io.github.ivangr1/walletap
NPM · @WALLETAP/MCP-SERVER · SCANNED SEP 20
Issue and manage Apple Wallet & Google Wallet passes from any AI assistant.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL redirects; it must resolve directly. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 34 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability47
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2242 tokens (~93/item across 24 items; 23 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "notify_pass" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.ivangr1/walletap MCP server?
io.github.ivangr1/walletap runs locally as an npm package, launched with npx -y @walletap/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @walletap/mcp-server
claude mcp add ivangr1-walletap -- npx -y @walletap/mcp-server
{
"mcpServers": {
"ivangr1-walletap": {
"command": "npx",
"args": [
"-y",
"@walletap/mcp-server"
]
}
}
} {
"servers": {
"ivangr1-walletap": {
"command": "npx",
"args": [
"-y",
"@walletap/mcp-server"
]
}
}
} codex mcp add ivangr1-walletap -- npx -y @walletap/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ivangr1-walletap": {
"type": "local",
"command": [
"npx",
"-y",
"@walletap/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add ivangr1-walletap --command npx --arg -y --arg @walletap/mcp-server
mcp_servers:
ivangr1-walletap:
command: "npx"
args: ["-y", "@walletap/mcp-server"] {
"McpServers": {
"ivangr1-walletap": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@walletap/mcp-server"
]
}
}
} assistant mcp add ivangr1-walletap -t stdio -c npx -a -y @walletap/mcp-server
{
"mcpServers": {
"ivangr1-walletap": {
"command": "npx",
"args": [
"-y",
"@walletap/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 0
- Stability: 0.97 → pass security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/@walletap/mcp-server@0.1.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_certificate ~62
Create or renew an Apple Wallet certificate for a template. Use this after creating a template to enable Apple Wallet pass generation. This is automatically handled during template creation but may need manual triggering for renewals.
| Name | Type | Req | Description |
|---|---|---|---|
| templateId | string | yes | Template ID to create certificate for |
No output schema declared.
No examples provided.
create_location ~97
Create a new business location for reader deployment and pass management. Use this when setting up a new store, venue, or checkpoint. Locations can be associated with passes and readers for validation.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | Human-readable address |
| businessLocationLabel | string | – | Internal label for this location |
| latitude | number | yes | GPS latitude |
| longitude | number | yes | GPS longitude |
| name | string | yes | Location display name |
No output schema declared.
No examples provided.
create_pass ~109
Create one or more wallet passes for a template. Use this to issue new loyalty cards, event tickets, coupons, or membership passes to customers. Can optionally send the pass link via email or SMS.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Locale for pass text and communications |
| passes | array | yes | Array of passes to create (1 or more) |
| sendToEmail | boolean | – | Send pass link via email to customer |
| sendToPhone | boolean | – | Send pass link via SMS to customer |
No output schema declared.
No examples provided.
create_reader ~92
Create a new VTAP NFC reader for pass validation at a location. Use this when deploying a new physical reader device. If a phone number is provided, an SMS with the login link is sent to the reader operator.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Reader display name |
| phone | string | – | Phone number to send SMS login link to reader operator |
| templateId | string | yes | Template ID this reader validates |
No output schema declared.
No examples provided.
create_sub_account ~119
Create a new sub-account (team member) with specific permissions and template access. Use this to grant team members limited access to manage specific templates. The sub-account gets their own login credentials.
| Name | Type | Req | Description |
|---|---|---|---|
| displayName | string | yes | Display name |
| string | yes | Email address for the new sub-account | |
| password | string | yes | Initial password for the sub-account |
| permissions | array | – | Permission list (e.g. ['passes.read', 'passes.write']) |
| templateIds | array | – | Template IDs this sub-account can access |
No output schema declared.
No examples provided.
create_template ~136
Create a new pass template (loyalty card, gift card, event ticket, coupon, or generic). Use this to set up a new pass type before issuing passes to customers. After creation, update the template to configure its visual design and fields.
| Name | Type | Req | Description |
|---|---|---|---|
| cardSharing | string | – | Card sharing setting |
| enableBarcode | boolean | – | Enable barcode on pass (default: true) |
| enableNFC | boolean | – | Enable NFC tap functionality (default: false) |
| name | string | yes | Template display name |
| requireAuthentication | boolean | – | Require device authentication to view pass |
| type | string | yes | Pass type |
No output schema declared.
