PassFast
REMOTE · PASSFA.ST
Remote HTTPS MCP for Apple + Google Wallet passes. Paste sk_live_ once.
Available components
Last scanned (6 hours ago)
Scores higher than 10% of remote servers
Reachable. Last reached 5 Nov 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not yet verified: we couldn't confirm whether this endpoint requires it. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint returned HTTP 410. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability0
- Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Tool Safety0
- Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Capabilities0
- Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −54
- Endpoint reachability: reachable → not serving MCP ▼ security
- Authorization: fail → unverified ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Transport: pass → fail ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 20 Oct 26 0
- Stability: 0.97 → pass security
- 19 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 63. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://passfa.st/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.passfa.st | CN=YR1,O=Let's Encrypt,C=US | 4 Nov 2026 | 2 Feb 2027 | RSA 2048 | SHA256-RSA | 6a782ac1089b70789af2bb7aacb2ea129bb |
| SANs: *.passfa.st, passfa.st | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of passfa.st. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| st. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Inconclusive
We could not reach the endpoint well enough to judge its authorisation posture.
| Result | Inconclusive |
|---|---|
| HTTP status | 410 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://datafa.st; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://*.supabase.co https://api.passfa.st; font-src 'self' data:; connect-src 'self' https://*.supabase.co wss://*.supabase.co https://api.passfa.st https://datafa.st; frame-ancestors 'none'; base-uri 'self'; form-action 'self' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://passfa.st/mcp | HTTP error | 410 | |
| http (plaintext) | http://passfa.st/mcp | HTTPS enforced | 308 | https://passfa.st/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
batchGeneratePasses ~600
Batch generate wallet passes Generate up to 100 wallet passes in one **synchronous** request. Each accepted row is one `POST /generate-pass` (same free-100 and card-on-file gates as a single generate). Optional `POST /share-pass/create` per successful row when `create_share_links` is true (default). **Host:** `https://passfa.st/api/passes/batch` (site / Vercel preview). This is not an `api.passfa.st` Edge Function. MCP tool: `batchGeneratePasses` (secret key `sk_live_` only) — same path and body as this operation. **Auth:** `Authorization: Bearer sk_live_…` or `pk_live_…` (scope `passes:create`). A Supabase user JWT is also accepted (dashboard session). Send `X-App-Id` for multi-app orgs and `X-Org-Id` as elsewhere. **Body:** mapped `rows` (same shape the dashboard posts) **or** raw `csv` plus optional `column_map`. Do not send both. **Limits:** more than 100 rows → `400 row_limit_exceeded` **before** any generate. Empty body / empty CSV → `400 empty_batch` or `invalid_csv`. Bad template → `400 invalid_template`. Missing or invalid Bearer → `401 unauthorized`. **Billing:** a row that hits the free-100 / card gate returns the same `402` codes as generate-pass (`free_limit_reached`, `subscription_canceled`, `payment_past_due`). Remaining rows stop. Already-created rows stay. HTTP `402` is returned only when **zero** rows succeeded; a later-row 402 after some successes is HTTP `200` with `stopped_reason` and per-row results. **Partial failures:** other per-row errors (validation, duplicate serial, share-link warning) continue. The response lists every processed row. **Scope:** `passes:create` Maps to OpenAPI operationId `batchGeneratePasses` — POST /passes/batch. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| column_map | object | – | Optional CSV header map when `csv` is sent. |
| create_share_links | boolean | – | When true, call POST /share-pass/create after each successful generate. |
| csv | string | – | Raw CSV text with a header row. Do not send together with rows. |
| rows | array | – | Mapped rows (dashboard / scripts). Do not send together with csv. |
| template_id | string | yes | ID of a published template. |
| wallet_type | string | – | – |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
createApiKey ~140
Create an API key Creates a new API key. The response contains `id`, `name`, `key_type`, `key_prefix`, `raw_key`, and `message`. The full raw key is shown only once and cannot be retrieved again. **Scope:** `org:manage` Maps to OpenAPI operationId `createApiKey` — POST /manage-keys. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| key_type | string | yes | Key type. Secret keys have full access; publishable keys have limited scopes. |
| name | string | yes | Human-readable label for the key. |
No output schema declared.
