Home / MCP registry index / io.usefulapi/pin-payments

Pin Payments MCP by usefulapi

io.usefulapi/pin-payments in the official MCP registry. Endpoint https://pin-payments.usefulapi.io/mcp. Source: github.com/m190/usefulapi-mcp.

The registry describes it as: Read Pin Payments charges, refunds, balances, transfers and subscriptions without moving money.

We read its 35 tools on 2026-11-01. Nothing in them matched our tool-poisoning rules. It also sets server instructions, text a client puts in front of the model on connect; those were read too.

A clean read means these rules found nothing, not that the server is harmless. A server can change its tools at any time, which is why the index reads it again every week.

Connect it

The endpoint answers MCP over HTTP; that is how we read it. Add it to your client:

Claude Code

claude mcp add --transport http pin-payments https://pin-payments.usefulapi.io/mcp

Cursor: ~/.cursor/mcp.json

{
  "mcpServers": {
    "pin-payments": {
      "url": "https://pin-payments.usefulapi.io/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"pin-payments","type":"http","url":"https://pin-payments.usefulapi.io/mcp"}'

Some servers ask you to sign in the first time a client connects, or want a key from the people who run them; the server's own docs say which.

Let Claude Code check servers as it adds them

With the free lazaretto-guard plugin installed, when Claude Code adds a server for you or writes one into an MCP config, the plugin reads the server's tools first and asks you if one of our rules matches. Install it, restart Claude Code, then ask it to run the command above.

Install lazaretto-guard

claude plugin marketplace add jamesdfinance-dev/lazaretto-plugins
claude plugin install lazaretto-guard@lazaretto-plugins

Tools it advertises

pinpayments_get_balance pinpayments_list_charges pinpayments_search_charges pinpayments_get_charge pinpayments_list_charge_refunds pinpayments_list_refunds pinpayments_get_refund pinpayments_list_authorisations pinpayments_get_authorisation pinpayments_list_customers pinpayments_get_customer pinpayments_list_customer_charges pinpayments_list_customer_cards pinpayments_list_customer_subscriptions pinpayments_list_deposits pinpayments_get_deposit pinpayments_list_transfers pinpayments_search_transfers pinpayments_get_transfer pinpayments_list_transfer_line_items pinpayments_list_recipients pinpayments_get_recipient pinpayments_list_recipient_transfers pinpayments_list_disputes pinpayments_search_disputes pinpayments_get_dispute pinpayments_get_dispute_activity pinpayments_list_plans pinpayments_get_plan pinpayments_list_plan_subscriptions pinpayments_list_subscriptions pinpayments_get_subscription pinpayments_get_subscription_ledger pinpayments_list_events pinpayments_get_event

Tool changes

We compare every full read of this server with the one before. No change in what its tools say has been seen since we started keeping this record on 2026-10-30.

Fingerprint of its tools at our last full read (2026-11-01): ac7a7e32206a1a9d. A client can hash the tools it is served the same way and compare; the full value and a hash per tool are in this page as JSON.

Run this server? Show the check in your README

The badge reflects the latest weekly read:

Markdown

[![MCP tool check](https://lazaretto.dev/mcp-registry/io-usefulapi-pin-payments/badge.svg)](https://lazaretto.dev/mcp-registry/io-usefulapi-pin-payments)

How this was checked

Lazaretto connects to the endpoint the way any MCP client does, asks the server to introduce itself and list its tools, and reads every name, description, parameter schema and server instruction for tool poisoning: hidden directive blocks, orders to read local secrets, parameters built to carry secrets or the conversation out, orders that redirect another server's tools, and invisible characters. It never calls a tool. What we found across the registry.

To run the same check every time Claude Code adds a server, install the free lazaretto-guard plugin. Browse every server in the index.