mpesa-mcp

mpesa-mcpwas updated in response toNSA CSI U/OO/6030316-26 (May 2026)— the NSA Artificial Intelligence Security Center's Cybersecurity Information Sheet on Model Context Protocol security.

The implementation below documents compliance against the NSA's MCP security framework, control by control.

Set these environment variables before starting the server:

# M-Pesa (Safaricom Daraja) MPESA_CONSUMER_KEY=your_consumer_key MPESA_CONSUMER_SECRET=your_consumer_secret MPESA_SHORTCODE=174379 # sandbox test shortcode MPESA_PASSKEY=your_passkey MPESA_CALLBACK_URL=https://yourdomain.com/mpesa/callback MPESA_SANDBOX=true # set false for production # Africa's Talking AT_USERNAME=sandbox # your AT username (sandbox for testing) AT_API_KEY=your_at_api_key

- Test shortcode:174379
- Test passkey:bfb279f9aa9bdbcf158e97dd71a467cd2e0c893059b10f78e6b72ada1ed2c919

Add to~/Library/Application Support/Claude/claude_desktop_config.json(macOS):

Claude Desktop and other MCP clients will request confirmation before triggering payment, SMS, or airtime operations.

# Check capabilities curl https://raw.githubusercontent.com/gabrielmahia/mpesa-mcp/main/.well-known/mcp.json

The MCP ecosystem benchmark (CData, 2026) found most MCP servers accurate 60–75% of the time on complex queries — particularly silent failures on write operations and partial parameter application.

mpesa-mcp is tested against all three Kenyan phone number formats, boundary amount values, and missing optional fields:

pytest tests/ -v # run full suite pytest tests/test_phone_formats.py # format normalization pytest tests/test_boundary_amounts.py # min/max amount edge cases

Write operations (STK push, SMS, airtime) have explicit validation before any API call is made.

Mojaloop(funded by the Gates Foundation) handles paymentinteroperability— connecting banks, mobile money wallets, and merchants across DFSPs in East Africa and beyond.

mpesa-mcphandles theAI agent tooling layer— enabling AI coding assistants to trigger and query M-Pesa payments programmatically.

- Mojaloop: the interoperability rails between financial providers
- mpesa-mcp: the MCP interface layer that connects AI agents to those rails

mpesa-mcp implementsMCP(Model Context Protocol) — how an AI agent talks to tools.

There is a complementary protocol,A2A(Agent-to-Agent), which handles how agents talk toeach other. They solve different problems and work together:

- MCP: Your AI agent → mpesa-mcp → Daraja API / Africa's Talking
- A2A: Orchestrator agent ↔ payment sub-agent ↔ notification sub-agent

For most integrations you only need MCP. A2A becomes relevant when you're building multi-agent systems where a payment workflow coordinates with other specialized agents.

MCP ecosystem benchmark(CData, 2026): Most MCP servers achieve 60-75% accuracy on complex queries. mpesa-mcp includes explicit validation and bounds checking to exceed this baseline.

Swahili AI accuracy(arXiv:2509.04516, 2025): AI models produce 4× more errors in Swahili than English. mpesa-mcp's Swahili-native tool descriptions are designed to minimize this gap for Swahili-speaking users by eliminating the translation step in tool selection.

MCP security research(arXiv:2603.18063, arXiv:2603.21642, 2026): Prompt injection via tool descriptions is the primary MCP attack vector. mpesa-mcp mitigates this through static, versioned tool descriptions and strict input validation.

Or watch this repo on GitHub for release notifications.

All MIT · All part of the East African civic AI stack

Part of the East Africa Coordination Stack

Part of the East Africa coordination stack

Model-agnostic by design: closed APIs, open-weight models, and small distilled models are all first-class citizens.

A public MCP server that gives AI agents access to real UK carrier phone numbers for SMS verification. Agents can rent disposable or rental numbers, pay Lightning invoices, and read incoming SMS, all through standard MCP tool calls with no authentication required.

Enables seamless integration with communication platform that allows you to reach your customers globally across any channel.

Platfone - Receive SMS & Virtual Numbers MCP

Virtual phone number platform for AI agents — rent numbers across 200+ countries, receive SMS, and manage the full activation lifecycle

Plug unlimited SMS, OTP verification, and inbound webhooks into your AI coding assistant using your paired Android phone as the gateway. Same SMS8 API key, JSON-RPC tools for every flow. No Twilio, no A2P 10DLC, no per-message fees.

Wavix is a global communications platform offering APIs for voice, SMS, 2FA, and phone numbers. Our MCP server brings these capabilities to AI agents and agentic workflows.

Remote MCP server (Streamable HTTP, read-only, no auth) at https://doc.2328.io/mcp — integration documentation for the 2328 payment platform.

Self-hosted email and SMS platform for AI agents — each agent gets a real email address, phone number, inbox, and API key.

Send SMS messages using the Aligo SMS API.

Secure agent purchasing with human-approved virtual cards.