Shatale MCP Server

What's New

v0.2.4

npx compatibility fix — proper shebang for reliable npx shatale-mcp-server execution
58 E2E tests — comprehensive coverage across guest, sandbox, and edge-case scenarios
3-tier CI pipeline — public (no key), sandbox (API key), and nightly (full regression)

Quick Start

Up and running in 3 steps

Install

Runs in guest mode out of the box — no API key needed to explore.

$ npx shatale-mcp-server

Configure your IDE

Add Shatale to your AI coding assistant. Pick your editor:

// claude_desktop_config.json { "mcpServers": { "shatale": { "command": "npx", "args": ["shatale-mcp-server"], "env": { "SHATALE_API_KEY": "your-sandbox-key" } } } }

// .cursor/mcp.json { "mcpServers": { "shatale": { "command": "npx", "args": ["shatale-mcp-server"], "env": { "SHATALE_API_KEY": "your-sandbox-key" } } } }

// ~/.windsurf/mcp.json { "mcpServers": { "shatale": { "command": "npx", "args": ["shatale-mcp-server"], "env": { "SHATALE_API_KEY": "your-sandbox-key" } } } }

$ claude mcp add shatale -- npx shatale-mcp-server

// .vscode/mcp.json { "servers": { "shatale": { "command": "npx", "args": ["shatale-mcp-server"], "env": { "SHATALE_API_KEY": "your-sandbox-key" } } } }

// ~/.config/zed/settings.json → "context_servers" { "context_servers": { "shatale": { "command": { "path": "npx", "args": ["shatale-mcp-server"], "env": { "SHATALE_API_KEY": "your-sandbox-key" } } } } }

// ~/.continue/config.yaml mcpServers: - name: shatale command: npx args: - shatale-mcp-server env: SHATALE_API_KEY: your-sandbox-key

Try it

Ask your AI agent to do something with payments:

▸ "Create a shopping agent with a €1,000 budget"

▸ "Simulate a €150 Nike purchase"

Tools

What your agent can do

Two modes: explore without signing up, or unlock the full sandbox with a free API key.

No key required

Guest Mode

4 tools — explore without signing up

explain_shatale Learn what Shatale is and how it works

simulate_purchase_flow See what happens when an agent tries to buy something

list_mcc_codes Browse merchant category codes for policy rules

generate_policy_template Generate a spending policy from a use case

search_merchants Search the merchant catalog by category, capability, or keyword

get_merchant_details Get MCP config and capabilities for a specific merchant

list_capabilities See all available features and payment options

API key

Production Mode

20+ tools — full payment lifecycle

request_purchase Buy something for a user — handles onboarding, approval, and payment. Supports user_hint for new users.

register_user_profile Pre-register a user with claims (email, name, country). User verifies via hosted page.

preview_purchase Check if a purchase would be approved before committing

get_purchase_status Poll for approval status, onboarding progress, and payment credentials

cancel_purchase Cancel a pending purchase request

get_onboarding_status Check user registration and verification progress

request_temporary_credentials Get login credentials for a merchant site

get_credential_status Check if temporary credentials are ready

Guest mode requires no signup. Sandbox mode needs a free API key.

Use Cases

What developers are building

🛒

AI Shopping Agents

Give your shopping bot a card with built-in guardrails. Block gambling, limit per-transaction to €500, cap monthly spend at €1,000.

"Create a shopping agent with €1,000/month budget, block gambling MCCs, max €500 per transaction"

✈️

Travel Booking

Restrict to airlines and hotels only. Set a €5,000/month budget with per-transaction limit of €2,000.

"Issue a travel card — airlines and hotels only, €5,000/month, max €2,000 per booking"

🏢

Procurement

Department-level budgets with approved vendor MCCs only. Full audit trail for every authorization.

"Set up procurement cards for the engineering team — software and cloud services MCCs only"

💳

Expense Management

Employee cards with daily limits. Block alcohol and tobacco MCCs. Real-time spend visibility.

"Create an employee expense card — €200/day, no alcohol or tobacco merchants"

Security

Built for safety

🔒

Sandbox only

Production API keys are rejected. The MCP server only works with sandbox credentials.

👃

No card data exposed

PAN and CVV are never visible to the AI agent. Card details stay in the secure vault.

🖥

Local transport

Runs as stdio — no network server, no open ports. Communication stays on your machine.

Read the full security model in SECURITY.md on GitHub.