Spree Commerce: open-source B2B and marketplace ecommerce
Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.
Description from the maker (original English)
MCP server for Alternative Payments — customers, invoices, payment requests, payouts, webhooks.
These three are never merged into one score: opinions, measurements and popularity are different things.
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
Pick the AI app you use, then copy the settings.
ALTERNATIVE_PAYMENTS_CLIENT_ID, ALTERNATIVE_PAYMENTS_CLIENT_SECRET, ALTERNATIVE_PAYMENTS_ENVIRONMENT, MCP_TRANSPORT, AUTH_MODE, LOG_LEVELValues marked secret are keys to your account. Never share them or paste them into a chat.
You need
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"alternative-payments": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ALTERNATIVE_PAYMENTS_CLIENT_ID",
"-e",
"ALTERNATIVE_PAYMENTS_CLIENT_SECRET",
"-e",
"ALTERNATIVE_PAYMENTS_ENVIRONMENT",
"-e",
"MCP_TRANSPORT",
"-e",
"AUTH_MODE",
"-e",
"LOG_LEVEL",
"ghcr.io/wyre-technology/alternative-payments-mcp:v1.0.8"
],
"env": {
"ALTERNATIVE_PAYMENTS_CLIENT_ID": "your-value",
"ALTERNATIVE_PAYMENTS_CLIENT_SECRET": "your-value",
"ALTERNATIVE_PAYMENTS_ENVIRONMENT": "your-value",
"MCP_TRANSPORT": "your-value",
"AUTH_MODE": "your-value",
"LOG_LEVEL": "your-value"
}
}
}
}Run this in your terminal
claude mcp add alternative-payments --env ALTERNATIVE_PAYMENTS_CLIENT_ID=your-value --env ALTERNATIVE_PAYMENTS_CLIENT_SECRET=your-value --env ALTERNATIVE_PAYMENTS_ENVIRONMENT=your-value --env MCP_TRANSPORT=your-value --env AUTH_MODE=your-value --env LOG_LEVEL=your-value -- docker run -i --rm -e ALTERNATIVE_PAYMENTS_CLIENT_ID -e ALTERNATIVE_PAYMENTS_CLIENT_SECRET -e ALTERNATIVE_PAYMENTS_ENVIRONMENT -e MCP_TRANSPORT -e AUTH_MODE -e LOG_LEVEL ghcr.io/wyre-technology/alternative-payments-mcp:v1.0.8Fill in the empty values before running it.
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"alternative-payments": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ALTERNATIVE_PAYMENTS_CLIENT_ID",
"-e",
"ALTERNATIVE_PAYMENTS_CLIENT_SECRET",
"-e",
"ALTERNATIVE_PAYMENTS_ENVIRONMENT",
"-e",
"MCP_TRANSPORT",
"-e",
"AUTH_MODE",
"-e",
"LOG_LEVEL",
"ghcr.io/wyre-technology/alternative-payments-mcp:v1.0.8"
],
"env": {
"ALTERNATIVE_PAYMENTS_CLIENT_ID": "your-value",
"ALTERNATIVE_PAYMENTS_CLIENT_SECRET": "your-value",
"ALTERNATIVE_PAYMENTS_ENVIRONMENT": "your-value",
"MCP_TRANSPORT": "your-value",
"AUTH_MODE": "your-value",
"LOG_LEVEL": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Paste into .vscode/mcp.json in your project
{
"servers": {
"alternative-payments": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"ALTERNATIVE_PAYMENTS_CLIENT_ID",
"-e",
"ALTERNATIVE_PAYMENTS_CLIENT_SECRET",
"-e",
"ALTERNATIVE_PAYMENTS_ENVIRONMENT",
"-e",
"MCP_TRANSPORT",
"-e",
"AUTH_MODE",
"-e",
"LOG_LEVEL",
"ghcr.io/wyre-technology/alternative-payments-mcp:v1.0.8"
],
"env": {
"ALTERNATIVE_PAYMENTS_CLIENT_ID": "your-value",
"ALTERNATIVE_PAYMENTS_CLIENT_SECRET": "your-value",
"ALTERNATIVE_PAYMENTS_ENVIRONMENT": "your-value",
"MCP_TRANSPORT": "your-value",
"AUTH_MODE": "your-value",
"LOG_LEVEL": "your-value"
}
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
ALTERNATIVE_PAYMENTS_ENVIRONMENT envMCP_TRANSPORT envAUTH_MODE envLOG_LEVEL envThese settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
Runs on your computer; the tool list appears in your AI app after you install it.
