← Back to search

io.github.mrslbt/xendit-mcp

mrslbt Scanned 12d ago

Xendit payment APIs for AI agents. Payment links, payouts, balances, and transactions.

B
86 / 100

Versions

No versions found.

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 14

get_workspace_mode
annotations: verified low

Explain the current Xendit MCP mode, what actions are enabled, and the safest next step to enable more access.

client enum allowLive boolean serverName string maxDailyAmount number
readOnlyHint true
guided_setup
annotations: verified low

Generate a safe Claude Code or Claude Desktop setup snippet for read-only, invoices, or guarded payouts mode. Uses a form when the client supports MCP elicitation.

client enum allowLive boolean serverName string maxDailyAmount number
readOnlyHint true
get_balance
annotations: verified low

Get your Xendit account balance. Returns available balance by account type (CASH, HOLDING, TAX).

accountType enum
readOnlyHint true
list_invoices
annotations: verified low

List invoices from your Xendit account with optional filters for status, date range, and pagination.

limit number status enum currency string
readOnlyHint true
get_invoice
annotations: mismatch low

Get details of a specific Xendit invoice by ID.

invoiceId string
readOnlyHint true destructiveHint true
create_invoice
annotations: verified low

Create a new payment invoice. Returns a payment link your customer can use to pay.

amount number currency enum externalId string description string customerSurname string
destructiveHint true
expire_invoice
annotations: verified low

Expire an active invoice so it can no longer be paid.

invoiceId string
readOnlyHint true destructiveHint true
list_transactions
annotations: verified low

List transactions from your Xendit account. Includes payments received, payouts, refunds, transfers, and balance adjustments.

limit number types enum status enum currency string createdGte string createdLte string
readOnlyHint true
create_disbursement
annotations: verified low

[DEPRECATED — prefer prepare_disbursement + confirm_disbursement] Send money to a payout channel in a single call. Requires an approval code and explicit legacy opt-in.

amount number currency enum externalId string description string accountNumber string accountHolderName string
destructiveHint true
prepare_disbursement
annotations: verified low

Stage a payout and return an opaque, time-bounded, single-use token. No money moves until confirm_disbursement is called with this token.

amount number currency enum externalId string description string accountNumber string accountHolderName string
destructiveHint true
confirm_disbursement
annotations: verified low

Execute a previously prepared disbursement token by creating a payout in Xendit. Requires a separate human approval code.

token string
destructiveHint true
cancel_disbursement
annotations: verified low

Cancel a prepared disbursement before it is confirmed. Idempotent when the token is already gone.

token string
readOnlyHint true
get_disbursement
annotations: verified low

Check the status of a payout/disbursement by ID.

disbursementId string
readOnlyHint true
list_disbursement_banks
annotations: verified low

List payout channels available for money-out flows. Returns channel codes such as ID_BCA and PH_BPI.

currency enum channelCode string
readOnlyHint true

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 39

info
Tool 'guided_setup' annotations are consistent annotation_checker · 80%
info
Tool 'get_workspace_mode' annotations are consistent annotation_checker · 80%
info
Tool 'get_balance' annotations are consistent annotation_checker · 80%
info
Tool 'list_invoices' annotations are consistent annotation_checker · 80%
medium
Tool 'get_invoice' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'create_invoice' annotations are consistent annotation_checker · 80%
info
Tool 'expire_invoice' annotations are consistent annotation_checker · 80%
info
Tool 'list_transactions' annotations are consistent annotation_checker · 80%
info
Tool 'create_disbursement' annotations are consistent annotation_checker · 80%
info
Tool 'prepare_disbursement' annotations are consistent annotation_checker · 80%
info
Tool 'confirm_disbursement' annotations are consistent annotation_checker · 80%
info
Tool 'cancel_disbursement' annotations are consistent annotation_checker · 80%
info
Tool 'get_disbursement' annotations are consistent annotation_checker · 80%
info
Tool 'list_disbursement_banks' annotations are consistent annotation_checker · 80%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: tsup@8.0.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: get_workspace_mode manifest_parser · 85%
info
Tool: guided_setup manifest_parser · 85%
info
Tool: get_balance manifest_parser · 85%
info
Tool: list_invoices manifest_parser · 85%
info
Tool: get_invoice manifest_parser · 85%
info
Tool: create_invoice manifest_parser · 85%
info
Tool: expire_invoice manifest_parser · 85%
info
Tool: list_transactions manifest_parser · 85%
info
Tool: create_disbursement manifest_parser · 85%
info
Tool: prepare_disbursement manifest_parser · 85%
info
Tool: confirm_disbursement manifest_parser · 85%
info
Tool: cancel_disbursement manifest_parser · 85%
info
Tool: get_disbursement manifest_parser · 85%
info
Tool: list_disbursement_banks manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (13) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 191 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%