No examples provided.
createApp ~74
Create a new app Creates a new app within the organization. **Scope:** `org:manage` Maps to OpenAPI operationId `createApp` — POST /manage-org/app. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | App display name. |
No output schema declared.
No examples provided.
createShareToken ~207
Create a share token Creates a public share token for a pass, enabling distribution via URL, QR code, or messaging. The share URL points to a public page where recipients can add the pass to Apple or Google Wallet without logging in. Idempotent — if the pass already has a share token, the existing token is returned (200) instead of creating a new one (201). For dual-wallet passes (same serial number with both Apple and Google), the share token is automatically applied to all sibling passes. **Scope:** `passes:manage` Maps to OpenAPI operationId `createShareToken` — POST /share-pass/create. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| pass_id | string | yes | ID of the pass to share. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
createTemplate ~382
Create a template Creates a new pass template in draft status. **Scope:** `templates:manage` Maps to OpenAPI operationId `createTemplate` — POST /manage-templates. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| background_image_id | string | – | – |
| description | string | – | Optional description of the template. |
| field_schema | object | – | Optional JSON schema for validating dynamic data. |
| google_logo_image_id | string | – | – |
| google_pass_type | string | – | Google Wallet class type override. If unset, PassFast auto-maps from the Apple `pass_style` (+ `structure.transitType` for boardingPass): - `generic` → generic - `storeCard` → loyalty (or giftCard vi… |
| google_wide_logo_image_id | string | – | – |
| icon_image_id | string | – | – |
| logo_image_id | string | – | – |
| name | string | yes | Human-readable template name. |
| pass_style | string | yes | Apple Wallet pass style. |
| strip_image_id | string | – | – |
| structure | object | yes | Complete pass structure. Drives both Apple `pass.json` emission and Google Wallet class/object JSON. Fields are grouped below by platform, but the single JSONB object carries all of them for dual-wal… |
| thumbnail_image_id | string | – | – |
| wallet_types | array | – | – |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
deactivateGoogleCredential ~116
Deactivate Google credential Deactivates a Google Wallet credential. **Scope:** `certs:manage` Maps to OpenAPI operationId `deactivateGoogleCredential` — DELETE /manage-certs/google/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Google credential ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
deleteApiKey ~109
Delete an API key Permanently deletes an API key. The key **must be revoked first** (via PATCH) before it can be deleted. Attempting to delete an active key returns 400. **Scope:** `org:manage` Maps to OpenAPI operationId `deleteApiKey` — DELETE /manage-keys/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | API key ID. |
No output schema declared.
No examples provided.
deleteApp ~104
Deactivate an app Deactivates the current app. This does not permanently delete data. **Scope:** `org:manage` Maps to OpenAPI operationId `deleteApp` — DELETE /manage-org/app. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
deleteCertificate ~106
Delete a certificate Deletes a certificate. **Scope:** `certs:manage` Maps to OpenAPI operationId `deleteCertificate` — DELETE /manage-certs/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Certificate ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
deleteImage ~203
Delete an image Deletes an image (storage file + DB row). Always succeeds when the image exists. Any template column pointing at this image is silently cleared (the template falls back to no image in that slot — re-attach a new one if needed). Any pass with `strip_image_id` pointing at this image has its override nullified and reverts to the template's strip on next render. Use `GET /manage-images/{id}/usage` first if you need to know the blast radius before deleting. **Scope:** `images:manage` Maps to OpenAPI operationId `deleteImage` — DELETE /manage-images/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Image ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
deleteTemplate ~147
Delete a template Soft-deletes a template by marking it as archived. Use `permanent=true` to permanently delete the template and its associated data. **Scope:** `templates:manage` Maps to OpenAPI operationId `deleteTemplate` — DELETE /manage-templates/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Template ID. |
| permanent | boolean | – | When true, permanently deletes the template instead of archiving it. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
downloadPass ~117
Download a .pkpass file Downloads the `.pkpass` binary for an active pass. **Scope:** `passes:download` Maps to OpenAPI operationId `downloadPass` — GET /manage-passes/{id}/download. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Pass ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
downloadPassBySerial ~200