No examples provided.
delete_location ~43
Delete a location permanently. Use with caution — readers associated with this location will need reassignment. Subscription is updated automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Location ID to delete |
No output schema declared.
No examples provided.
delete_sub_account ~57
Permanently delete a sub-account and revoke all their access. Use with caution — this removes the user's Firebase auth account and all template access records. This cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | yes | Sub-account user ID to delete |
No output schema declared.
No examples provided.
delete_template ~61
Permanently delete a template and deactivate its billing meters. Use with caution — this cannot be undone. All passes under this template will become orphaned. Consider listing passes first to ensure the template is empty.
| Name | Type | Req | Description |
|---|---|---|---|
| templateId | string | yes | Template ID to delete |
No output schema declared.
No examples provided.
export_passes ~95
Export all passes for a template as CSV data. Use this to get a full data dump of passes for reporting or migration. Returns CSV with columns: Pass ID, External ID, Email, Phone, Name, Member ID, Status, Installation Status, Device Count, Created, Updated.
| Name | Type | Req | Description |
|---|---|---|---|
| status | string | – | Filter by installation status (default: all) |
| templateId | string | yes | Template ID to export passes for |
No output schema declared.
No examples provided.
get_pass ~140
Get a single pass by ID or by externalId + templateId. Returns the pass with wallet download URLs (Apple, Google, Huawei) and installation badge URLs. Use includeTemplate to also get the full template configuration.
| Name | Type | Req | Description |
|---|---|---|---|
| externalId | string | – | External ID (must be combined with templateId) |
| id | string | – | Pass ID (use this OR externalId + templateId) |
| includeTemplate | boolean | – | Include full template data in response |
| locale | string | – | Locale for pass text (e.g. 'en', 'hr', 'de') |
| templateId | string | – | Template ID (required when using externalId) |
No output schema declared.
No examples provided.
list_locations ~39
List all locations for the authenticated account. Use this to see available business locations for reader deployment or pass association. Returns location names, addresses, and coordinates.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_passes ~129
List all passes for a given template with pagination and optional status filtering. Use this to browse passes, check counts, or find passes by their installation status. Returns pass objects with IDs, emails, phones, and device counts.
| Name | Type | Req | Description |
|---|---|---|---|
| endBefore | string | – | Cursor for previous page |
| limit | number | – | Max results to return (default: 15) |
| startAfter | string | – | Cursor for next page — use value from previous response |
| status | string | – | Filter by installation status (default: all) |
| templateId | string | yes | Template ID to list passes for |
No output schema declared.
No examples provided.
list_sub_accounts ~44
List all sub-accounts (team members) for the main account. Use this to see who has access and their template permissions. Returns sub-account details with template access counts.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_templates ~76
List all pass templates with cursor-based pagination. Use this to discover available templates before creating or managing passes. Returns template names, types, IDs, and pagination info.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results to return (default: 15) |
| startAfter | string | – | Cursor for next page — pass endCursor from previous response |
No output schema declared.
No examples provided.
notify_pass ~140
Send a push notification to a single pass holder via Google Wallet. Use this for targeted messages to individual customers (e.g. balance update, reward earned). For bulk notifications to all pass holders, use send_template_notification instead.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Notification body text. URLs in content become clickable links. |
| passId | string | yes | ID of the pass to send notification to |
| title | string | yes | Notification title |
| validFrom | string | – | ISO 8601 timestamp when notification becomes visible (default: now) |
| validUntil | string | – | ISO 8601 timestamp when notification expires (default: now + 24h) |
No output schema declared.
No examples provided.
search_passes ~69
Search passes within a template by email or phone number. Use this when you need to find a specific customer's pass. Returns matching passes ordered by creation date.
| Name | Type | Req | Description |
|---|---|---|---|
| searchQuery | string | yes | Email address or phone number to search for |
| templateId | string | yes | Template ID to search within |
No output schema declared.
