Yolfi Payments MCP
NPM · @YOLFI/AGENT · 2 COMPONENTS
Let AI agents add Yolfi crypto checkout, paylinks, webhooks, and status checks.
Available components
Last scanned (22 hours ago)
Scores higher than 69% of npm servers
Category Crypto and Web3
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability64
- 42% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2012 tokens (~77/item across 26 items; 19 tools + 7 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 0
- Security disclosure: unverified → fail ▼ functional
- 31 Oct 26 0
- Stability: 0.97 → pass security
- Security disclosure: fail → unverified ▼ functional
- 30 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 0
- Stability: 0.97 → pass security
- 23 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 0
- Stability: 0.97 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/@yolfi/agent@0.2.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
yolfi_agent_checkin Check In Yolfi Agent Setup ~78
Check whether browser authorization finished. On success, securely stores the returned yolfi_agent_* credential for later local SDK, CLI, and MCP calls.
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | Stable lowercase slug used for yolfi_agent_setup_start. |
| agentId | string | – | Compatibility alias for agent. Use agent for new integrations. |
No output schema declared.
No examples provided.
yolfi_agent_register Create Yolfi Account For User ~294
Start signup for a new Yolfi user from a user-confirmed email. The first call sends a confirmation link and stores protected check-in state; call the same tool again after confirmation to store the one-time credential without exposing it.
| Name | Type | Req | Description |
|---|---|---|---|
| agentName | string | yes | Name of the coding agent or MCP host, for example Codex, Claude Code, Cursor, or OpenClaw. |
| string | yes | New Yolfi account email explicitly confirmed by the user. Existing Yolfi account emails are rejected and must use OAuth or browser setup. | |
| idempotencyKey | string | – | Optional retry key. Reuse the same value when calling this tool after email confirmation; a UUID is generated and persisted when omitted. |
| integrationIntent | string | – | User-approved reason for the integration. Defaults to accept_payments when omitted. |
| language | string | – | Optional preferred language code for agent-facing responses. |
| metadata | object | – | Optional safe non-secret metadata. Do not include API keys, wallet private keys, tokens, or personal secrets. |
| projectName | string | yes | User-approved product or project name for the Yolfi workspace. |
| projectUrl | string | – | Optional public or local URL of the target product, if known. |
| ref | string | – | Optional source tag such as mcp, glama, npm, docs, codex, claude-code, or cursor. |
No output schema declared.
No examples provided.
yolfi_agent_setup_start Start Yolfi Agent Setup ~92
Start the preferred browser-based Yolfi authorization flow. Returns a login URL and stores only a short-lived check-in token in the protected local Yolfi config.
| Name | Type | Req | Description |
|---|---|---|---|
| agent | string | – | Stable lowercase slug for the MCP host, for example codex, claude-code, cursor, or local-agent. |
| agentId | string | – | Compatibility alias for agent. Use agent for new integrations. |
No output schema declared.
No examples provided.
yolfi_auth_status Check Yolfi Auth Status ~38
Verify the active OAuth, local agent, or API-key credential and return the current Yolfi organization context before mutating payment settings.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
yolfi_organization_get Get Yolfi Organization ~32
Read the current Yolfi organization settings, including webhook and settlement configuration visible to this API key.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
yolfi_organization_update Update Yolfi Organization ~70
Update organization profile fields through the existing Yolfi organization endpoint. Do not invent merchant identity, support email, or settlement settings.
| Name | Type | Req | Description |
|---|---|---|---|
| string | – | Merchant support or account email approved by the user. | |
| name | string | – | Merchant or project display name approved by the user. |
No output schema declared.
No examples provided.
yolfi_paylinks_create Create Yolfi Paylink ~270
Create a Yolfi payment link only after the user approves product name, amount, currency, and one-time or recurring payment type.
| Name | Type | Req | Description |
|---|---|---|---|
| collectAddress | boolean | – | Whether checkout should collect the customer address. |
| collectDateOfBirth | boolean | – | Whether checkout should collect the customer date of birth. |
| collectEmail | boolean | – | Whether checkout should collect customer email. |
| collectName | boolean | – | Whether checkout should collect the customer name. |
| collectPhoneNumber | boolean | – | Whether checkout should collect the customer phone number. |
| currency | string | – | Account currency code. Supported values are USD, EUR, and CNY. |
| description | string | – | Optional user-approved customer-facing description. |
| imageUrl | string | – | Optional public product image URL shown on checkout. |
| metadata | object | – | Safe non-secret metadata such as source, productSlug, planId, or environment. |
| name | string | yes | User-approved product, plan, donation, or access name shown on checkout. |
| price | string | yes | User-approved decimal price, represented as a string to avoid numeric rounding. |
| recurringInterval | string | – | Recurring billing interval when type is RECURRING. |
| type | string | – | Payment link type: ONE_TIME or RECURRING. |
No output schema declared.
No examples provided.
yolfi_paylinks_disable Disable Yolfi Paylink ~57
Disable a paylink. This is destructive and must only run after explicit user confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | – | yes | Must be true only after explicit user confirmation. |
| id | string | yes | Yolfi paylink ID to disable. |
No output schema declared.
No examples provided.
yolfi_paylinks_get Get Yolfi Paylink ~57
Get private paylink details by ID for verification, checkout wiring, or duplicate detection.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Yolfi paylink ID returned by yolfi_paylinks_create or yolfi_paylinks_list. |
No output schema declared.
No examples provided.
yolfi_paylinks_list List Yolfi Paylinks ~63
List existing Yolfi paylinks before creating new ones so agents can avoid duplicates after retries or timeouts.
| Name | Type | Req | Description |
|---|---|---|---|
| page | number | – | Page number. Defaults to 1. |
| rows | number | – | Rows per page. Defaults to 10. |
No output schema declared.