Download a .pkpass file by serial number Downloads the `.pkpass` binary for an active pass looked up by serial number. When a serial has both Apple and Google passes, use `?wallet_type=` to select which one (defaults to `apple`). **Scope:** `passes:download` Maps to OpenAPI operationId `downloadPassBySerial` — GET /manage-passes/serial/{serial_number}/download. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| serial_number | string | yes | Pass serial number (unique within app + wallet type). |
| wallet_type | string | – | Wallet type to look up when a serial number has both Apple and Google passes. Defaults to `apple` for backward compatibility. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
downloadSharedPass ~101
Download shared Apple .pkpass Downloads the Apple `.pkpass` file for a shared pass. No authentication required. Only works for active Apple passes. Maps to OpenAPI operationId `downloadSharedPass` — GET /share-pass/{token}/download. Public endpoint — no API key required. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | Share token (32 hex characters). |
No output schema declared.
No examples provided.
generatePass ~673
Generate a wallet pass Generates a wallet pass from a published template. For Apple passes (default), returns a signed `.pkpass` binary file directly. For Google passes (`wallet_type: "google"`), returns a JSON object containing a `save_url` that the user can open to add the pass to Google Wallet. When `wallet_type: "both"`, generates both Apple and Google passes in a single call. The response is always JSON with `apple` and `google` keys. Partial success is allowed — if one wallet fails, the other is still returned with a warning. Returns 201 if at least one succeeds. The pass ID is returned in the `X-Pass-Id` response header (for single-wallet). If the app has a validation webhook configured, the webhook is called once before generation (not per wallet type). A webhook rejection returns 403; a webhook error returns 502 (fail-closed). **Scope:** `passes:create` Maps to OpenAPI operationId `generatePass` — POST /generate-pass. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | yes | Dynamic field values merged into the template structure. |
| expires_at | string | – | Optional expiration timestamp for the pass. |
| external_id | string | – | Optional external identifier for cross-system lookups. |
| get_or_create | boolean | – | When true, if a pass with the same serial_number already exists and is active, return the existing .pkpass (200) instead of a 409 error. The response includes an `X-Pass-Existed: true` header. If the… |
| locations | array | – | GPS locations where the pass is relevant (shown on lock screen). Overrides template defaults if provided. |
| max_distance | number | – | Maximum distance in meters from a location for lock screen relevance. |
| relevant_date | string | – | ISO 8601 date when the pass is relevant (appears on lock screen). |
| serial_number | string | yes | Unique serial number for this pass. |
| strip_image_id | string | – | Override the template's strip/hero image for this pass only. The referenced image must belong to the same app and have purpose `strip` (or a `strip_*` variant). Applied to Apple `strip.png` and Googl… |
| template_id | string | yes | ID of the published template to use. |
| wallet_type | string | – | Target wallet platform. Defaults to `apple`. When set to `google`, the response is a JSON object with a `save_url` instead of a binary .pkpass file. When set to `both`, generates both Apple and Googl… |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
getApp ~97
Get current app details Returns the current app's settings. **Scope:** `org:read` Maps to OpenAPI operationId `getApp` — GET /manage-org/app. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
getBatchGenerateLimits ~129
Batch generate limits Public metadata for `POST /passes/batch`. No authentication. Returns the hard row cap (100), sync mode, auth summary, and stable error codes. This path is on the site host (`https://passfa.st/api`), not `https://api.passfa.st/functions/v1`. MCP tool: `getBatchGenerateLimits`. Maps to OpenAPI operationId `getBatchGenerateLimits` — GET /passes/batch. Public endpoint — no API key required. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
getImageUsage ~220
Get image usage / reference counts Report how an image is referenced across templates and passes. Useful before DELETE to confirm an image is unused, or to find which templates a shared asset is attached to. - `template_refs` lists every template column (e.g. `strip_image_id`, `icon_image_id`, `google_logo_image_id`) that references this image. - `pass_refs_count` is the number of passes whose per-pass `strip_image_id` points at this image. - `safe_to_delete` is `true` when `total_refs` is 0. **Scope:** `images:manage` Maps to OpenAPI operationId `getImageUsage` — GET /manage-images/{id}/usage. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Image ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
getManagedSigningStatus ~124
Check managed signing availability Returns whether managed (platform) signing credentials are available for Apple and Google wallets. When `apple_ready` or `google_ready` is `true`, apps can use `signing_mode: "managed"` or `google_signing_mode: "managed"` without uploading their own credentials. **Scope:** `org:read` Maps to OpenAPI operationId `getManagedSigningStatus` — GET /manage-org/managed-signing-status. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
getOrganization ~60
