io.github.gabrielmahia/mpesa-mcp
PYPI · MPESA-MCP · SCANNED SEP 20
MCP server for M-Pesa mobile-money integration in Kenya
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 2 of 25 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency35
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- License check failed: no license is declared. See how to fix → Fail
- Actively maintained (last published 19 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability77
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2378 tokens (~103/item across 23 items; 23 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the io.github.gabrielmahia/mpesa-mcp server?
io.github.gabrielmahia/mpesa-mcp runs locally as a PyPI package, launched with uvx mpesa-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · mpesa-mcp
claude mcp add gabrielmahia-mpesa-mcp -- uvx mpesa-mcp
{
"mcpServers": {
"gabrielmahia-mpesa-mcp": {
"command": "uvx",
"args": [
"mpesa-mcp"
]
}
}
} {
"servers": {
"gabrielmahia-mpesa-mcp": {
"command": "uvx",
"args": [
"mpesa-mcp"
]
}
}
} codex mcp add gabrielmahia-mpesa-mcp -- uvx mpesa-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"gabrielmahia-mpesa-mcp": {
"type": "local",
"command": [
"uvx",
"mpesa-mcp"
],
"enabled": true
}
}
} openclaw mcp add gabrielmahia-mpesa-mcp --command uvx --arg mpesa-mcp
mcp_servers:
gabrielmahia-mpesa-mcp:
command: "uvx"
args: ["mpesa-mcp"] {
"McpServers": {
"gabrielmahia-mpesa-mcp": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"mpesa-mcp"
]
}
}
} assistant mcp add gabrielmahia-mpesa-mcp -t stdio -c uvx -a mpesa-mcp
{
"mcpServers": {
"gabrielmahia-mpesa-mcp": {
"command": "uvx",
"args": [
"mpesa-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Sept 26 −3
- Stability: pass → 0.77 functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 −15
- Malware scan: pass → unverified ▼ security
- 13 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 11 Sept 26 −18
- Malware scan: pass → unverified ▼ security
- Stability: pass → 0.80 functional
- 10 Sept 26 +1
- Stability: 0.97 → pass security
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/mpesa-mcp@0.2.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 25 packages
| Packages resolved | 25 |
|---|---|
| Stale | 2 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
airtime_send Send Airtime ~135
Send airtime top-up to MTN/Safaricom/Airtel/Vodafone subscribers. Use for NGO field incentives, survey rewards, agent payouts. No real airtime sent in sandbox mode (AT_USERNAME=sandbox).
| Name | Type | Req | Description |
|---|---|---|---|
| amount | string | yes | Amount as string e.g. '50' (KES 50). Min KES 10 in production. |
| currency_code | string | – | ISO currency: KES, NGN, GHS, UGX, TZS, RWF, ZAR |
| phone | string | yes | Recipient phone in E.164 format e.g. '+254712345678' |
Structured output declared, but exposes no named fields.
No examples provided.
get_model_hint Get Model Hint ~37
Returns the recommended AI model for using mpesa-mcp tools. Call this first when selecting a model to pair with mpesa-mcp.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_account_balance M-Pesa Account Balance ~86
Query current balance of the business M-Pesa account (shortcode/till). Result delivered async to MPESA_RESULT_URL. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL.
| Name | Type | Req | Description |
|---|---|---|---|
| identifier_type | string | – | 1=MSISDN, 2=Till, 4=Shortcode/Paybill |
| remarks | string | – | Query remarks |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_b2b_express_checkout B2B Express Checkout ~115
Initiate USSD Push to till — enables merchant-to-merchant payments. Recipient merchant receives a USSD prompt to confirm payment from their till. Use for wholesale supplier payments between Lipa Na M-PESA merchants. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL.
| Name | Type | Req | Description |
|---|---|---|---|
| account_reference | string | yes | Account reference for the transaction |
| amount | integer | yes | Amount in KES |
| receiver_till | string | yes | Recipient till number |
| remarks | string | – | Remarks |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_b2c M-Pesa B2C ~130
Business To Customer disbursement — send money from shortcode to phone. Use for payroll, NGO field incentives, agent float, survey rewards. Result delivered async to MPESA_RESULT_URL. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL env vars.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | yes | Amount in KES to send |
| command_id | string | – | SalaryPayment | BusinessPayment | PromotionPayment |
| occasion | string | – | Optional occasion label |
| phone | string | yes | Recipient phone number (any Kenyan format) |
| remarks | string | – | Remarks (max 100 chars) |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_bill_manager_cancel Bill Manager — Cancel Invoice ~59
Cancel an outstanding Bill Manager invoice. Customer will no longer be able to pay the cancelled invoice. Use when an order is cancelled or a duplicate invoice was created.