No examples provided.
yolfi_payments_create Create Yolfi Public Payment ~239
Create a public payment invoice from an existing paylink for checkout integration, testing, or customer flow setup.
| Name | Type | Req | Description |
|---|---|---|---|
| clientReferenceId | string | – | Optional merchant reference for the customer or order; returned as customer.clientReferenceId in webhook payloads. |
| customerAddress | string | – | Optional customer address. |
| customerDateOfBirth | string | – | Optional customer date of birth. |
| customerEmail | string | yes | Customer email required for checkout and payment receipts. |
| customerName | string | – | Optional customer name. |
| customerPhone | string | – | Optional customer phone number. |
| language | string | – | Optional checkout language code supported by Yolfi. |
| metadata | object | – | Safe non-secret metadata for the target app payment flow. |
| network | string | yes | Blockchain network identifier supported by the Yolfi organization, for example ARB. |
| paylinkId | string | yes | Yolfi paylink ID used to create the customer payment. |
| subscriptionId | string | – | Optional existing subscription ID to associate the payment with. |
| symbol | string | yes | Payment token symbol supported on the selected network, for example USDC. |
No output schema declared.
No examples provided.
yolfi_payments_status Get Yolfi Payment Status ~50
Get public payment status by ID. Do not treat a frontend redirect as proof of payment.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Yolfi payment ID returned by yolfi_payments_create. |
No output schema declared.
No examples provided.
yolfi_settlement_configure Configure Yolfi Settlement Wallets ~62
Configure settlement wallets after the user provides wallet addresses, networks, and enabled tokens. Never invent wallet addresses.
| Name | Type | Req | Description |
|---|---|---|---|
| settlementAccounts | array | yes | Settlement account objects accepted by the Yolfi organization endpoint. Example fields: id, address, tokens. |
No output schema declared.
No examples provided.
yolfi_webhooks_configure Configure Yolfi Webhooks ~125
Configure webhook delivery for the target app. The host must not invent backend URLs and must ensure the app verifies X-Yolfi-Signature.
| Name | Type | Req | Description |
|---|---|---|---|
| adapter | string | – | Webhook adapter output format. Defaults to NONE if omitted. |
| metadataFilters | object | – | Optional flat key/value metadata filters. A delivery must match every configured string value. |
| name | string | – | Endpoint display name, for example Merchant analytics. |
| url | string | yes | HTTPS webhook URL in the target app, for example https://example.com/api/yolfi/webhook. |
No output schema declared.
No examples provided.
yolfi_webhooks_delete Delete Yolfi Webhook Endpoint ~52
Delete an unused webhook endpoint or disable it when existing delivery history must be retained.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | – | yes | Must be true only after explicit user confirmation. |
| id | string | yes | Webhook endpoint id. |
No output schema declared.
No examples provided.
yolfi_webhooks_list List Yolfi Webhook Endpoints ~23
List all independent webhook endpoints configured for the current organization.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
yolfi_webhooks_rotate_secret Rotate Yolfi Webhook Signing Secret ~61
Rotate an endpoint-specific webhook signing secret and store it in the protected local Yolfi config without returning the plaintext secret.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | – | yes | Must be true only after explicit user confirmation. |
| id | string | yes | Webhook endpoint id. |
No output schema declared.
No examples provided.
yolfi_webhooks_update Update Yolfi Webhook Endpoint ~111
Update the name, URL, adapter, or enabled state of one independent Yolfi webhook endpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| adapter | string | – | Webhook adapter output format. |
| enabled | boolean | – | Whether this endpoint receives new deliveries. |
| id | string | yes | Webhook endpoint id. |
| metadataFilters | object | – | Optional flat key/value metadata filters. A delivery must match every configured string value. |
| name | string | – | Endpoint display name. |
| url | string | – | HTTPS webhook URL. |
No output schema declared.
No examples provided.
yolfi_webhooks_verify Verify Yolfi Webhook Signature ~99
Verify an X-Yolfi-Signature HMAC over the raw JSON webhook payload before trusting payment events.
| Name | Type | Req | Description |
|---|---|---|---|
| endpointId | string | – | Webhook endpoint id whose signing secret was stored locally during create or rotate. YOLFI_WEBHOOK_SECRET takes precedence when set. |
| payload | string | yes | Raw webhook request body string, before JSON parsing. |
| signature | string | yes | X-Yolfi-Signature header value. |
No output schema declared.
No examples provided.
How do I install the Yolfi Payments MCP server?
Yolfi Payments MCP runs locally as an npm package, launched with npx -y @yolfi/agent. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @yolfi/agent
claude mcp add yolfinance-yolfi-agent -- npx -y @yolfi/agent
What is the Yolfi Payments MCP server?
Yolfi Payments MCP is listed in the public MCP registry as io.github.yolfinance/yolfi-agent. Let AI agents add Yolfi crypto checkout, paylinks, webhooks, and status checks. This page covers its npm package (@yolfi/agent).
Is the Yolfi Payments MCP server safe to use?
Yolfi Payments MCP scores 81 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Yolfi Payments MCP server expose?
Yolfi Payments MCP exposes 19 tools: yolfi_agent_setup_start, yolfi_agent_checkin, yolfi_agent_register, yolfi_auth_status, yolfi_organization_get, and 14 more. Their descriptions and schemas cost roughly 1,873 tokens of context every time the server is loaded.
Is the Yolfi Payments MCP server still maintained?
Yolfi Payments MCP is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Yolfi Payments MCP server under?
Yolfi Payments MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.