← Back to search

jPOS MCP Server

mohisyed Scanned 1d ago

MCP server for jPOS and ISO 8583. Deterministic payment protocol tools for AI agents.

B
79.3 / 100

Versions

0.1.1latest
first seen Jun 5, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 7

validate_descriptor
annotations: none low

Validate a jPOS Q2 deploy descriptor XML file. Checks: well-formed XML, required attributes, channel/QMUX/TM-specific rules, common property name typos.

xml_content string
health
annotations: none low

Return server health status: version, tool count, and ChromaDB chunk count.

search_jpos
annotations: none low

Search jPOS documentation using hybrid semantic + keyword search. Returns up to 5 matches with source, section, page, and similarity score. Scores are calibrated for the all-mpnet-base-v2 embedding model combined with a keyword overlap rerank: - strong >= 0.55 (direct answer expected in chunk) - good >= 0.40 (relevant context, may need synthesis) - partial >= 0.25 (tangentially related) Chunks below 0.25 are filtered out as noise. Pipeline: 1. Expand short/jargon queries with domain context 2. Embed the expanded query and fetch top 15 candidates by cosine 3. Rerank candidates with keyword overlap from the *original* query (70% cosine + 30% keyword overlap) 4. Return top 5 Why return raw chunks instead of summarizing: the calling LLM can reason about conflicting chunks, notice version differences, and assess confidence from similarity scores. Pre-summarizing loses this nuance.

query string
generate_packager
annotations: none low

Generate a complete jPOS GenericPackager XML configuration. Parses field numbers from description, looks up correct jPOS classes, and assembles valid XML ready to save as a .xml file. Always includes fields 0 (MTI) and 1 (Bitmap). Why this doesn't use an LLM: LLM-generated XML can contain hallucinated class names. This uses iso_fields.json as ground truth — always correct.

description string
build_message
annotations: none low

Validate an ISO 8583 message field dictionary. Checks MTI validity, missing mandatory fields, value length violations, and potential real PANs (detected via Luhn algorithm — rejected for safety). Only test PANs (4111111111111111 etc.) are accepted.

fields string
lookup_field
annotations: none low

Return the complete ISO 8583 specification for a data element number. Returns: name, format (FIXED/LLVAR/LLLVAR), type, max_length, jpos_class_bcd, jpos_class_ascii, mandatory_for_mtis, pci_sensitive, notes. Use this before writing any GenericPackager XML.

field_number string
decode_mti
annotations: none low

Decode a 4-digit MTI into version, message class, function, and origin. For request messages (function digit = 0), returns the expected response MTI.

mti string

Permissions 2

filesystem low
Server uses filesystem capabilities via: open(), os, pathlib
env_vars low
Server uses env_vars capabilities via: os.getenv()

Scan Findings 36

low
Tool 'health' has no annotations annotation_checker · 100%
low
Tool 'search_jpos' has no annotations annotation_checker · 100%
low
Tool 'generate_packager' has no annotations annotation_checker · 100%
low
Tool 'validate_descriptor' has no annotations annotation_checker · 100%
low
Tool 'build_message' has no annotations annotation_checker · 100%
low
Tool 'lookup_field' has no annotations annotation_checker · 100%
low
Tool 'decode_mti' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: fastmcp@3.1.1 (GHSA-m8x7-r2rg-vh5g) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.1.1 (GHSA-rww4-4w9c-7733) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.1.1 (GHSA-vv7q-7jx5-f767) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.1.1 (PYSEC-2026-2475) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.1.1 (PYSEC-2026-2476) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@3.1.1 (PYSEC-2026-338) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (GHSA-9hjg-9r4m-mvj7) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (GHSA-9wx4-h78v-vm56) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (GHSA-gc5v-m9x4-r6x2) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (PYSEC-2026-1872) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (PYSEC-2026-1873) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.31.0 (PYSEC-2026-2275) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0.0 (PYSEC-2026-1812) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: health manifest_parser · 90%
info
Tool: search_jpos manifest_parser · 90%
info
Tool: generate_packager manifest_parser · 90%
info
Tool: validate_descriptor manifest_parser · 90%
info
Tool: build_message manifest_parser · 90%
info
Tool: lookup_field manifest_parser · 90%
info
Tool: decode_mti manifest_parser · 90%
info
Required env vars (2) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
low
Permission: filesystem access detected permission_analyzer · 80%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%