No examples provided.
send_template_notification ~138
Send a push notification to ALL pass holders of a template via Apple, Google, and Huawei wallets. Use this for announcements, promotions, or updates that apply to all customers. For individual notifications, use notify_pass instead.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Notification body text. URLs in content become clickable links. |
| templateId | string | yes | Template ID to send notification for |
| title | string | yes | Notification title |
| validFrom | string | – | ISO 8601 timestamp when notification becomes visible (default: now) |
| validUntil | string | – | ISO 8601 timestamp when notification expires (default: now + 24h) |
No output schema declared.
No examples provided.
translate_pass_text ~104
Translate pass text to multiple languages using Google Cloud Translation. Use this to localize pass content (field labels, messages) for international customers. Supports all Google Translate languages.
| Name | Type | Req | Description |
|---|---|---|---|
| sourceLanguage | string | yes | Source language code (e.g. 'en', 'hr', 'de') |
| targetLanguages | array | yes | Array of target language codes (e.g. ['es', 'fr', 'de']) |
| texts | array | yes | Array of text strings to translate |
No output schema declared.
No examples provided.
update_location ~101
Update an existing location's details. Use this to correct addresses, rename locations, or update coordinates. Only provided fields are updated — omitted fields remain unchanged.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | – | New address |
| businessLocationLabel | string | – | New internal label |
| id | string | yes | Location ID to update |
| latitude | number | – | New GPS latitude |
| longitude | number | – | New GPS longitude |
| name | string | – | New location name |
No output schema declared.
No examples provided.
update_pass ~192
Update an existing pass's fields, stamps, or balance. Use this to modify customer data, add/remove loyalty stamps, adjust balance, or invalidate a pass. Identify the pass by ID or by externalId + templateId.
| Name | Type | Req | Description |
|---|---|---|---|
| balanceOperation | object | – | Balance operation (for gift cards / prepaid) |
| customFields | object | – | Custom metadata to update |
| externalId | string | – | External ID (must be combined with templateId) |
| id | string | – | Pass ID (use this OR externalId + templateId) |
| isValid | boolean | – | Set pass validity (false = voided/greyed out) |
| redemptionValue | string | – | Update NFC redemption value |
| stampOperation | object | – | Stamp collection operation (for stamp cards) |
| templateFields | object | – | Template field values to update |
| templateId | string | – | Template ID (required when using externalId) |
No output schema declared.
No examples provided.
update_sub_account ~109
Update a sub-account's permissions, template access, or active status. Use this to grant/revoke access or deactivate a team member. Only provided fields are updated.
| Name | Type | Req | Description |
|---|---|---|---|
| displayName | string | – | Updated display name |
| isActive | boolean | – | Set active status (false = deactivated) |
| permissions | array | – | Updated permission list |
| templateIds | array | – | Updated template IDs this sub-account can access |
| userId | string | yes | Sub-account user ID to update |
No output schema declared.
No examples provided.
update_template ~85
Update an existing template's configuration, design, or fields. Use this to change visual appearance, update field mappings, or modify behavior. Changes are pushed to all installed passes automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | Template fields to update (deep merged with existing data). Can include visual config, field definitions, translations, etc. |
| templateId | string | yes | Template ID to update |
No output schema declared.
No examples provided.
What is the io.github.ivangr1/walletap MCP server?
io.github.ivangr1/walletap is an MCP server listed in the public MCP registry as io.github.ivangr1/walletap. Issue and manage Apple Wallet & Google Wallet passes from any AI assistant. This page covers its npm package (@walletap/mcp-server).
Is the io.github.ivangr1/walletap MCP server safe to use?
io.github.ivangr1/walletap scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.ivangr1/walletap MCP server expose?
io.github.ivangr1/walletap exposes 23 tools: list_passes, search_passes, export_passes, get_pass, create_pass, and 18 more. Their descriptions and schemas cost roughly 2,237 tokens of context every time the server is loaded.
Is the io.github.ivangr1/walletap MCP server still maintained?
io.github.ivangr1/walletap is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.ivangr1/walletap MCP server under?
io.github.ivangr1/walletap declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.