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 9, 2026
The registry name was verified with the GitHub account wyre-technology, which owns the repo
We have not read this repo from GitHub yet
We have not read this repo from GitHub yet
This one runs on your computer; there is no internet endpoint
Runs on your computer and uses local settings instead
Runs on your computer; we can only read tool lists from internet endpoints
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
You need to fill in: ALTERNATIVE_PAYMENTS_CLIENT_ID, ALTERNATIVE_PAYMENTS_CLIENT_SECRET
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
The GitHub repo last changed –, and the latest version (1.0.8) reached the registry 3 months ago.
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Docker on your computer.
In the same category: Spree Commerce: open-source B2B and marketplace ecommerce, Stripe MCP, MCP Cn Commerce
Servers in the same category from other makers, sorted by stars.
Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.
Stripe’s official server lets AI view and manage customers, products, payments and invoices. Connect to Stripe’s cloud and sign in with OAuth.
8 read-only MCP platform entries; support is operation-specific; merchant live acceptance pending
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
A Model Context Protocol (MCP) server that gives AI assistants read + safe-write access to Alternative Payments — customers, invoices, payment requests, transactions, payouts, and webhooks.
Maintained by Wyre Technology.
This server deliberately does not move money. It exposes reads and safe writes (creating customers, invoices, and hosted payment links). It does not implement direct payment creation (POST /payments), which would charge a card or bank account.
The three destructive tools — ap_archive_customer, ap_archive_invoice, ap_delete_webhook — require interactive confirmation before they run.
| Domain | Tools |
|---|---|
| customers | ap_list_customers, ap_get_customer, ap_list_customer_users, ap_create_customer, ap_add_customer_user, ap_archive_customer ⚠ |
| invoicing | ap_list_invoices, ap_get_invoice, ap_get_invoice_payment_link, ap_get_invoice_pdf_link, ap_create_invoice, ap_create_payment_request, ap_get_payment_request, ap_archive_invoice ⚠ |
| payments | ap_list_transactions, ap_get_transaction, ap_list_payouts, ap_get_payout, ap_list_payout_transactions |
| webhooks | ap_list_webhooks, ap_list_webhook_events, ap_create_webhook, ap_retry_webhooks, ap_delete_webhook ⚠ |
Plus discovery tools ap_navigate and ap_status.
Alternative Payments uses OAuth 2.0 client-credentials. Generate an API key (client_id / client_secret) in the Partner Dashboard.
Copy .env.example. The stdio transport reads these variables and does not use CONDUIT_S2S_SECRET:
ALTERNATIVE_PAYMENTS_CLIENT_IDALTERNATIVE_PAYMENTS_CLIENT_SECRETALTERNATIVE_PAYMENTS_ENVIRONMENT (production or demo, default production)The server exchanges these for a bearer token automatically and refreshes it before expiry.
CONDUIT_S2S_SECRET is required when MCP_TRANSPORT=http. If it is empty, or a known placeholder (changeme, your-s2s-secret, secret, placeholder, and the other example values), the process logs an error and exits non-zero. It never prints the secret. Compose will not start when the variable is unset.
Set MCP_ALLOW_INSECURE_DEV=1 only for local development to start without the secret. The process logs a loud warning, does not check X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST (including 0.0.0.0) is ignored in that mode and the override is logged. A placeholder secret is still refused.
MCP_HTTP_HOST is honored when a real CONDUIT_S2S_SECRET is set. If MCP_HTTP_HOST is unset, the server keeps the historical default and binds 0.0.0.0. The container image and Compose set 0.0.0.0 and AUTH_MODE=gateway. Publish the port on loopback unless a proxy sits in front.
