AbaPay
REMOTE · AGENTS.ABAPAYS.COM · SCANNED SEP 27
Non-custodial stablecoin bill-pay rails on Celo & Base for AI agents, settled on-chain via MCP.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (pay_bill). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3394 tokens (~308/item across 11 items; 10 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
- Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
How do I install the AbaPay MCP server?
AbaPay is a hosted endpoint at https://agents.abapays.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · agents.abapays.com
claude mcp add --transport http investorphem-abapay 'https://agents.abapays.com/api/mcp'
{
"mcpServers": {
"investorphem-abapay": {
"url": "https://agents.abapays.com/api/mcp"
}
}
} {
"servers": {
"investorphem-abapay": {
"type": "http",
"url": "https://agents.abapays.com/api/mcp"
}
}
} [mcp_servers.investorphem-abapay] url = "https://agents.abapays.com/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"investorphem-abapay": {
"type": "remote",
"url": "https://agents.abapays.com/api/mcp",
"enabled": true
}
}
} openclaw mcp add investorphem-abapay --url 'https://agents.abapays.com/api/mcp' --transport streamable-http
mcp_servers:
investorphem-abapay:
url: "https://agents.abapays.com/api/mcp" {
"McpServers": {
"investorphem-abapay": {
"Transport": "http",
"Url": "https://agents.abapays.com/api/mcp"
}
}
} assistant mcp add investorphem-abapay -t streamable-http -u 'https://agents.abapays.com/api/mcp'
{
"mcpServers": {
"investorphem-abapay": {
"type": "http",
"url": "https://agents.abapays.com/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 27 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 23 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 0
- Tool “pay_bill” rewrote its description, which is the text the model reads security
- Tool “check_balance” rewrote its description, which is the text the model reads security
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “pay_bill” rewrote its description, which is the text the model reads security
- Tool “list_international_options” rewrote its description, which is the text the model reads security
- Stability: unverified → 0.03 ▲ functional
- 16 Sept 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 27 Sept 2026 · Probed https://agents.abapays.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=agents.abapays.com | CN=YR1,O=Let's Encrypt,C=US | 12 Sept 2026 | 11 Dec 2026 | RSA 2048 | SHA256-RSA | 581f70b2c9d1da8115925867cfb26efbcdb |
| SANs: agents.abapays.com | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of agents.abapays.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| abapays.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://agents.abapays.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://agents.abapays.com/api/mcp | HTTPS enforced | 308 | https://agents.abapays.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_schedule Cancel Schedule ~147
Cancel one or more active schedules for the linked wallet. Call list_schedules first to get a real id. Pass id to cancel exactly one; pass provider to cancel every active schedule for that provider; omit both to cancel ALL active schedules for this wallet. No PIN required, matching chat.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | AbaPay MCP API key. NOT needed when the connector is authorized via OAuth — omit it entirely in that case. |
| id | string | – | The exact schedule id from list_schedules. Cancels only that one schedule. |
| provider | string | – | Cancel every active schedule for this provider, e.g. "mtn". Ignored if id is also given. |
No output schema declared.
No examples provided.
check_balance Check Balance ~103
Check a linked wallet's stablecoin balances and remaining agent spending allowance. Works with no arguments once this connector is authorized via OAuth.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | AbaPay MCP API key (starts with aba_mcp_). NOT needed when the connector is authorized via OAuth — omit it entirely in that case; only supply it if this server asked you to authenticate and OAuth is… |
| chain | string | – | Defaults to the chain approved when the key was created. |
No output schema declared.
No examples provided.
describe_capabilities Describe Capabilities ~45
List what AbaPay can pay (airtime, data, electricity, cable, etc.), any services currently paused, and example requests. Call this first if unsure what is supported.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_international_options List International Options ~249
Browse the REAL, live international top-up catalogue (140+ countries) one level at a time. Call with no country to see supported countries. Add country to see its product types. Add product_type_id to see operators. Add operator_id too to see real, currently purchasable plans with their exact codes, foreign-currency price, and NGN-equivalent cost. ALWAYS call this before pay_bill with service: INTERNATIONAL, and pass back the exact country/product_type_id/operator_id/variation_code shown — never guess any of them. Only plans marked fixed-price can be paid via pay_bill right now; flexible-amount plans must be completed in the AbaPay app.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Country name or ISO code, e.g. "Ghana" or "GH". Omit to list all supported countries. |
| operator_id | string | – | An operator_id returned for this country + product_type_id — the network to top up. Omit to list operators. |
| product_type_id | string | – | A product_type_id returned for this country — e.g. which kind of top-up (airtime vs a data bundle). Omit to list the country's product types. |
No output schema declared.
