluation (isGhostLeak, isGhostUsage, reason). Use this tool for real-time per-customer entitlement gating; use revclamp_audit_revenue_leakage for batch multi-customer portfolio audits.

輸入參數democustomerIdusageEventoccurredAtSecsubscriptions必填usageTimestampSecsubscriptionsHasMoredunningGracePeriodDays

revclamp_stage_stripe_dispute_ce3

Stage Visa CE 3.0 Stripe Dispute Evidence Draft

Evaluate Visa Compelling Evidence 3.0 (CE 3.0) qualification across 120-to-365-day historical charges (requiring at least 2 settled, non-refunded, non-disputed prior transactions sharing IP address, device fingerprint, or billing email) and assemble a non-destructive Stripe dispute evidence draft with submit hardcoded to false. Executes as a pure read-only staging computation that never auto-submits to card networks. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, submitForcedFalse, ce3Qualification, and drawer (including stripeUpdateParams with submit: false and merged access_activity_log). Use this tool for single-dispute CE 3.0 qualification and evidence staging; use revclamp_audit_revenue_leakage for portfolio-wide dispute readiness counts.

輸入參數demodisputeIdcustomerIdusageEventsdisputeReasonpriorTransactionsdisputedTransactionexistingAccessActivityLogexistingUncategorizedText

revclamp_validate_eu_vat_vies

Validate EU/XI B2B VAT ID & VIES Reverse-Charge State

Normalize EU-27 and Northern Ireland (XI) B2B VAT identifiers (including mandatory Greece ISO-3166 GR to EL prefix normalization) and evaluate cross-border 0% VAT reverse-charge eligibility, VIES consultation evidence, or MS_UNAVAILABLE circuit-breaker fulfillment hold actions. Read-only and non-destructive; supports deterministic simulation modes ('VALID', 'INVALID', 'MS_UNAVAILABLE') or real-time European Commission VIES SOAP/REST lookup ('LIVE'). Returns structuredContent containing ok, mode, statelessEphemeralAudit, simulatedViesLookup, tenantId, normalizedVat, reverseChargeEligible, and viesDecision (status, action, zeroRateAllowed, consultationId). Use this tool for EU/XI VAT tax compliance; use revclamp_reconcile_b2b_net_terms for wholesale Net-15/30/60 deposit and credit-note accounting.

輸入參數demoviesModebuyerVatId必填supplyTypesellerCountryconsultationNumber

revclamp_reconcile_b2b_net_terms

Reconcile B2B Wholesale Net-15/30/60 Deposits & Credit Notes

Reconcile B2B wholesale Net-15, Net-30, and Net-60 invoice deposits, partial payments, and credit notes using exact integer minor-unit (EUR/USD cent) arithmetic with zero IEEE-754 floating-point drift. Executes as a pure, stateless, read-only financial reconciliation function. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, and reconciliation (state, status, fulfillmentHold, releaseHoldAction, requiredDepositCents, remainingBalanceCents, creditDueCents, overpaidWarning, orderTag). Use this tool for B2B wholesale order deposit gating and Net-terms balance calculation; use revclamp_validate_eu_vat_vies for cross-border EU VAT number validation.

輸入參數demoorderIdtoleranceCentscreditNoteCentsorderTotalCentspaidAmountCents必填totalOrderCentscreditNotesCentspaymentTermsDaysrequiredDepositCentsrequiredDepositPercentdaysElapsedSinceInvoice

revclamp_verify_webhook_signature

Verify Stripe, Shopify & RevClamp Webhook HMAC-SHA256 Signatures

Generate and verify canonical Stripe-Signature (t=<unix>,v1=<hex_sha256>), X-Shopify-Hmac-Sha256 (<base64_sha256>), and X-RevClamp-Signature (t=<unix>,v1=<hex_sha256>) headers over exact UTF-8 webhook payload bytes using crypto.timingSafeEqual and a 300-second replay window guard. Enforces a Zero-Trust guard that blocks known live/production credential patterns (sk_live_, rk_live_, non-test whsec_..., shpss_..., shpat_..., rg_live_, rc_live_, AKIA..., and PEM private keys) with -32602 LIVE_SECRET_FORBIDDEN_IN_SANDBOX. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, and verification (provider, verificationMode, headerName, generatedHeader, expectedSignature, signatureValid, verificationReason, timingSafeCompared, replayWindowApplicable, timestampSec, timestampSkewSeconds, toleranceSeconds, withinReplayWindow, payloadByteLength, payloadSha256, commonIntegrationTrap). Use this tool to debug webhook signature mismatches and replay skew.