Get organization details Returns the current organization's settings. **Scope:** `org:read` Maps to OpenAPI operationId `getOrganization` — GET /manage-org. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
getPass ~110
Get a pass Returns the full details of a single pass. **Scope:** `passes:read` Maps to OpenAPI operationId `getPass` — GET /manage-passes/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Pass ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
getPassBySerial ~193
Get a pass by serial number Returns the full details of a single pass looked up by serial number. When a serial has both Apple and Google passes, use `?wallet_type=` to select which one (defaults to `apple`). **Scope:** `passes:read` Maps to OpenAPI operationId `getPassBySerial` — GET /manage-passes/serial/{serial_number}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| serial_number | string | yes | Pass serial number (unique within app + wallet type). |
| wallet_type | string | – | Wallet type to look up when a serial number has both Apple and Google passes. Defaults to `apple` for backward compatibility. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
getSharePassMetadata ~100
Get shared pass metadata Returns public metadata for a shared pass. No authentication required. Used by the public share page to display wallet buttons and pass info. Maps to OpenAPI operationId `getSharePassMetadata` — GET /share-pass/{token}. Public endpoint — no API key required. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | Share token (32 hex characters). |
No output schema declared.
No examples provided.
getTemplate ~110
Get a template Returns the full details of a single template. **Scope:** `templates:manage` Maps to OpenAPI operationId `getTemplate` — GET /manage-templates/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Template ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
listApiKeys ~66
List API keys Returns all API keys for the current organization. **Scope:** `org:manage` Maps to OpenAPI operationId `listApiKeys` — GET /manage-keys. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
listCertificates ~97
List certificates Returns all certificates for the current app. **Scope:** `certs:manage` Maps to OpenAPI operationId `listCertificates` — GET /manage-certs. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
listGoogleCredentials ~104
List Google credentials Returns all active Google Wallet credentials for the current app. **Scope:** `certs:manage` Maps to OpenAPI operationId `listGoogleCredentials` — GET /manage-certs/google. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
listImages ~100
List images Returns all images for the current app, including signed preview URLs. **Scope:** `images:manage` Maps to OpenAPI operationId `listImages` — GET /manage-images. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
listPasses ~217
List passes Returns a paginated list of passes for the current app. **Scope:** `passes:read` Maps to OpenAPI operationId `listPasses` — GET /manage-passes. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| created_after | string | – | Only return passes created after this timestamp. |
| created_before | string | – | Only return passes created before this timestamp. |
| external_id | string | – | Filter by external ID. |
| limit | integer | – | Maximum number of results to return. |
| offset | integer | – | Number of results to skip. |
| serial_number | string | – | Filter by serial number. |
| status | string | – | Filter by pass status. |
| template_id | string | – | Filter by template ID. |
| wallet_type | string | – | Filter by wallet platform type. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
listTemplates ~136
List templates Returns all templates for the current app. By default returns non-archived templates. Set `archived=true` to return only archived templates. **Scope:** `templates:manage` Maps to OpenAPI operationId `listTemplates` — GET /manage-templates. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| archived | boolean | – | When true, return only archived templates instead of active ones. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
listWebhookEvents ~157
List webhook events Returns a paginated list of webhook event delivery records for the current app. **Scope:** `org:read` Maps to OpenAPI operationId `listWebhookEvents` — GET /manage-org/webhook-events. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| delivery_status | string | – | Filter by delivery status. |
| event_type | string | – | Filter by event type. |
| limit | integer | – | Maximum number of results to return. |
| offset | integer | – | Number of results to skip. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
publishTemplate ~121
Publish a template Publishes a draft template, making it available for pass generation. Published templates cannot be modified. **Scope:** `templates:manage` Maps to OpenAPI operationId `publishTemplate` — POST /manage-templates/{id}/publish. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Template ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
revokeApiKey ~89
Revoke an API key Revokes an API key, making it inactive. Revoked keys cannot authenticate. **Scope:** `org:manage` Maps to OpenAPI operationId `revokeApiKey` — PATCH /manage-keys/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | API key ID. |
No output schema declared.