No examples provided.
list_plans List Plans ~174
List the REAL, currently purchasable plans for a service that needs one — DATA bundles, CABLE packages, or EDUCATION products (WAEC/JAMB) — with their exact codes and current VTpass prices. ALWAYS call this before pay_bill for these three services and pass back one of the returned codes as variation_code. Never guess a plan, a code, or a price — if this returns nothing usable, say so rather than inventing one.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | yes | e.g. mtn, airtel, glo, 9mobile (data); dstv, gotv, startimes (cable); waec, waec-registration, jamb (education) |
| service | string | yes | Which service to list plans for. Electricity and airtime are free-amount and have no plan list. |
No output schema declared.
No examples provided.
list_schedules List Schedules ~91
List active recurring/one-off bill schedules for the linked wallet — same data as the AbaPay app and Telegram/WhatsApp "show my schedules". Read-only, no PIN required. Returns each schedule's id — pass that to cancel_schedule to remove one.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | AbaPay MCP API key. NOT needed when the connector is authorized via OAuth — omit it entirely in that case. |
No output schema declared.
No examples provided.
pay_bill Pay Bill ~805
Pay a real bill — Nigerian (airtime, data, electricity, cable TV, a WAEC/JAMB education PIN) or international airtime/data across 140+ countries — from the linked wallet, settled on-chain and delivered via the same pipeline as the AbaPay app. For DATA, CABLE (when changing package), and EDUCATION, call list_plans first and use a real variation_code from it. For service: INTERNATIONAL, call list_international_options first and pass back its exact country/product_type_id/operator_id/variation_code — never guess any of these. ALWAYS requires the PIN — including when this connector is authorized via OAuth; ask the human for it every time and never guess or reuse a remembered one. Money moves for real — only call this once the human has clearly confirmed the exact amount, provider, and account. EXECUTES IMMEDIATELY, with no delay/schedule parameter of any kind — there is no way to queue this call for later on this connection. If the human asks to pay "in N minutes", "later today", "tomorrow", or any other future time, do NOT call this now: ask them to confirm they want it sent immediately instead, or tell them delayed/recurring automations can only be set up from the AbaPay app or by messaging the AbaPay agent on Telegram/WhatsApp/X — never silently pay right away when a delay was requested.
| Name | Type | Req | Description |
|---|---|---|---|
| account_number | string | yes | Phone number (airtime/data), meter number (electricity), smartcard/IUC number (cable), JAMB profile ID (education: jamb), the buyer's phone number (education: waec), or the destination phone number a… |
| amount_ngn | number | – | Amount in Naira. Not needed for service: INTERNATIONAL — the NGN-equivalent is derived from the live plan you picked via list_international_options. |
| api_key | string | – | AbaPay MCP API key. NOT needed when the connector is authorized via OAuth — omit it entirely in that case. |
| chain | string | – | Defaults to the chain approved when the API key was created. Only override this if the default chain lacks balance/allowance and check_balance shows funds on the other one. |
| country | string | – | Required for service: INTERNATIONAL — country name or ISO code, from list_international_options. |
| customer_email | string | – | Required for service: INTERNATIONAL (the receipt goes here). Optional otherwise. |
| customer_name | string | – | Optional — used for the receipt if known |
| meter_type | string | – | Required for ELECTRICITY |
| operator_id | string | – | Required for service: INTERNATIONAL — from list_international_options. |
| pin | string | yes | 4-6 digit PIN set when the API key was created. Required on EVERY payment, including over an OAuth connection — ask the human for it each time. |
| product_type_id | string | – | Required for service: INTERNATIONAL — from list_international_options. |
| provider | string | – | e.g. mtn, airtel, glo, ikeja-electric, dstv, gotv, startimes, waec, waec-registration, jamb. Not used for service: INTERNATIONAL — use country/product_type_id/operator_id instead. |
| service | string | yes | Which kind of bill |
| token | string | – | Which stablecoin to pay with. Defaults to the token approved when the API key was created. If that one is short on balance or on-chain allowance, call check_balance first to see what else is availabl… |
| variation_code | string | – | Plan/bundle/product code — required for DATA, EDUCATION, and INTERNATIONAL, and for CABLE when changing package (not needed to renew the current one) |
No output schema declared.
No examples provided.
pay_bill_batch Pay Bill Batch ~424
Pay airtime or data to multiple recipients in ONE call — the same multi-recipient batch Telegram/WhatsApp/X support ("send 500 to X and 1000 to Y"). One PIN authorizes the whole batch. Recipients are grouped by (chain, token); each group's capacity (balance + approved agent limit) is checked against that group's own subtotal — but if ANY group is short, the ENTIRE batch is refused before anything moves (all-or-nothing on capacity; paying 6 of 8 recipients because the 7th was under-funded is worse than one clear error up front). Once capacity clears, recipients are paid one at a time and the response reports each individually, since a single vend failure partway through must not be reported as if the whole batch failed. AIRTIME and DATA only — electricity, cable, education, and international are not batchable; call pay_bill for those, one at a time. For DATA, call list_plans first and give each recipient needing one its own real variation_code. EXECUTES IMMEDIATELY: no delay/schedule option, same as pay_bill — for a delayed/recurring batch, call schedule_bill once per recipient instead.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | AbaPay MCP API key. NOT needed when the connector is authorized via OAuth — omit it entirely in that case. |
| chain | string | – | Default chain for recipients that don't set their own. Falls back to the chain approved when the API key was created. |
| customer_email | string | – | Optional — used for receipts if known, applies to the whole batch. |
| pin | string | yes | 4-6 digit PIN set when the API key was created. Required once for the whole batch. |
| recipients | array | yes | At least 2 recipients (a single recipient should just use pay_bill), at most 20 per call — split a larger batch across several calls. |
| token | string | – | Default token for recipients that don't set their own. Falls back to the token approved when the API key was created. |
No output schema declared.