| Name | Type | Req | Description |
|---|---|---|---|
| external_reference | string | yes | The externalReference used when creating the invoice |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_bill_manager_invoice Bill Manager — Create Invoice ~147
Create a Bill Manager invoice — customer receives SMS with payment link. They can pay directly via M-PESA by clicking the link or using the paybill. Returns invoice ID. Use mpesa_bill_manager_cancel to void outstanding invoices.
| Name | Type | Req | Description |
|---|---|---|---|
| account_ref | string | – | Account reference for the payment |
| amount | number | yes | Invoice amount in KES |
| billing_ref | string | yes | Customer billing account reference |
| due_date | string | yes | Payment due date YYYY-MM-DD |
| external_ref | string | yes | Your internal invoice/reference number |
| invoice_name | string | yes | Invoice description shown to customer |
| phone | string | yes | Customer phone to receive SMS notification |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_bill_manager_optin Bill Manager — Opt In ~91
Enrol your business in M-PESA Bill Manager. Must be called once before creating invoices. After opt-in, customers can pay your invoices directly via M-PESA.
| Name | Type | Req | Description |
|---|---|---|---|
| callback_url | string | – | Callback URL for Bill Manager events |
| string | yes | Business email for Bill Manager notifications | |
| logo_url | string | – | HTTPS URL to your business logo (PNG/JPG) |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_business_buygoods Business Buy Goods (B2B) ~72
Pay from business shortcode to a till/buy-goods number. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | yes | Amount in KES |
| remarks | string | – | Transaction remarks |
| till_number | string | yes | Destination till number (Buy Goods) |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_business_paybill Business Pay Bill (B2B) ~95
Pay directly from business shortcode to another paybill number. Use for supplier payments, utility bills, inter-business transfers. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL.
| Name | Type | Req | Description |
|---|---|---|---|
| account_reference | string | yes | Account number at destination paybill |
| amount | integer | yes | Amount in KES |
| receiver_paybill | string | yes | Destination paybill shortcode |
| remarks | string | – | Transaction remarks |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_business_pochi Business to Pochi la Biashara ~88
Pay from business shortcode to a Pochi la Biashara micro-SME wallet. Used for micro-enterprise supplier payments and informal sector settlements. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | yes | Amount in KES |
| phone | string | yes | Pochi wallet owner phone number |
| remarks | string | – | Remarks |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_dynamic_qr Dynamic QR Code ~150
Generate a Dynamic M-PESA QR code for a specific payment amount. Customer scans QR with their M-PESA app — amount pre-fills automatically. Returns base64-encoded QR image. Use for receipts, invoices, POS displays.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | yes | Amount in KES to encode in QR |
| merchant_name | string | yes | Business/merchant name to display on QR |
| qr_size | integer | – | QR image size in pixels (300-1000) |
| ref_no | string | yes | Transaction reference number |
| trx_code | string | – | BG=Buy Goods, PB=Paybill, WA=Wallet, SM=Send Money, SB=Lipa Shortcode |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_imsi_query IMSI Query — Phone Verification ~79
Verify a Safaricom number — returns registration date, SIM age, last swap, and hashed IMSI. Enhanced KYC/AML signal for financial services compliance. Older SIMs with no recent swaps have lower fraud risk. Returns data suitable for risk scoring without exposing raw IMSI.
| Name | Type | Req | Description |
|---|---|---|---|
| phone | string | yes | Phone number to verify |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_pull_transactions Pull C2B Transactions ~100
Pull all C2B transactions for reconciliation within a date range. Returns customer payments to your shortcode for audit and reconciliation. Max range: 48 hours per call. Max 10,000 records per call.
| Name | Type | Req | Description |
|---|---|---|---|
| end_date | string | yes | End date YYYY-MM-DD HH:MM:SS |
| offset | integer | – | Pagination offset (0-based) |
| start_date | string | yes | Start date YYYY-MM-DD HH:MM:SS |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_query_org_info Query Org Info ~65
Validate a shortcode — returns the registered name and tariff type. Use before sending B2B payments to confirm the destination shortcode is correct. Prevents accidental payments to wrong paybill numbers.
| Name | Type | Req | Description |
|---|---|---|---|
| shortcode | string | yes | Shortcode to validate (paybill or till number) |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_ratiba_create M-PESA Ratiba — Create Standing Order ~194
Create an M-PESA Ratiba standing order — automated recurring payments. Customer authorizes once; payments happen automatically on schedule. Perfect for subscription billing, rent collection, loan repayments, SACCO contributions. Returns a standing order ID to manage/cancel later.
