Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "agent": {
      "type": "http",
      "url": "https://imbawallet.com/mcp/spend",
      "headers": {
        "X-IMBA-Agent-Client-Id": "${X_IMBA_AGENT_CLIENT_ID}",
        "X-IMBA-Agent-Private-Key": "${X_IMBA_AGENT_PRIVATE_KEY}",
        "Authorization": "${X_IMBA_AGENT_PRIVATE_KEY}"
      }
    }
  }
}

claude mcp add --transport http agent https://imbawallet.com/mcp/spend --header "X-IMBA-Agent-Client-Id: ${X_IMBA_AGENT_CLIENT_ID}" --header "X-IMBA-Agent-Private-Key: ${X_IMBA_AGENT_PRIVATE_KEY}" --header "Authorization: ${X_IMBA_AGENT_PRIVATE_KEY}"

[mcp_servers.agent]
url = "https://imbawallet.com/mcp/spend"
env_http_headers = { "X-IMBA-Agent-Client-Id" = "X_IMBA_AGENT_CLIENT_ID", "X-IMBA-Agent-Private-Key" = "X_IMBA_AGENT_PRIVATE_KEY", "Authorization" = "X_IMBA_AGENT_PRIVATE_KEY" }

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "agent": {
      "type": "remote",
      "url": "https://imbawallet.com/mcp/spend",
      "enabled": true,
      "headers": {
        "X-IMBA-Agent-Client-Id": "{env:X_IMBA_AGENT_CLIENT_ID}",
        "X-IMBA-Agent-Private-Key": "{env:X_IMBA_AGENT_PRIVATE_KEY}",
        "Authorization": "{env:X_IMBA_AGENT_PRIVATE_KEY}"
      }
    }
  }
}

{
  "mcpServers": {
    "agent": {
      "type": "http",
      "url": "https://imbawallet.com/mcp/spend",
      "headers": {
        "X-IMBA-Agent-Client-Id": "${X_IMBA_AGENT_CLIENT_ID}",
        "X-IMBA-Agent-Private-Key": "${X_IMBA_AGENT_PRIVATE_KEY}",
        "Authorization": "${X_IMBA_AGENT_PRIVATE_KEY}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=agent&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vaW1iYXdhbGxldC5jb20vbWNwL3NwZW5kIiwiaGVhZGVycyI6eyJYLUlNQkEtQWdlbnQtQ2xpZW50LUlkIjoiJHtYX0lNQkFfQUdFTlRfQ0xJRU5UX0lEfSIsIlgtSU1CQS1BZ2VudC1Qcml2YXRlLUtleSI6IiR7WF9JTUJBX0FHRU5UX1BSSVZBVEVfS0VZfSIsIkF1dGhvcml6YXRpb24iOiIke1hfSU1CQV9BR0VOVF9QUklWQVRFX0tFWX0ifX0%3D"
}

{
  "servers": {
    "agent": {
      "type": "http",
      "url": "https://imbawallet.com/mcp/spend",
      "headers": {
        "X-IMBA-Agent-Client-Id": "${X_IMBA_AGENT_CLIENT_ID}",
        "X-IMBA-Agent-Private-Key": "${X_IMBA_AGENT_PRIVATE_KEY}",
        "Authorization": "${X_IMBA_AGENT_PRIVATE_KEY}"
      }
    }
  }
}

{
  "mcpServers": {
    "agent": {
      "httpUrl": "https://imbawallet.com/mcp/spend",
      "headers": {
        "X-IMBA-Agent-Client-Id": "${X_IMBA_AGENT_CLIENT_ID}",
        "X-IMBA-Agent-Private-Key": "${X_IMBA_AGENT_PRIVATE_KEY}",
        "Authorization": "${X_IMBA_AGENT_PRIVATE_KEY}"
      }
    }
  }
}

extensions:
  "agent":
    enabled: true
    name: "agent"
    type: streamable_http
    uri: "https://imbawallet.com/mcp/spend"
    headers:
      "X-IMBA-Agent-Client-Id": "${X_IMBA_AGENT_CLIENT_ID}"
      "X-IMBA-Agent-Private-Key": "${X_IMBA_AGENT_PRIVATE_KEY}"
      "Authorization": "${X_IMBA_AGENT_PRIVATE_KEY}"
    timeout: 300

Placeholders to fill from your own secret store: ${X_IMBA_AGENT_PRIVATE_KEY}, ${X_IMBA_AGENT_PRIVATE_KEY}. The registry never accepts secret values.