No examples provided.
testAppleCertificates ~134
Test Apple certificates Generates an ephemeral test `.pkpass` file to verify that the uploaded Apple signing certificates are valid and complete. The test pass is not stored — it is returned directly as a binary download. **Scope:** `certs:manage` Maps to OpenAPI operationId `testAppleCertificates` — POST /manage-certs/test. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
testGoogleConnection ~111
Test Google connection Tests the configured Google Wallet credentials by attempting to authenticate with the Google Wallet API. **Scope:** `certs:manage` Maps to OpenAPI operationId `testGoogleConnection` — POST /manage-certs/google/test. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
testWebhook ~110
Test the validation webhook Sends a sample validation webhook payload to the configured URL and returns the result. **Scope:** `org:manage` Maps to OpenAPI operationId `testWebhook` — POST /manage-org/app/test-webhook. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
updateApp ~302
Update app settings Updates the current app's settings, including webhook configuration. Set `regenerate_webhook_secret` to `true` to generate a new webhook signing secret; the new secret is returned in `webhook_secret_raw` (shown only once). **Scope:** `org:manage` Maps to OpenAPI operationId `updateApp` — PATCH /manage-org/app. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| apple_team_id | string | – | Apple Developer Team ID. |
| google_signing_mode | string | – | Google signing mode. `managed` uses platform credentials; `custom` uses your own. |
| name | string | – | App display name. |
| onboarding_completed | boolean | – | Whether onboarding has been completed for this app. |
| pass_type_identifier | string | – | Apple pass type identifier (e.g., pass.com.example.myapp). |
| regenerate_webhook_secret | boolean | – | Set to true to regenerate the webhook signing secret. |
| signing_mode | string | – | Apple signing mode. `managed` uses platform credentials; `custom` uses your own. |
| validation_webhook_url | string | – | URL for pre-generation validation webhooks. |
| webhook_url | string | – | URL for async event webhook delivery. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
updateOrganization ~120
Update organization settings Updates the current organization's settings, including APNs credentials. **Scope:** `org:manage` Maps to OpenAPI operationId `updateOrganization` — PATCH /manage-org. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| apns_key_id | string | – | Apple Push Notification service Key ID. |
| apns_key_p8 | string | – | APNs .p8 private key contents. |
| name | string | – | Organization display name. |
| slug | string | – | URL-friendly slug. |
No output schema declared.
