Mastercard Developers
Read Mastercard's API catalog, documentation and integration guides from an AI agent. All nine tools are read-only and cannot move money, create a transaction or issue a payment credential. No sign-in required.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Mastercard Developers via MCP
https://developer.mcp.mastercard.com/Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Mastercard Developers Tools & Capabilities (9)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- The hosted endpoint was down when we checked. Every request to
https://developer.mcp.mastercard.com/returned HTTP 504 from AkamaiGHost on 2026-08-22 — across the root,/mcp,/sseand/message, on three separate attempts, and on GET as well as POST. A nonsense control path returned the identical error, so this is an edge gateway failing to reach the origin, not a routing mistake on our side. The local npm package was unaffected. - We could not verify the auth posture over the wire. Because of that outage, no handshake succeeded and no RFC 9728 descriptor was readable. "No authentication" is Mastercard's documented instruction and the directory's
is_authlessflag — both are evidence about the posture, not our observation of it, so this page does not record the auth mode as verified. - No OAuth scopes exist, because there is no OAuth. There is no consent screen and no grant to narrow. That is not a boundary weakness here — with nine read-only tools against public documentation, there is nothing a scope would usefully separate.
- Tool annotations come from source, not from a live handshake. We read
readOnlyHintanddestructiveHintin the published repository at commit24df3ad, dated 2026-05-16. The deployed remote server may run a different build, and we could not confirm which. - The nominated documentation URL renders nothing to a fetcher. It returns a 1,629-byte JavaScript shell with no embedded payload — 2 words of text. The readable documentation lives at the same path with
index.mdappended.llms-full.txtis sign-in walled, andsitemap.xmlreturns 401. - The site-wide
llms.txtdoes not mention MCP at all. It is a 21,000-word catalog of Mastercard's products and services with no reference to the agent toolkit or any tool name, so it is useless as a second enumeration despite being the largest doc route. - Documentation accuracy depends on Mastercard's published pages. The connector returns what
developer.mastercard.comserves. Generated code samples should be verified against the API reference before use, particularly for OAuth 1.0a request signing. - We never called a tool. Every finding here comes from reading published source, documentation and the directory snapshot, plus unauthenticated probes of the endpoint.
Frequently asked questions
No. All nine tools read documentation and API specifications, and none initiates a transaction. Mastercard's published client source pins every request to the GET method against developer.mastercard.com, so no tool can write anywhere. The connector describes Mastercard's payment APIs; it does not call them.
No. The tools fetch public developer documentation, OpenAPI specifications and integration guides from developer.mastercard.com, which requires no sign-in. There is no account, no card number and no transaction record in the surface, so nothing it returns falls in PCI scope. It reads reference material, not production data.
Because the method is a lookup key, not a verb it will send. The tool takes an HTTP method and a path to identify which operation in an OpenAPI specification to describe. Mastercard's client forwards both as query-string filters on a GET request, so asking about DELETE /accounts returns that operation's schema.
No. Mastercard's own setup documentation instructs users to select No Authentication when adding the connector, and the directory records the server as authless. We could not confirm this over the wire because the endpoint returned an Akamai gateway error on every request we made on 2026-08-22.
Nine, and this is one of the rare cases where that count is firm. Mastercard publishes the tool registry in its open-source repository, and the nine exported names match Anthropic's directory listing exactly, character for character. The documentation table lists the same nine, with one typo.
It is Mastercard's package for connecting AI assistants to its developer platform. It ships two things: a hosted remote MCP server, and an npm SDK that runs the same nine tools locally. Despite the name, it generates no per-account tools, so the reachable operation count equals the tool count.
No. Every request goes to developer.mastercard.com without credentials, so the server reaches exactly what an anonymous browser reaches. Pages behind Mastercard's developer sign-in return an authentication error to the connector as they would to anyone. It cannot widen its own access.
Pass --service or --api-specification when running the local npm server. Mastercard documents that either flag scopes the agent to one service's documentation, that --api-specification wins when both are set, and that setting either disables get-services-list. The hosted remote server accepts no such flags.
Sources
- Mastercard Developers Agent Toolkit documentation (retrieved 2026-08-22). Readable Markdown at the same path plus
index.md. · retrieved 2026-08-22 - Mastercard Model Context Protocol overview, including the vendor's own tool table (retrieved 2026-08-22) · retrieved 2026-08-22
- Mastercard MCP SDK guide (retrieved 2026-08-22) · retrieved 2026-08-22
- Mastercard developers-agent-toolkit repository, tool registry and HTTP client, commit
24df3adbe6378a652ecea96a636350d68bb5b57edated 2026-05-16 (retrieved 2026-08-22) · retrieved 2026-05-16 - npm package
@mastercard/developers-mcpversion 0.1.7, read from the registry metadata at (retrieved 2026-08-22). The npmjs.com web page for the same package returned a Cloudflare bot interstitial to our client and was not read. · retrieved 2026-08-22 - Mastercard Developers platform catalog,
llms.txt(retrieved 2026-08-22) · retrieved 2026-08-22 - Mastercard Developers
robots.txt, which disallows only/media/and a download API and carries no Content-Signal directive (retrieved 2026-08-22) · retrieved 2026-08-22 - Live endpoint probe of
https://developer.mcp.mastercard.com/— HTTP 504 from AkamaiGHost on all paths and methods tried, with a nonsense control returning the same (2026-08-22) · retrieved 2026-08-22 - Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-16 · retrieved 2026-08-16
- Mastercard Developers support — · Privacy policy as linked by the directory entry (returned an Akamai access-denied to our client on 2026-08-22 and was not read; listed for reference, not cited for any claim) · retrieved 2026-08-22
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Finance
- Developer
- Mastercard Developers
- Tools
- 9
- Domain
- developer.mcp.mastercard.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.