Quality 91 / 100strong

protocol88 · weight 25

pass
protocol.modernsupports 2026-07-28 (server/discover)
pass
protocol.statelessanswers without a session
pass
protocol.transportstreamable HTTP
warn
protocol.list_ttltools/list declares ttlMs 0, so clients re-fetch it on every use

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene86 · weight 30

pass
tools.descriptionsevery tool has a description
pass
tools.description_lengthdescriptions are concise
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations19 of 19 tools declare readOnlyHint or destructiveHint
fail
tools.directory_hintsno tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: get_deposit_address (openWorldHint); list_card_products (openWorldHint); create_card (openWorldHint); …
pass
tools.token_costabout 2,327 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump

stability100 · weight 15

pass
stability.changesno tool changes in 30 days
pass
stability.rug_pullno tool changed its meaning under the same name

dependencies100 · weight 15

pass
deps.known_vulnsno known advisory in 1 resolved packages
n/a
deps.mcp_sdk_versionthe official MCP SDK is not in the dependency graph
pass
deps.resolvable@imba_wallet/[email protected] resolved: 1 packages

19 tools, about 2,327 tokens to load them all · tool set b88f2ba232bd · checked 2026-10-20 10:35 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 97 / 100

provenance100

liveness100

freshness85

hygiene100

+repository +namespace-matches-repo +dns-namespace +website +reachable +uptime-99% ~updated-50d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Dependencies

@imba_wallet/[email protected] npm0 dependencies, resolved · advisories checked 2026-10-19

No known advisory affects this dependency graph.

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. The graph is what a clean install of this version resolves today; nothing was installed or run. How it is checked.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://imbawallet.com/mcp/spend` streamable-http	api_key `${X_IMBA_AGENT_PRIVATE_KEY}`	yes	99%	704 ms	2026-07-28	2026-10-20

package	registry	version	runtime	secrets
`@imba_wallet/agent-mcp`	npm	0.1.4	–	`IMBA_AGENT_PRIVATE_KEY`

Tools (19)

