# Xaalis

> Wave and Orange Money payments in Senegal: payment links, refunds, subscriptions, agent payouts.

- name: org.xaalis/mcp
- version: 0.1.0
- connection class: R0 (autonomous)
- trust: 81/100 flags: no-repository
- quality: 93/100 (strong)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/org.xaalis%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/org.xaalis%2Fmcp/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "xaalis": {
      "type": "http",
      "url": "https://mcp.xaalis.org/sandbox"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 96
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-91% +updated-12d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 93/100 (strong)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: 100 (weight 15)

- pass `auth.prm`: Protected Resource Metadata (RFC 9728) published
- pass `auth.as_metadata`: authorization server metadata reachable
- pass `auth.cimd`: Client ID Metadata Documents supported
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 28 of 28 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 5,099 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name
- pass `stability.new_links`: no tool change named a new site

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 28, about 5,099 tokens to load them all
- tool set hash: 2601fed5fce1395bdd9561bf92ac3c6e
- badge: [![protogrid quality](https://protogrid.dev/badge/org.xaalis/mcp.svg)](https://protogrid.dev/servers/org.xaalis/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://mcp.xaalis.org/mcp (streamable-http, auth oauth2, reachable false, uptime30d 0.90909094)
- https://mcp.xaalis.org/sandbox (streamable-http, auth none, reachable true, uptime30d 0.9111111)

## Packages

_none_

## Tools (28)

- `xaalis_advance_subscription`: Sandbox only: jump to the subscription's next billing event (next invoice, due date or end of grace) to test renewals without waiting.
- `xaalis_cancel_subscription`: Cancel now (voids the unpaid invoice if checkout hasn't started) or at the end of the current period.
- `xaalis_create_agent_wallet`: Sandbox: create a spending wallet for an AI agent, with a per-payout cap and the only phone numbers it may pay. Fund it, then issue its ak_test_ key. In production a human sets up agent wallets.
- `xaalis_create_payment`: Create a payment and get a hosted checkout_url to send to the customer (Wave or Orange Money). The payment is NOT paid until its status is 'succeeded' — check with xaalis_get_payment or a signed webhook, never the customer's redirect.
- `xaalis_create_payout`: Sandbox only with a merchant key: send money from the merchant balance to a Wave or Orange Money number. In production, agents pay out only through an agent wallet key (ak_) with limits set by a human.
- `xaalis_create_subscription`: Bill a customer every day/week/month/year. Invoice 0 is issued at once: send its hosted_invoice_url (in latest_invoice) to the customer. Set billing_cycles (2–24) for an instalment plan that ends by itself.
- `xaalis_disable_agent_wallet`: Stop an agent wallet: its keys can no longer start payouts. Payouts already accepted finish normally. Safe to repeat.
- `xaalis_fund_agent_wallet`: Sandbox: move money from the merchant balance into an agent wallet. The wallet's balance is the agent's total spend limit.
- `xaalis_get_agent_wallet`: Read an agent wallet's policy and balance.
- `xaalis_get_balance`: The merchant's available balance (withdrawable) and money reserved for payouts in flight, in XOF.
- `xaalis_get_invoice`: Read a subscription invoice: status, amount, due date, and hosted_invoice_url (the stable link to send the customer).
- `xaalis_get_payment`: Read a payment's current status, amount, fee and checkout link. 'succeeded' is the only proof the customer paid.
- `xaalis_get_payout`: Read a payout's status (pending, processing, succeeded, failed).
- `xaalis_get_subscription`: Read a subscription: status, cycles paid, latest invoice.
- `xaalis_issue_agent_key`: Sandbox: issue the ak_test_ key an agent uses to pay out from this wallet. The secret is shown ONCE — store it in a secret store or env var right away. Retrying with the same idempotency_key never shows it again.
- `xaalis_list_agent_wallets`: List the merchant's agent wallets and their policies.
- `xaalis_list_invoices`: List invoices, optionally for one subscription or by status.
- `xaalis_list_payments`: List payments, newest first, optionally filtered by status.
- `xaalis_list_payouts`: List the merchant's payouts, newest first, with their status and recipient.
- `xaalis_list_refunds`: Read the refund of a payment, if any (a list of zero or one). Use it to check an uncertain refund instead of retrying.
- `xaalis_list_subscriptions`: List subscriptions, newest first, optionally by status.
- `xaalis_list_webhook_deliveries`: Recent webhooks Xaalis sent to the merchant's endpoint, with status, attempts and the last error — use it to debug a webhook integration.
- `xaalis_reclaim_agent_wallet`: Sandbox: move unreserved money from an agent wallet back to the merchant balance.
- `xaalis_refund_payment`: Send the FULL amount of a succeeded Wave payment back to the customer (no partial refunds). The merchant's available balance must cover it. One refund per payment; the same idempotency_key returns the same refund.
- `xaalis_sandbox_signup`: Create a Xaalis SANDBOX merchant account and get its test secret key (sk_test_…) and webhook secret, with no human step. Sandbox only: no real money, simulated wallets. Going live later needs a human (KYC and approval). Store the returned secrets in environment variables, never in code.
- `xaalis_search_docs`: Search the official Xaalis documentation (payments, webhooks, payouts, refunds, subscriptions, SDKs, errors, go-live). Use it before guessing how an endpoint behaves.
- `xaalis_simulate_payment`: Sandbox only: make a test payment succeed or fail as if the customer had paid (or declined) in their wallet. Triggers the same webhooks as a real payment.
- `xaalis_whoami`: Start here. Shows which Xaalis key is connected (none, merchant test/live, agent wallet), its mode, the account or wallet it belongs to, and which tools it unlocks.