Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

afro.tools

REMOTE · MCP.AFRO.TOOLS

Open-source API specs for African providers (payments, SMS, KYC, delivery) for AI agents.

Available components

70 Trust /100

Last scanned (2 hours ago)

Scores higher than 56% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Developer Tools

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security74
Transport & Reachability100
Schema Quality & AI Usability57
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2919 tokens (~583/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
  • Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 80% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1
    • Tool “list_providers” rewrote its description, which is the text the model reads security
    • Tool “search_specs” rewrote its description, which is the text the model reads security
  • 4 Nov 26 0
    • Tool “get_spec” rewrote its description, which is the text the model reads security
    • Tool “list_providers” rewrote its description, which is the text the model reads security
    • Tool “request_spec” rewrote its description, which is the text the model reads security
    • Tool “search_specs” rewrote its description, which is the text the model reads security
    • Schema quality: 481 → 561 ▼ functional
    • “request_spec” added an optional parameter “country_code” cosmetic
    • “request_spec” added an optional parameter “follow_up” cosmetic
    • “request_spec” reworded the description of “capability” cosmetic
    • “request_spec” made “provider” optional cosmetic
  • 3 Nov 26 0
    • Tool “list_providers” rewrote its description, which is the text the model reads security
  • 2 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

  • 1 Nov 26 0
    • Stability: unverified → 0.03 ▲ functional
  • 31 Oct 26 68

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://mcp.afro.tools/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=mcp.afro.tools CN=YR2,O=Let's Encrypt,C=US 4 Oct 2026 2 Jan 2027 RSA 4096 SHA256-RSA 5ca186320d20682632b84774ae054b841d2
SANs: mcp.afro.tools
CN=YR2,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA 4ebd24947e24d394802d84a52fd5b319
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of mcp.afro.tools. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
tools. present 13831 8 Verified
afro.tools. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://mcp.afro.tools/mcp Verified 200
http (plaintext) http://mcp.afro.tools/mcp HTTPS enforced 301 https://mcp.afro.tools/mcp
MCP tools · 5 exposed · ~2,782 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
get_spec ~741

Returns the full spec payload for a provider + capability, including canonical_example.ts source code. Use this to get the complete integration guide — auth pattern, endpoint, schemas, gotchas, and a TypeScript example — before writing API calls. The response includes a "status" field: - "verified": tested against the provider's API, in "sandbox" or "production" (verified_in / verification.environment) - "deprecated": the provider is retiring it — "deprecation" gives the reason, replaced_by (the capability to use instead) and removed_after - anything else (e.g. "ready", "unverified"): written from the provider's documentation, NOT tested against the live API "verification" says how and when it was tested; sandbox proves the request and response shapes, not production behaviour. "open_questions", when present, lists what the provider's docs do not answer: tell the user before relying on the spec. "account", when present, says who can open the provider's account; list_providers and search_specs add its open questions (caps, conditions) and sources. "environments", when present, gives each documented environment's base URL; a missing one is undocumented — ask the user, never guess. "auth.credentials" / "signing" / "token_exchange" / "apply" and "webhook.signature", when present, describe the auth and webhook signature steps exactly: follow them. "parameters", when present, lists the path, query and header parameters; "input_schema" is the request body only. A path parameter fills the {name} placeholder of endpoint.url. "success_condition", when present, names the response field (dotted path) that says the call succeeded: a 2xx response with another value is a failure. If status is not "verified", always warn the user before generating integration code: "This spec has not been tested against the live API yet and may contain errors." Args: - provider (string): Provider slug e.g. "paycard" - capability (string): Capability name e.g. "create_payment" - vari…

NameTypeReqDescription
capabilitystringyesCapability name e.g. "create_payment"
providerstringyesProvider slug e.g. "paycard"
variantarray–Discriminator values to keep, e.g. ["mobile_money_ghs"] — see "variants" in search_specs

No output schema declared.

No examples provided.

list_providers ~398

Lists every provider in the registry with what it offers. Every listed provider is AI Ready: its specs give you a structured description to integrate it from (endpoints, fields, errors, gotchas taken from the provider's docs). verified_count says how many of its capabilities were also tested against the provider's API; all_verified is true when all of them were. When you show this list, present what each provider offers and give the tested capabilities per provider (e.g. "3/4 tested"), not a headline such as "only one provider is fully verified": a capability not tested yet is still documented and usable, it may contain errors. Before integrating one, check its "status" with get_spec and tell the user if it was not tested. "account", when present, says who can open the account the API needs, from the provider's own pages: holder is "business_only" (a registered business) or "business_or_individual", for all its countries except those in country_exceptions; documents lists what the pages ask for; open_questions gives caps, conditions and what the pages leave unsaid — tell the user, they can change the answer; sources link to those pages (with checked_at, the reading date). A country with no answer (no holder, not in country_exceptions), or no "account" at all, is not documented: tell the user to check with the provider before signing up, never guess. note is present when the list was trimmed to stay readable: description first, then the accounts' sources and checked_at (each provider's page on afro.tools shows the description, links the sources and gives the date) — never an account's answers or open questions. It says which. Returns: { note?, providers: Array<{ slug, name, category, channels?, all_verified, verified_count, capabilities, country_code, docs_public, docs_url, description?, account? }> }

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

report_integration ~385

Builds a pre-filled GitHub link to report how an integration went against a spec — it worked, or the spec is wrong. Call it when the user confirms an integration works against the real API (sandbox or production), or when you find the spec does not match the API. Reports are how specs get verified and fixed. Nothing is posted: the user reviews the text and submits it on GitHub. One report per provider, covering every capability of the flow (e.g. payment init, status, webhook): each one is verified on its own. Args: - provider (string): Provider slug e.g. "paycard" - capabilities (array): Every capability the integration used, each with its own result e.g. [{ "capability": "create_payment", "result": "worked" }, { "capability": "webhook", "result": "wrong: status is SUCCESSFUL, spec says succeeded" }] - summary (string): One line about the flow, e.g. "checkout flow works in sandbox" - details (string): What was called, what came back, what differed from the spec. NEVER include API keys, tokens, phone numbers or personal data. - tested_on (string?): Date of the test, YYYY-MM-DD Returns: { url, next_step } — give the url to the user and follow next_step. If a spec does not exist: isError, with { error, available_capabilities } when the provider exists.

