MCP server
The SorenPay MCP server lets an AI assistant, such as Claude or Cursor, look at your SorenPay account for you. You can ask it questions like "How much can we spend right now?", "Which cards are frozen?" or "What did our agents spend on last week?". The assistant gets the answer straight from your account instead of you copying numbers into the chat.
MCP (Model Context Protocol) is an open
standard that AI assistants use to connect to outside tools. SorenPay
speaks it at POST https://sorenpay.com/api/mcp.
What an assistant can do today
Every tool is read-only. An assistant connected over MCP can look, but it can't move money, issue cards or change anything.
| Ask it… | Tool it uses | Key needs |
|---|---|---|
| "How much can we spend?" | get_treasury | read:treasury |
| "What came in and went out recently?" | get_recent_activity | read:treasury |
| "Which cards do we have? Which are frozen?" | list_cards | read:cards |
| "Which agents are set up?" | list_agents | read:agents |
| "Which checkout payments are still open?" | list_checkout_sessions | read:checkout |
Tools that act (issue a card, submit an agent payment, open a checkout session, send an international payment) are planned. They'll ask you to confirm before anything happens. Until then, use the REST API or the dashboard for those.
How it works
- You create an API key for your workspace (an
apk_…secret) with only the read scopes you want the assistant to have. - You add SorenPay to your assistant's MCP settings with that key.
- When you ask a question, the assistant calls a tool. SorenPay checks the key, checks it has the tool's scope, and answers with data from that workspace only.
Revoke the key and the assistant loses access straight away.
Technical summary
- Transport: JSON-RPC 2.0 over HTTP, one endpoint:
POST /api/mcp. Responses are plain JSON (no streaming). - Protocol version:
2024-11-05. Server namesoren-pay, version0.1.0. - Auth:
Authorization: Bearer apk_…, the same API keys as the REST API. - Methods:
initialize,tools/list,tools/call,ping,notifications/initialized. - Scopes: each tool needs one scope. A key without it gets a
missing_scope:<scope>error for that tool. A key with no scopes can't call any tool. - Stdio clients: Claude Desktop talks to local processes, so it connects
through a small bridge,
@sorenpay/mcp-bridge.
Next
- Set up Claude Desktop, Claude Code or Cursor
- Tool reference: every tool's inputs, output and an example
- JSON-RPC reference: methods and error codes
- Agents: let software spend (with its own card and limits), not just read