Mcp Worldpay

io.github.codespar由 GitHub 帳號 codespar 發布v0.2.0-alpha.3更新於 Oct 25, 2026

MCP server for Access Worldpay — enterprise processor: authorize, capture, refund, tokenize

已驗證STDIO僅桌面金融商業與電商

概覽

AI 產生的概覽

針對 Access Worldpay 的本機 MCP 伺服器，讓助理完成授權、請款、退款、撤銷、卡權杖管理、3DS2 驗證與爭議處理等付款作業。

可以做什麼
授權、請款、取消、退款與撤銷卡片付款，依事件 ID 或交易參考號查詢付款，並列出近期付款事件與對帳批次。執行 AVS/CVC 帳戶驗證，以及不產生扣款的獨立 FraudSight 風險篩檢。建立、讀取、更新與刪除供卡片存檔使用的卡權杖。完成 3DS2 三步流程：裝置資料蒐集查詢、持卡人驗證與挑戰回應。取得爭議詳情、提出抗辯、提交證據或接受拒付。
適用情境
適合需要從桌面用戶端操作 Access Worldpay 付款流程的情境，例如在沙箱測試授權與請款、管理已儲存的卡權杖，或處理爭議與對帳。主要面向已接入 Access Worldpay 的開發者或商家。
執行需求
透過 npm 套件以 stdio 在本機執行，需要 Node.js。需要 Worldpay 核發的 Basic Auth 憑證，放在 WORLDPAY_USERNAME 與 WORLDPAY_PASSWORD 中，並在 WORLDPAY_ENTITY 提供商家實體 ID。WORLDPAY_ENV 選擇 sandbox（預設）或 production，WORLDPAY_API_VERSION 預設為 v7。需要能連線至 Worldpay 端點的網路。
安裝前請注意
此伺服器涉及真實資金：授權、請款、退款、撤銷與爭議操作都會產生財務後果，production 模式會連上正式 Worldpay 端點。它需要 WORLDPAY_USERNAME 與 WORLDPAY_PASSWORD 中的 API 憑證，這些憑證具備付款權限，應避免出現在日誌與共用設定中。權杖工具可刪除已儲存的卡權杖。此套件為 alpha 版本，端點路徑與媒體類型可能變動。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Mcp Worldpay，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

@codespar/mcp-worldpay

MCP server for Access Worldpay — global enterprise payment processor.

Worldpay is one of the largest card acquirers in the world and a default rail for EU/UK/US enterprise merchants. This server targets the modern Access Worldpay REST surface, not the legacy FIS/WPG XML gateway.

Status: 0.1.0-alpha.1 — Access Worldpay uses HATEOAS action links (linkData) for lifecycle operations. Exact endpoint paths and media-type versions have been validated against the public docs (v7 payments, v4 verifications, v3 tokens, v1 fraudsight/disputes) but are moving targets. See Stability below.

Tools (22)

ToolPurpose
verify_accountRun an AVS/CVC account verification on a card without charging it.
authorize_paymentAuthorize a card payment.
capture_paymentCapture (settle) an authorized payment.
cancel_paymentVoid an authorization that has not yet been captured.
refund_paymentRefund a captured payment.
reverse_paymentReverse a payment atomically — voids if not yet captured, refunds if already captured.
get_paymentRetrieve the detail of a payment event by its Worldpay eventId.
create_tokenTokenize a card for reuse (card-on-file).
get_tokenRetrieve a stored card token's metadata (bin, scheme, last4, cardHolderName, expiryDate, etc.).
update_tokenUpdate metadata on a stored card token (e.g.
delete_tokenDelete a stored card token.
query_paymentLook up a payment by the merchant-side transactionReference you assigned on authorize_payment.
list_payment_eventsList recent payment events for the configured merchant entity.
lookup_3dsStep 1 of 3DS2 — submit device-data-collection (DDC) output to Worldpay to determine whether a challenge is...
authenticate_3dsStep 2 of 3DS2 — authenticate the cardholder.
challenge_3dsStep 3 of 3DS2 — post the CReq back after the issuer challenge window closes, to retrieve the final authent...
get_disputeRetrieve a dispute's current state, evidence requirements, deadlines, and HATEOAS action links.
defend_disputeOpen a defence on a dispute — signals intent to defend before submit_dispute_evidence.
get_reconciliation_batchRetrieve a reconciliation batch (daily settlement file equivalent) — lists all settled transactions, fees,...
accept_disputeAccept a dispute (forfeit the chargeback).
submit_dispute_evidenceSubmit evidence to defend a dispute.
fraud_screenRun a standalone FraudSight assessment on a payment method (no authorization).

Install

bash
npm install @codespar/mcp-worldpay@alpha

Environment

bash
WORLDPAY_USERNAME="..."    # API username (Basic Auth)WORLDPAY_PASSWORD="..."    # API password (Basic Auth)WORLDPAY_ENTITY="..."      # Merchant entity id; injected as merchant.entityWORLDPAY_ENV="sandbox"     # sandbox | production; default sandboxWORLDPAY_API_VERSION="v7"  # Payments API version; default v7

Authentication

HTTP Basic auth with your Worldpay-issued credentials:

Authorization: Basic base64(username:password)

Each API family uses its own versioned media type. The server sets the correct Content-Type / Accept headers per call:

FamilyMedia type
paymentsapplication/vnd.worldpay.payments-v7+json
verificationsapplication/vnd.worldpay.verifications.accounts-v4+json
tokensapplication/vnd.worldpay.tokens-v3.hal+json
fraudsightapplication/vnd.worldpay.fraudsight-v1.hal+json
disputesapplication/vnd.worldpay.disputes-v1.hal+json

HATEOAS and linkData

Access Worldpay is HATEOAS-driven. After authorize_payment, the response contains _links such as payments:settle, payments:partialSettle, payments:cancel, payments:refund, payments:partialRefund, and payments:reverse. Each href ends in an opaque segment we call linkData, e.g.:

/payments/settlements/eyJrIjoiazNhYjYzMiJ9                       ^^^^^^^^^^^^^^^^^^^ linkData

Extract that segment and pass it as linkData to capture_payment / cancel_payment / refund_payment / reverse_payment. When omitted, the server POSTs to the bare resource path; this only works for onboardings configured for transactionReference-addressable settlements.

Run

bash
# stdio (default — for Claude Desktop, Cursor, etc.)npx @codespar/mcp-worldpay
# HTTP (for server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-worldpay

Stability

  • Published as 0.1.0-alpha.1 until we validate end-to-end against a real sandbox account.
  • Global Payments acquired Worldpay in January 2026. Base URLs (try.access.worldpay.com / access.worldpay.com) remain valid as of this writing, but Global Payments has publicly signalled platform consolidation. Expect URL and media-type rebranding over the next 12–18 months. Pin the WORLDPAY_API_VERSION env var and watch the release notes.
  • This server does not cover: Worldpay Total (US CNP-API legacy), the WPG/FIS XML gateway, Disputes Direct (separate from Access Disputes), or Worldpay for Platforms. Those are separate surfaces and would be separate packages.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

來源：packages/payments/worldpay/README.md，提交 d0a519a

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.2.0-alpha.3最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分