NameTypeReqDescription
capabilitiesarrayyesEvery capability the integration used, each with its own result
detailsstringyesNo secrets or personal data
providerstringyesProvider slug e.g. "paycard"
summarystringyesOne line
tested_onstring–Date of the test, YYYY-MM-DD

No output schema declared.

No examples provided.

request_spec ~447

Logs a request for a spec that doesn't exist yet and notifies maintainers. Call this when a user asks for a provider or capability that has no spec in the registry (check list_providers first), or needs a capability in a country where no listed provider offers it (search_specs with country first). This helps maintainers prioritize which specs and providers to add next. Args: - capability (string): Capability name e.g. "create_payment", or what is needed e.g. "ussd" - provider (string?): Provider slug e.g. "wave" — omit when no provider is named - country_code (string?): ISO 3166-1 alpha-2 code e.g. "SN" — required when provider is omitted - follow_up ("none" | "github_issue", default "none"): "none" records the request only; "github_issue" also returns issue_url, a pre-filled GitHub issue the user can review and submit Returns: { logged: true, count, issue_url? } if the request was recorded — count is the all-time number of times this provider + capability (or, without a provider, capability + country) was requested, including this one (a repeated request counts again). count is absent if it could not be determined: do not guess a number. issue_url only with follow_up "github_issue": give it to the user, who submits it. { logged: false, reason: "spec already exists" }: the spec is in the registry — use the existing spec (get_spec) instead. isError if the request could not be stored: tell the user it was NOT recorded.

NameTypeReqDescription
capabilitystringyesCapability name e.g. "create_payment", or what is needed e.g. "ussd"
country_codestring–ISO 3166-1 alpha-2 country code e.g. "SN" — required without provider
follow_upstring–"github_issue" also returns issue_url, a pre-filled GitHub issue the user can submit
providerstring–Provider slug e.g. "wave"

No output schema declared.

No examples provided.

search_specs ~811

Searches specs by words and filters by category, channel, provider, country, currency, status or capability type. Returns the matching providers, each with its countries, currencies, sandbox flag, docs URL and the matching capabilities (name, type, status, example_prompt) — no endpoints, schemas, gotchas or canonical_example source. Use get_spec with the exact capability name to retrieve the full payload. A capability with "variants" has several request/response shapes (e.g. one per payment method or corridor): pass the ones you need to get_spec "variant" to receive only those. Each result includes a "status" field: - "verified": tested against the provider's API, in "sandbox" or "production" (verified_in / verification.environment) - "deprecated": the provider is retiring it — get_spec says what replaces it - anything else (e.g. "ready", "unverified"): written from the provider's documentation, NOT tested against the live API — may contain errors Always check the status field. If status is not "verified", inform the user that the spec is experimental and may contain errors. Args: - query (string?): Words, e.g. "wave", "mobile money senegal", "send sms", "kyc", "XOF". Every word must match somewhere: provider name or slug, capability, description, example_prompt, countries (code or English/French name), currencies, channels (a few synonyms: momo, otp, kyc, payout…). Providers the query names come first. - category (string?): Filter by category, e.g. "payment", "communications" (SMS, WhatsApp, USSD, voice and email providers — "sms" is accepted as a legacy alias), "identity" (KYC, document verification, AML), "logistics" (delivery and courier providers). The registry adds categories over time: list_providers shows every category that exists - channel ("sms"|"whatsapp"|"ussd"|"voice"|"email"?): Only providers that offer this channel - provider (string?): Provider slug e.g. "paycard" - country_code (string?): ISO 3166-1 alpha-2 e.g. "GN"…

NameTypeReqDescription
capability_typestring––
categorystring––
channelstring––
country_codestring–ISO 3166-1 alpha-2 e.g. "GN"
currencystring–ISO 4217 e.g. "XOF"
providerstring–Provider slug e.g. "paycard"
querystring–Words, e.g. "mobile money senegal" — every word must match
statusstring––

No output schema declared.

No examples provided.

Install

How do I install the afro.tools MCP server?

afro.tools is a hosted endpoint at https://mcp.afro.tools/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · mcp.afro.tools

# add to Claude Code
claude mcp add --transport http afrotools-afrotools 'https://mcp.afro.tools/mcp'
Common questions

What is the afro.tools MCP server?

afro.tools is an MCP server listed in the public MCP registry as io.github.afrotools/afrotools. Open-source API specs for African providers (payments, SMS, KYC, delivery) for AI agents. This page covers its hosted endpoint (https://mcp.afro.tools/mcp).

Is the afro.tools MCP server safe to use?

afro.tools scores 70 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the afro.tools MCP server expose?

afro.tools exposes 5 tools: list_providers, search_specs, get_spec, request_spec, report_integration. Their descriptions and schemas cost roughly 2,782 tokens of context every time the server is loaded.

Does the afro.tools MCP server require authentication?

No. We connected to afro.tools without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the afro.tools MCP server still maintained?

afro.tools is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.