With a real secret, every /mcp request must include:
X-Gateway-S2S: t=<unix seconds>,v1=<hex hmac-sha256>
v1 is the hex HMAC-SHA256 of the ASCII string t= , keyed with CONDUIT_S2S_SECRET. The timestamp must be within 300 seconds of the server clock. A missing or invalid header returns 401 before vendor credentials are read.
AUTH_MODE=gateway)Every /mcp request must also include:
X-Alternative-Payments-Client-IDX-Alternative-Payments-Client-SecretX-Alternative-Payments-Environment (optional: production or demo)A request missing the client id or secret gets 401 and does not fall back to ALTERNATIVE_PAYMENTS_CLIENT_ID / ALTERNATIVE_PAYMENTS_CLIENT_SECRET in the process environment. The checked-in Compose service sets no static vendor credentials.
AUTH_MODE=env)/mcp still requires a valid X-Gateway-S2S header. Vendor credentials come from the ALTERNATIVE_PAYMENTS_* environment variables when the request does not carry the client-id and client-secret headers.
/health always returns 200. It does not require authentication and does not read vendor credentials.
Claude Code (CLI):
claude mcp add alternative-payments \
-e ALTERNATIVE_PAYMENTS_CLIENT_ID=your-client-id \ -e ALTERNATIVE_PAYMENTS_CLIENT_SECRET=your-client-secret \ -- npx -y github:WYRE-AI/alternative-payments-mcp
Docker (HTTP transport, gateway mode):
The image listens on 0.0.0.0 inside the container and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode, Alternative Payments credentials arrive on each request as headers; they are not read from the environment.
docker run --rm \
-p 127.0.0.1:8080:8080 \ -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \ ghcr.io/wyre-ai/alternative-payments-mcp:latest
Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, publishes 127.0.0.1:8080:8080, and does not inject static vendor credentials:
CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" docker compose up
The gateway signs each /mcp call:
t=$(date +%s)
sig=$(printf 't=%s' "$t" | openssl dgst -sha256 -hmac "$CONDUIT_S2S_SECRET" -hex | awk '{print $NF}') curl -sS -X POST http://127.0.0.1:8080/mcp \ -H "content-type: application/json" \ -H "accept: application/json, text/event-stream" \ -H "X-Gateway-S2S: t=${t},v1=${sig}" \ -H "X-Alternative-Payments-Client-ID: $ALTERNATIVE_PAYMENTS_CLIENT_ID" \ -H "X-Alternative-Payments-Client-Secret: $ALTERNATIVE_PAYMENTS_CLIENT_SECRET" \ -H "X-Alternative-Payments-Environment: production" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Single-tenant HTTP (AUTH_MODE=env) still requires the S2S secret, then uses ALTERNATIVE_PAYMENTS_CLIENT_ID and ALTERNATIVE_PAYMENTS_CLIENT_SECRET. This is separate from the gateway Compose service:
docker run --rm \
-p 127.0.0.1:8080:8080 \ -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \ -e AUTH_MODE=env \ -e ALTERNATIVE_PAYMENTS_CLIENT_ID="$ALTERNATIVE_PAYMENTS_CLIENT_ID" \ -e ALTERNATIVE_PAYMENTS_CLIENT_SECRET="$ALTERNATIVE_PAYMENTS_CLIENT_SECRET" \ ghcr.io/wyre-ai/alternative-payments-mcp:latest
Local HTTP without a secret is development-only. It binds 127.0.0.1 and logs a warning:
MCP_ALLOW_INSECURE_DEV=1 npm run start:http
node dist/index.js. Does not use CONDUIT_S2S_SECRET.MCP_TRANSPORT=http): streamable HTTP on MCP_HTTP_PORT (default 8080), with /mcp and /health endpoints. Each request gets a fresh stateless server, which is required for the WYRE MCP Gateway. Startup refuses to listen until CONDUIT_S2S_SECRET is a real secret, unless MCP_ALLOW_INSECURE_DEV=1.npm install
npm run build npm test npm run lint
Apache-2.0