`create_card`destructive	Issue a Visa/MasterCard prepaid from this agent 2401 USDT so the agent can pay merchants that require a card (airlines, hotels, SaaS, datacenter/GPU clouds). POST /api/pin/create_card. ext_id required. imba_product_id is core.card_product.id. Never payment_source=stars. Never pass client_id. IMBA does not create the booking.
`get_balance`read-only	GET /api/balance. USDT is the spendable catalog currency.
`get_card_details`read-only	POST /api/pin/get_card_details for a card this agent owns. Needed to present PAN at merchant checkout (airline, datacenter, SaaS). PAN/CVV arrive as card_encrypted JWE when jwe_public_key is registered (PATCH webhook). Without that key the number is masked. Never logs raw PAN. cvv defaults true. Never pass client_id.
`get_deposit_address`	POST /api/deposit_address blockchain=tron. Address is issued for the authenticated agent only. Always re-fetch before send. Do not cache. USDT TRC-20 only. 24h unfunded hold.
`get_spend_policy`read-only	Forbidden rails and tier rules. Allowed catalog: Visa prepaid, travel eSIM, gift cards, paid KYT address screen. Read-only.
`kyt_check`destructive	Screen a crypto address for dirt (sanctions / mixer exposure). Use BEFORE you accept a TRC-20 send, or AFTER a wallet is blocked and the reason is unclear. POST /api/kyt_check. Body: network (tron_usdt \| eth \| btc) + address. Debits ~0.99 USDT from 2401. Returns a report — does not gate deposit, does not ban or unblock. TON is not in this catalog. Never pass client_id. Space ~1s.
`kyt_check_get`read-only	POST /api/kyt_check_get. Poll until the report is ready. Own check only (404 otherwise). Use after kyt_check when a wallet was blocked and you need the dirt report. Never pass client_id.
`kyt_checks`read-only	POST /api/kyt_checks. Own KYT history plus quote fields. Use to find a past address check. Space ~1s. Never pass client_id.
`kyt_quote`read-only	POST /api/kyt_quote. Price for a paid crypto-address screen (Didit). Debit is on kyt_check (~0.99 USDT from 2401), not on quote. Off unless didit.enabled and didit.agent_api. Does not gate TRON deposit. Not /api/client/kyt_* and not partner. Space ~1s.
`list_card_products`read-only	POST /api/card_products. Use id as imba_product_id for create_card (Visa prepaid). Space catalog calls ~1s apart.
`list_cards`read-only	POST /api/cards for the authenticated agent. No client_id argument.
`list_esim_plans`read-only	POST /api/esim/plans. Travel/data eSIM. esim_provider=yesim. Optional country ISO2. Use plan id with purchase_esim. Space catalog calls ~1s apart (agent catalog_gap).
`list_gift_offers`read-only	POST /api/offers. Live gift catalog (~20k positions / ~2k unique: Apple, Google Play, Steam, games, travel, retail). Optional query string. Then purchase_gift with offer_id + ext_id. Space catalog calls ~1s apart. Do not assume a SKU.
`list_notifications`read-only	POST /api/notifications. Poll this when a Visa payment asks for 3-D Secure. Agents keep payload.code (never SMS, never Telegram). category=codes for 3-D Secure OTP. Also delivered on webhook field otp if callback_url is set, and optional email. Space catalog calls ~1s apart.
`purchase_esim`destructive	POST /api/esim/new_plan5. Buy a travel/data eSIM plan from this agent 2401. Omit blank/null iccid so SQL takes the new-eSIM path. A set iccid must already belong to this agent. ext_id required. Never Stars.
`purchase_gift`destructive	POST /api/purchase. Buy a brand gift code (Apple, Steam, Google Play, … — live list). ext_id required. Never payment_source=stars.
`rotate_hmac`destructive	POST /auth/v1/agent/hmac/rotate. Previous HMAC dies immediately. Requires an existing callback_url (400 callback_url required before rotate otherwise). Pass callback_url here to PATCH webhook first. Plaintext HMAC is returned once — store it; never a Wallet JWT.
`set_webhook`	PATCH /auth/v1/agent/webhook. Sets https callback_url (required before hmac/rotate), optional X25519 jwe_public_key for card_encrypted, optional email for 3DS OTP. Not SMS. HMAC plaintext is shown once when a URL is first accepted.
`topup_card`destructive	POST /api/pin/topup_card from this agent 2401 USDT. card_id must belong to the same agent (SQL owner guard). ext_id required. Never Stars.

Schemas: list_tools.

Also listed as

1 other active names share this repository: com.imbawallet/agent-docs

Similar MCP servers

More from com.imbawallet

Official server.json

{
  "name": "com.imbawallet/agent",
  "title": "IMBA Agent Spend",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://imbawallet.com/mcp/spend",
      "type": "streamable-http",
      "headers": [
        {
          "name": "X-IMBA-Agent-Client-Id",
          "isRequired": true,
          "description": "Decimal agent client_id"
        },
        {
          "name": "X-IMBA-Agent-Private-Key",
          "isSecret": true,
          "isRequired": true,
          "description": "Operator Ed25519 private key, one HTTP header line (PEM with \\n or base64url). IMBA does not host a shared spend wallet."
        }
      ]
    }
  ],
  "version": "0.1.4",
  "packages": [
    {
      "version": "0.1.4",
      "transport": {
        "type": "stdio"
      },
      "identifier": "@imba_wallet/agent-mcp",
      "registryType": "npm",
      "environmentVariables": [
        {
          "name": "IMBA_AGENT_CLIENT_ID",
          "format": "string",
          "isRequired": true,
          "description": "Decimal agent client_id from register"
        },
        {
          "name": "IMBA_AGENT_PRIVATE_KEY",
          "format": "string",
          "isSecret": true,
          "isRequired": true,
          "description": "Ed25519 private key (PKCS#8 PEM or base64). Never a shared IMBA key."
        }
      ]
    }
  ],
  "repository": {
    "url": "https://github.com/IMBAwallet/IMBA_front",
    "source": "github"
  },
  "websiteUrl": "https://imbawallet.com/agent_api_about_en.html",
  "description": "IMBA spend MCP: USDT TRC-20 deposit and catalog buy with your key. No withdraw."
}