| Name | Type | Req | Description |
|---|---|---|---|
| account_ref | string | yes | Account reference for each payment |
| amount | integer | yes | Amount in KES per payment |
| description | string | – | Standing order description |
| end_date | string | yes | End date YYYYMMDD |
| frequency | string | – | 1=One-Off 2=Daily 3=Weekly 4=Monthly 5=Bi-Monthly 6=Quarterly 7=Half-Year 8=Annually |
| phone | string | yes | Customer phone number |
| standing_order_name | string | yes | Name for the standing order |
| start_date | string | yes | Start date YYYYMMDD |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_reversal M-Pesa Reversal ~100
Reverse an erroneous M-Pesa transaction. Use when a payment was sent to the wrong number or wrong amount. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL. Result delivered async to MPESA_RESULT_URL.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | yes | Amount to reverse in KES |
| remarks | string | – | Reason for reversal |
| transaction_id | string | yes | M-Pesa receipt to reverse e.g. QKL8XXXXXX |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_sim_swap_query SIM Swap Query ~78
Check if a phone number's SIM card was recently swapped. Critical fraud prevention signal — SIM swaps often precede account takeovers. Use before high-value B2C disbursements to verify recipient identity is stable. Returns swap status and last swap date.
| Name | Type | Req | Description |
|---|---|---|---|
| phone | string | yes | Phone number to check for SIM swap activity |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_stk_push M-Pesa STK Push ~133
Trigger M-Pesa STK Push — sends payment prompt to customer's phone. Customer enters M-PESA PIN to complete payment. Returns CheckoutRequestID; poll mpesa_stk_query after 10-30 seconds.
| Name | Type | Req | Description |
|---|---|---|---|
| account_ref | string | yes | Account reference shown to customer on phone (max 12 chars) |
| amount | integer | yes | Amount in KES (whole number, min 1, max 150000) |
| description | string | – | Transaction description (max 13 chars) |
| phone | string | yes | Customer phone (any Kenyan format: +254..., 07..., 254...) |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_stk_query M-Pesa STK Query ~69
Check STK Push status. Poll 10-30s after mpesa_stk_push. ResultCode 0 = success, 1032 = cancelled, 1037 = timed out.
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_request_id | string | yes | CheckoutRequestID from mpesa_stk_push response |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_tax_remittance Tax Remittance to KRA ~101
Remit tax directly from M-PESA business account to Kenya Revenue Authority. Provide the KRA Payment Registration Number (PRN) as account_reference. KRA shortcode: 572572. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL.
| Name | Type | Req | Description |
|---|---|---|---|
| account_reference | string | yes | KRA Payment Registration Number (PRN) |
| amount | integer | yes | Tax amount in KES |
| remarks | string | – | Remittance remarks |
Structured output declared, but exposes no named fields.
No examples provided.
mpesa_transaction_status M-Pesa Transaction Status ~66
Query status of any M-Pesa transaction by receipt number. Requires MPESA_INITIATOR_NAME and MPESA_SECURITY_CREDENTIAL. Result delivered async to MPESA_RESULT_URL.
| Name | Type | Req | Description |
|---|---|---|---|
| transaction_id | string | yes | M-Pesa receipt number e.g. QKL8XXXXXX |
Structured output declared, but exposes no named fields.
No examples provided.
sms_send Send SMS ~108
Send SMS to 1-1000 recipients via Africa's Talking. Works across Kenya, Nigeria, Ghana, Tanzania, Uganda, Rwanda and 15+ more. Returns per-recipient status and cost breakdown.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | SMS message text. Unicode supported (Kiswahili etc.) |
| recipients | array | yes | Phone numbers in E.164 format e.g. ['+254712345678'] |
| sender_id | string | – | Optional pre-registered alphanumeric sender ID |
Structured output declared, but exposes no named fields.
No examples provided.
What is the io.github.gabrielmahia/mpesa-mcp server?
io.github.gabrielmahia/mpesa-mcp is listed in the public MCP registry as io.github.gabrielmahia/mpesa-mcp. MCP server for M-Pesa mobile-money integration in Kenya. This page covers its PyPI package (mpesa-mcp).
Is the io.github.gabrielmahia/mpesa-mcp server safe to use?
io.github.gabrielmahia/mpesa-mcp scores 65 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.gabrielmahia/mpesa-mcp server expose?
io.github.gabrielmahia/mpesa-mcp exposes 23 tools: mpesa_stk_push, mpesa_stk_query, mpesa_b2c, mpesa_business_paybill, mpesa_business_buygoods, and 18 more. Their descriptions and schemas cost roughly 2,298 tokens of context every time the server is loaded.
Is the io.github.gabrielmahia/mpesa-mcp server still maintained?
io.github.gabrielmahia/mpesa-mcp is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.