輸入參數demosecretsecretsproviderrawPayloadtimestampSectoleranceSecsignatureHeader

revclamp_calculate_roi_and_plan_fit

Calculate B2B 0% Take-Rate ROI & Optimal Plan Fit

Deterministically calculate monthly and annual B2B margin savings using exact integer USD cents when replacing a 25%-30% contingency chargeback agency with RevClamp flat-rate 0% commission plans ($19 Starter, $59 Growth, $199 Scale). Evaluates monthlyWonDisputeUsd, monthlyGhostBleedUsd, contingencyTakeRatePercent, and monthlyUsageEvents to recommend the optimal tier. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, recommendedTier, annualNetMarginSavedUsd, roiMultiple, and calculation.

輸入參數monthlyUsageEventsmonthlyGhostBleedUsdmonthlyWonDisputeUsdcontingencyTakeRatePercent

revclamp_simulate_webhook_replay

Simulate Webhook Replay & Out-of-Order State Machine

Deterministically evaluate an ordered or out-of-order sequence of 1-10 Stripe/Shopify/RevClamp subscription lifecycle webhooks against a 72-hour idempotency deduplication Set (eventId), a configurable idempotencyWindowSec (60s-2592000s, default: 259200s / 72h), and a monotonic transition timestamp guard (event.createdSec >= lastAppliedCreatedSec). Compares RevClamp's monotonic FSM against a naive overwrite-on-arrival handler to detect resurrected canceled subscriptions, stale tier downgrades, and duplicate retry side-effects. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, simulation, steps, finalStatus, finalTier, finalEntitlementDecision, naiveFinalStatus, and naiveHandlerBug.

輸入參數demoeventsnowSecscenarioPresetidempotencyWindowSec

revclamp_lint_dispute_evidence

Stripe Dispute Evidence UTF-16 & CE 3.0 Completeness Linter

Deterministically lint a Stripe dispute evidence[access_activity_log] payload against Stripe's 18,000 UTF-16 code unit (String.prototype.length) ceiling, UTF-8 byte length, non-destructive --- BEGIN REVCLAMP CE3 EVIDENCE --- / --- END REVCLAMP CE3 EVIDENCE --- (or [RevClamp Verified Product Usage Log] / [/RevClamp Verified Product Usage Log]) delimiter markers, existing merchant note preservation, 17,922/17,920-char fixed wrapper capacity threshold (SKIP_POST_PRESERVE_DRAFT), and Visa Compelling Evidence 3.0 (CE 3.0) prior-charge (>= 2) + IP/device overlap qualification. Returns structuredContent containing ok, mode, statelessEphemeralAudit, tenantId, lint, utf16CodeUnits, maxUtf16Ceiling, remainingUtf16Units, withinCeiling, utf8Bytes, nonDestructiveMarkersPresent, merchantNotesPreserved, merchantNotesUtf16CodeUnits, fixedWrapperUtf16CodeUnits, merchantLogAtCapacity, stagingActionWhenAtCapacity, priorMatchedCount, hasIpMatch, hasDeviceMatch, ce3RubricPassed, and overallVerdict.

輸入參數demopresethasIpMatchhasDeviceMatchevidenceLogTextaccessActivityLogpriorMatchedCountpriorTransactionsdisputedTransactionexistingMerchantNotes

版本歷史

8
  1. v1.20.24最新Nov 7, 2026
  2. v1.20.20Nov 5, 2026
  3. v1.20.19Nov 1, 2026
  4. v1.20.17Nov 1, 2026
  5. v1.20.16Nov 1, 2026
  6. v1.20.14Nov 1, 2026
  7. v1.20.13Oct 31, 2026
  8. v1.20.11Oct 29, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

其他 Revclamp 整合