No examples provided.
updatePass ~367
Update a pass Updates the dynamic data of an active pass. Optionally sends a push notification to registered devices so they fetch the updated pass. At least one of `data`, `expires_at`, `locations`, `relevant_date`, or `max_distance` is required. **Scope:** `passes:manage` Maps to OpenAPI operationId `updatePass` — PATCH /manage-passes/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | New dynamic field values to merge into the pass. |
| expires_at | string | – | Expiration timestamp (set to null to remove expiration). |
| id | string | yes | Pass ID. |
| locations | array | – | GPS locations where the pass is relevant (overrides template defaults). |
| max_distance | number | – | Maximum distance in meters from a location for lock screen relevance. |
| push_update | boolean | – | If true, send a push notification to registered devices. |
| relevant_date | string | – | ISO 8601 date when the pass is relevant (lock screen). |
| strip_image_id | string | – | Override the template's strip/hero image for this pass. The referenced image must belong to the same app and have purpose `strip` (or a `strip_*` variant). Applied to Apple `strip.png` and Google `he… |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
updatePassBySerial ~443
Update a pass by serial number Updates the dynamic data of an active pass looked up by serial number. Optionally sends a push notification to registered devices. At least one of `data`, `expires_at`, `locations`, `relevant_date`, or `max_distance` is required. When a serial has both Apple and Google passes, use `?wallet_type=` to select which one (defaults to `apple`). **Scope:** `passes:manage` Maps to OpenAPI operationId `updatePassBySerial` — PATCH /manage-passes/serial/{serial_number}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| data | object | – | New dynamic field values to merge into the pass. |
| expires_at | string | – | Expiration timestamp (set to null to remove expiration). |
| locations | array | – | GPS locations where the pass is relevant (overrides template defaults). |
| max_distance | number | – | Maximum distance in meters from a location for lock screen relevance. |
| push_update | boolean | – | If true, send a push notification to registered devices. |
| relevant_date | string | – | ISO 8601 date when the pass is relevant (lock screen). |
| serial_number | string | yes | Pass serial number (unique within app + wallet type). |
| strip_image_id | string | – | Override the template's strip/hero image for this pass. The referenced image must belong to the same app and have purpose `strip` (or a `strip_*` variant). Applied to Apple `strip.png` and Google `he… |
| wallet_type | string | – | Wallet type to look up when a serial number has both Apple and Google passes. Defaults to `apple` for backward compatibility. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
updateTemplate ~281
Update a template Updates a draft template. Published templates cannot be modified. **Scope:** `templates:manage` Maps to OpenAPI operationId `updateTemplate` — PATCH /manage-templates/{id}. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| background_image_id | string | – | – |
| description | string | – | – |
| field_schema | object | – | – |
| google_logo_image_id | string | – | – |
| google_pass_type | – | – | – |
| google_wide_logo_image_id | string | – | – |
| icon_image_id | string | – | – |
| id | string | yes | Template ID. |
| logo_image_id | string | – | – |
| name | string | – | – |
| pass_style | string | – | Apple Wallet pass style. |
| strip_image_id | string | – | – |
| structure | object | – | Complete pass structure. Drives both Apple `pass.json` emission and Google Wallet class/object JSON. Fields are grouped below by platform, but the single JSONB object carries all of them for dual-wal… |
| thumbnail_image_id | string | – | – |
| wallet_types | array | – | Wallet platforms this template supports. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
uploadCertificate ~130
Upload a single certificate Uploads a single PEM-encoded certificate or key. **Scope:** `certs:manage` Maps to OpenAPI operationId `uploadCertificate` — POST /manage-certs. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| cert_data | string | yes | Base64-encoded certificate or key data. |
| cert_type | string | yes | Type of certificate being uploaded. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
uploadGoogleCredentials ~143
Upload Google credentials Uploads Google service account credentials for Google Wallet pass signing. The service account JSON and issuer ID are stored securely. **Scope:** `certs:manage` Maps to OpenAPI operationId `uploadGoogleCredentials` — POST /manage-certs/google. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| issuer_id | string | yes | Google Wallet issuer ID. |
