# io.github.ivangr1/walletap (npm · @walletap/mcp-server)

Issue and manage Apple Wallet & Google Wallet passes from any AI assistant.

- Trust score: 59/100 (low)
- Change this week: +21
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@walletap/mcp-server`: 59/100 (this document), [markdown](https://verifymcp.io/servers/ivangr1-walletap/walletap-mcp-server.md), [page](https://verifymcp.io/servers/ivangr1-walletap/walletap-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@walletap/mcp-server`
- Version: `0.1.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 19/100
  - Repository check failed: the declared repository URL redirects; it must resolve directly.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 78 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 49/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2242 tokens (~93/item across 24 items; 23 tools + 1 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add ivangr1-walletap -- npx -y @walletap/mcp-server
```

### Codex

```bash
codex mcp add ivangr1-walletap -- npx -y @walletap/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ivangr1-walletap": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@walletap/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ivangr1-walletap --command npx --arg -y --arg @walletap/mcp-server
```

### Hermes

```yaml
mcp_servers:
  ivangr1-walletap:
    command: "npx"
    args: ["-y", "@walletap/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "ivangr1-walletap": {
      "command": "npx",
      "args": [
        "-y",
        "@walletap/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 59, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 55, +53)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → 0
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 2, +2)

- [functional improvement] Dependency health: unverified → partial

### 2026-07-31 (score 0, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 20, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 38)

First indexed and scored.

## MCP tools (23)

### `list_passes` (~129 tokens)

List all passes for a given template with pagination and optional status filtering. Use this to browse passes, check counts, or find passes by their installation status. Returns pass objects with IDs, emails, phones, and device counts.

Input parameters:

- `endBefore` (string): Cursor for previous page
- `limit` (number): Max results to return (default: 15)
- `startAfter` (string): Cursor for next page — use value from previous response
- `status` (string): Filter by installation status (default: all)
- `templateId` (string, required): Template ID to list passes for

### `search_passes` (~69 tokens)

Search passes within a template by email or phone number. Use this when you need to find a specific customer's pass. Returns matching passes ordered by creation date.

Input parameters:

- `searchQuery` (string, required): Email address or phone number to search for
- `templateId` (string, required): Template ID to search within

### `export_passes` (~95 tokens)

Export all passes for a template as CSV data. Use this to get a full data dump of passes for reporting or migration. Returns CSV with columns: Pass ID, External ID, Email, Phone, Name, Member ID, Status, Installation Status, Device Count, Created, Updated.

Input parameters:

- `status` (string): Filter by installation status (default: all)
- `templateId` (string, required): Template ID to export passes for

### `get_pass` (~140 tokens)

Get a single pass by ID or by externalId + templateId. Returns the pass with wallet download URLs (Apple, Google, Huawei) and installation badge URLs. Use includeTemplate to also get the full template configuration.

Input parameters:

- `externalId` (string): External ID (must be combined with templateId)
- `id` (string): Pass ID (use this OR externalId + templateId)
- `includeTemplate` (boolean): Include full template data in response
- `locale` (string): Locale for pass text (e.g. 'en', 'hr', 'de')
- `templateId` (string): Template ID (required when using externalId)

### `create_pass` (~109 tokens)

Create one or more wallet passes for a template. Use this to issue new loyalty cards, event tickets, coupons, or membership passes to customers. Can optionally send the pass link via email or SMS.

Input parameters:

- `locale` (string): Locale for pass text and communications
- `passes` (array, required): Array of passes to create (1 or more)
- `sendToEmail` (boolean): Send pass link via email to customer
- `sendToPhone` (boolean): Send pass link via SMS to customer

### `update_pass` (~192 tokens)

Update an existing pass's fields, stamps, or balance. Use this to modify customer data, add/remove loyalty stamps, adjust balance, or invalidate a pass. Identify the pass by ID or by externalId + templateId.

Input parameters:

- `balanceOperation` (object): Balance operation (for gift cards / prepaid)
- `customFields` (object): Custom metadata to update
- `externalId` (string): External ID (must be combined with templateId)
- `id` (string): Pass ID (use this OR externalId + templateId)
- `isValid` (boolean): Set pass validity (false = voided/greyed out)
- `redemptionValue` (string): Update NFC redemption value
- `stampOperation` (object): Stamp collection operation (for stamp cards)
- `templateFields` (object): Template field values to update
- `templateId` (string): Template ID (required when using externalId)

### `notify_pass` (~140 tokens)

Send a push notification to a single pass holder via Google Wallet. Use this for targeted messages to individual customers (e.g. balance update, reward earned). For bulk notifications to all pass holders, use send_template_notification instead.

Input parameters:

- `content` (string, required): Notification body text. URLs in content become clickable links.
- `passId` (string, required): ID of the pass to send notification to
- `title` (string, required): Notification title
- `validFrom` (string): ISO 8601 timestamp when notification becomes visible (default: now)
- `validUntil` (string): ISO 8601 timestamp when notification expires (default: now + 24h)

### `list_templates` (~76 tokens)

List all pass templates with cursor-based pagination. Use this to discover available templates before creating or managing passes. Returns template names, types, IDs, and pagination info.

Input parameters:

- `limit` (number): Max results to return (default: 15)
- `startAfter` (string): Cursor for next page — pass endCursor from previous response

### `create_template` (~136 tokens)

Create a new pass template (loyalty card, gift card, event ticket, coupon, or generic). Use this to set up a new pass type before issuing passes to customers. After creation, update the template to configure its visual design and fields.