No examples provided.
schedule_bill Schedule Bill ~617
Set up a recurring or future one-off bill payment — daily/weekly/monthly airtime, data, electricity, or cable — the same automation Telegram/WhatsApp/X support. Validates exactly like pay_bill (call list_plans first for DATA, or CABLE when changing package, to get a real variation_code) and ALWAYS requires the PIN, since this creates a standing spend. Nothing is charged when this tool runs — money only moves later, when the schedule actually fires, and only if the wallet still has a funded on-chain allowance at that time. If the approved agent limit already covers the amount right now, the schedule is created to auto-pay itself each time it is due; otherwise it is saved as notify-only and someone must call pay_bill manually when it comes due — the response says which. EDUCATION and INTERNATIONAL cannot be scheduled; pay those directly with pay_bill. Use list_schedules to see what is set up and cancel_schedule to remove one.
| Name | Type | Req | Description |
|---|---|---|---|
| account_number | string | yes | Phone number (airtime/data), meter number (electricity), or smartcard/IUC number (cable) |
| amount_ngn | number | yes | Amount in Naira to charge each time the schedule runs. |
| api_key | string | – | AbaPay MCP API key. NOT needed when the connector is authorized via OAuth — omit it entirely in that case. |
| chain | string | – | Defaults to the chain approved when the API key was created. |
| customer_email | string | – | Where to send a notification when this runs. MCP has no persistent channel to message back into a conversation — without this, you'll need to poll list_schedules or transaction_history yourself to se… |
| day_of_month | number | – | Required when frequency is "monthly" — 1 through 28. |
| day_of_week | number | – | Required when frequency is "weekly" — 0 (Sunday) through 6 (Saturday). |
| frequency | string | yes | How often this runs. "once" fires exactly one time, schedule_in_minutes from now. |
| meter_type | string | – | Required for ELECTRICITY |
| pin | string | yes | 4-6 digit PIN set when the API key was created. Required to create a schedule, same as pay_bill. |
| provider | string | – | e.g. mtn, airtel, glo, 9mobile, ikeja-electric, dstv, gotv, startimes |
| schedule_in_minutes | number | – | Required when frequency is "once" — minutes from now to run it a single time. |
| service | string | yes | Which kind of bill to schedule. EDUCATION and INTERNATIONAL are not schedulable — use pay_bill directly for those. |
| token | string | – | Defaults to the token approved when the API key was created. |
| variation_code | string | – | Plan/bundle/product code — required for DATA, and for CABLE when changing package (not needed to renew the current one). Get a real one from list_plans first. |
No output schema declared.
No examples provided.
transaction_history Transaction History ~194
List recent real transactions for the linked wallet — same data as the AbaPay app's History tab (service, provider, amount, status, tx hash). Read-only, no PIN required. The interactive card's own Next/Previous buttons page through results by re-calling this tool with a different offset — pass offset yourself only when asked for something like "the next page" or "transactions before that" in plain text.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key | string | – | AbaPay MCP API key. NOT needed when the connector is authorized via OAuth — omit it entirely in that case. |
| limit | number | – | How many recent transactions to return. Defaults to 10, max 25. |
| offset | number | – | How many of the most recent transactions to skip before listing — 0 (default) starts at the newest. Used for paging: offset=10 with the default limit gets the next 10 after the first page. |
No output schema declared.
No examples provided.
What is the AbaPay MCP server?
AbaPay is an MCP server listed in the public MCP registry as io.github.investorphem/abapay. Non-custodial stablecoin bill-pay rails on Celo & Base for AI agents, settled on-chain via MCP. This page covers its hosted endpoint (https://agents.abapays.com/api/mcp).
Is the AbaPay MCP server safe to use?
AbaPay scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AbaPay MCP server expose?
AbaPay exposes 10 tools: describe_capabilities, check_balance, list_plans, list_international_options, transaction_history, and 5 more. Their descriptions and schemas cost roughly 2,849 tokens of context every time the server is loaded.
Does the AbaPay MCP server require authentication?
No. We connected to AbaPay without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the AbaPay MCP server still maintained?
AbaPay is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.