| service_account_json | object | yes | Google service account JSON key file contents. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
uploadImage ~397
Upload an image Uploads an image for use in pass templates or per-pass strip overrides. Send as multipart form data with a `purpose` field and a `file` field containing the PNG image. **Upload behaviour by purpose:** - `strip` — **accumulates**. Each upload creates a new image; the returned `id` can be passed as `strip_image_id` on `POST /v1/passes` or `PATCH /v1/passes/{id}` to give individual passes their own banner. Previous `strip` images are NOT deleted — manage them via `DELETE /v1/images/{id}` when no longer referenced. - All other purposes (`icon`, `logo`, `thumbnail`, `background`, `footer`, and all `_2x`/`_3x` variants) — **replace-on-upload**. Uploading a new image of the same purpose deletes the previous one from storage and DB. These are app-wide template assets, not per-pass. **Scope:** `images:manage` Maps to OpenAPI operationId `uploadImage` — POST /manage-images. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| file_base64 | string | yes | Base64-encoded file bytes. Maps to the OpenAPI multipart `file` field — same uploadImage (or equivalent) endpoint, not a new API. |
| filename | string | – | Optional filename sent with the multipart upload. |
| purpose | string | yes | The intended use of the image. `strip` uploads accumulate (for per-pass `strip_image_id` overrides); all other purposes replace existing uploads of the same purpose for the app. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
uploadP12Certificate ~181
Upload a .p12 certificate bundle Uploads a PKCS#12 (.p12) bundle containing signer certificate and private key. The bundle is decrypted with the provided password, and individual certificates are extracted and stored with AES-256-GCM encryption. **Scope:** `certs:manage` Maps to OpenAPI operationId `uploadP12Certificate` — POST /manage-certs/p12. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| p12_data | string | yes | Base64-encoded .p12 file data. |
| password | string | – | Password to decrypt the .p12 bundle (if password-protected). |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
voidPass ~163
Void a pass Marks a pass as invalidated and rebuilds the `.pkpass` file with Apple's `voided: true` flag. Registered devices are sent push notifications so the pass appears voided immediately in Apple Wallet. Rebuild failure is non-fatal — the pass is still invalidated at the DB level. **Scope:** `passes:manage` Maps to OpenAPI operationId `voidPass` — POST /manage-passes/{id}/void. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Pass ID. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
voidPassBySerial ~231
Void a pass by serial number Marks a pass (looked up by serial number) as invalidated and rebuilds the `.pkpass` file with Apple's `voided: true` flag. Registered devices are sent push notifications so the pass appears voided immediately in Apple Wallet. When a serial has both Apple and Google passes, use `?wallet_type=` to select which one (defaults to `apple`). **Scope:** `passes:manage` Maps to OpenAPI operationId `voidPassBySerial` — POST /manage-passes/serial/{serial_number}/void. Same PassFast HTTP API, billing, and rate limits. Do not invent other paths.
| Name | Type | Req | Description |
|---|---|---|---|
| serial_number | string | yes | Pass serial number (unique within app + wallet type). |
| wallet_type | string | – | Wallet type to look up when a serial number has both Apple and Google passes. Defaults to `apple` for backward compatibility. |
| x_app_id | string | – | Override X-App-Id for this call. Omit the connection header by default; set it only for multi-app orgs. |
No output schema declared.
No examples provided.
How do I install the PassFast MCP server?
PassFast is a hosted endpoint at https://passfa.st/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · passfa.st
claude mcp add --transport http st-passfa-passfast 'https://passfa.st/mcp'
What is the PassFast MCP server?
PassFast is an MCP server listed in the public MCP registry as st.passfa/passfast. Remote HTTPS MCP for Apple + Google Wallet passes. Paste sk_live_ once. This page covers its hosted endpoint (https://passfa.st/mcp).
Is the PassFast MCP server safe to use?
PassFast scores 25 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the PassFast MCP server expose?
PassFast exposes 47 tools: generatePass, getBatchGenerateLimits, batchGeneratePasses, listPasses, getPass, and 42 more. Their descriptions and schemas cost roughly 8,622 tokens of context every time the server is loaded.
Does the PassFast MCP server require authentication?
Its publisher declares that PassFast requires credentials, so you will need to authorise it in your MCP client. We have not been able to confirm that against the live endpoint.
Is the PassFast MCP server still maintained?
PassFast is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.