Input parameters:

- `cardSharing` (string): Card sharing setting
- `enableBarcode` (boolean): Enable barcode on pass (default: true)
- `enableNFC` (boolean): Enable NFC tap functionality (default: false)
- `name` (string, required): Template display name
- `requireAuthentication` (boolean): Require device authentication to view pass
- `type` (string, required): Pass type

### `update_template` (~85 tokens)

Update an existing template's configuration, design, or fields. Use this to change visual appearance, update field mappings, or modify behavior. Changes are pushed to all installed passes automatically.

Input parameters:

- `data` (object, required): Template fields to update (deep merged with existing data). Can include visual config, field definitions, translations, etc.
- `templateId` (string, required): Template ID to update

### `delete_template` (~61 tokens)

Permanently delete a template and deactivate its billing meters. Use with caution — this cannot be undone. All passes under this template will become orphaned. Consider listing passes first to ensure the template is empty.

Input parameters:

- `templateId` (string, required): Template ID to delete

### `send_template_notification` (~138 tokens)

Send a push notification to ALL pass holders of a template via Apple, Google, and Huawei wallets. Use this for announcements, promotions, or updates that apply to all customers. For individual notifications, use notify_pass instead.

Input parameters:

- `content` (string, required): Notification body text. URLs in content become clickable links.
- `templateId` (string, required): Template ID to send notification for
- `title` (string, required): Notification title
- `validFrom` (string): ISO 8601 timestamp when notification becomes visible (default: now)
- `validUntil` (string): ISO 8601 timestamp when notification expires (default: now + 24h)

### `create_certificate` (~62 tokens)

Create or renew an Apple Wallet certificate for a template. Use this after creating a template to enable Apple Wallet pass generation. This is automatically handled during template creation but may need manual triggering for renewals.

Input parameters:

- `templateId` (string, required): Template ID to create certificate for

### `list_locations` (~39 tokens)

List all locations for the authenticated account. Use this to see available business locations for reader deployment or pass association. Returns location names, addresses, and coordinates.

### `create_location` (~97 tokens)

Create a new business location for reader deployment and pass management. Use this when setting up a new store, venue, or checkpoint. Locations can be associated with passes and readers for validation.

Input parameters:

- `address` (string): Human-readable address
- `businessLocationLabel` (string): Internal label for this location
- `latitude` (number, required): GPS latitude
- `longitude` (number, required): GPS longitude
- `name` (string, required): Location display name

### `update_location` (~101 tokens)

Update an existing location's details. Use this to correct addresses, rename locations, or update coordinates. Only provided fields are updated — omitted fields remain unchanged.

Input parameters:

- `address` (string): New address
- `businessLocationLabel` (string): New internal label
- `id` (string, required): Location ID to update
- `latitude` (number): New GPS latitude
- `longitude` (number): New GPS longitude
- `name` (string): New location name

### `delete_location` (~43 tokens)

Delete a location permanently. Use with caution — readers associated with this location will need reassignment. Subscription is updated automatically.

Input parameters:

- `id` (string, required): Location ID to delete

### `create_reader` (~92 tokens)

Create a new VTAP NFC reader for pass validation at a location. Use this when deploying a new physical reader device. If a phone number is provided, an SMS with the login link is sent to the reader operator.

Input parameters:

- `name` (string, required): Reader display name
- `phone` (string): Phone number to send SMS login link to reader operator
- `templateId` (string, required): Template ID this reader validates

### `list_sub_accounts` (~44 tokens)

List all sub-accounts (team members) for the main account. Use this to see who has access and their template permissions. Returns sub-account details with template access counts.

### `create_sub_account` (~119 tokens)

Create a new sub-account (team member) with specific permissions and template access. Use this to grant team members limited access to manage specific templates. The sub-account gets their own login credentials.

Input parameters:

- `displayName` (string, required): Display name
- `email` (string, required): Email address for the new sub-account
- `password` (string, required): Initial password for the sub-account
- `permissions` (array): Permission list (e.g. ['passes.read', 'passes.write'])
- `templateIds` (array): Template IDs this sub-account can access

### `update_sub_account` (~109 tokens)

Update a sub-account's permissions, template access, or active status. Use this to grant/revoke access or deactivate a team member. Only provided fields are updated.

Input parameters:

- `displayName` (string): Updated display name
- `isActive` (boolean): Set active status (false = deactivated)
- `permissions` (array): Updated permission list
- `templateIds` (array): Updated template IDs this sub-account can access
- `userId` (string, required): Sub-account user ID to update

### `delete_sub_account` (~57 tokens)

Permanently delete a sub-account and revoke all their access. Use with caution — this removes the user's Firebase auth account and all template access records. This cannot be undone.

Input parameters:

- `userId` (string, required): Sub-account user ID to delete

### `translate_pass_text` (~104 tokens)

Translate pass text to multiple languages using Google Cloud Translation. Use this to localize pass content (field labels, messages) for international customers. Supports all Google Translate languages.

Input parameters:

- `sourceLanguage` (string, required): Source language code (e.g. 'en', 'hr', 'de')
- `targetLanguages` (array, required): Array of target language codes (e.g. ['es', 'fr', 'de'])
- `texts` (array, required): Array of text strings to translate

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/ivangr1-walletap/walletap-mcp-server#diagnostics

## Score history

- 2026-08-03: 59
- 2026-08-02: 55
- 2026-08-01: 2
- 2026-07-31: 0
- 2026-07-30: 20
- 2026-07-28: 38
- 2026-07-27: 38

## Links

- npm package: https://www.npmjs.com/package/@walletap/mcp-server
- Socket report: https://socket.dev/npm/package/@walletap/mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/ivangr1-walletap/walletap-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ivangr1-walletap/walletap-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/ivangr1-walletap/walletap-mcp-server