PayPay MCP · Product marque
PayPay is the most ubiquitous QR wallet in Japan. Tens of millions of users, accepted almost everywhere. When AI agents start doing real commerce on behalf of real people, they need a typed interface to move real money through real payment rails. No one had shipped an MCP for PayPay yet. So I built one.
The consumer is an agent, not a person. Tool names, parameter descriptions, defaults, and the README are the entire UI. There is nothing else to fall back on. An agent reads the contract and acts on it literally.
The API surface is the UI
Tool names are buttons. Parameter descriptions are tooltips. Defaults are first-screen state. I named the six tools for intent, not endpoint paths. create_qr_code returns a payment URL and PNG. wait_for_payment polls until the transaction reaches a terminal state. Descriptions are written for the LLM reading them, specifying expected use and common mistakes. The agent reads the contract and acts.
Safe by default, dangerous by opt-in
Payment APIs move real money. I shipped refund_payment and cancel_payment disabled by default. They activate only when a developer explicitly flips a config flag. The default install cannot accidentally move funds. Dangerous capabilities are a deliberate opt-in, not a footnote in the docs. The first-run experience is safe to test, safe to break.
Sandbox-first
Every example in the README, every default in the code, every quickstart points at PayPay's sandbox environment. Production credentials are an explicit second step. The fastest path to a working install is also the safest one. Developers opt in to real money on purpose, not by accident.
Open source on GitHub. Published on npm. Built on PayPay's official Open Payment API. About 247 monthly downloads as of April 2026. Scaffolded with Claude Code. Tool design, iteration, and every ship decision are mine.
npm · paypay-mcp GitHubAgents take defaults literally. They don't hesitate. They don't notice warnings. So the first design decision for a payment tool is what happens when nothing is configured. Default to sandbox and keep the dangerous tools behind an explicit flag.