Is io.github.gabrielmahia/mpesa-mcp safe to use?

io.github.gabrielmahia/mpesa-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.gabrielmahia/mpesa-mcp?

io.github.gabrielmahia/mpesa-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with io.github.gabrielmahia/mpesa-mcp?

io.github.gabrielmahia/mpesa-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is io.github.gabrielmahia/mpesa-mcp actively maintained?

io.github.gabrielmahia/mpesa-mcp is actively maintained — last commit was 3 days ago.

io.github.gabrielmahia/mpesa-mcp

mpesa-mcp

M-Pesa + Africa's Talking MCP server — payments, SMS, airtime for AI agents in East Africa.

0 tools GitHub PyPI

No known CVEs

No license

Actively maintained

Last commit 3d ago

Works with most clients

Transport: stdio, sse, http

0 tools

Grade F

Edit this pageView history

Finance Communication

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mpesa": {
      "env": {
        "AT_API_KEY": "your_at_key",
        "AT_USERNAME": "sandbox",
        "MPESA_PASSKEY": "your_passkey",
        "MPESA_SANDBOX": "true",
        "MPESA_SHORTCODE": "174379",
        "MPESA_CALLBACK_URL": "https://yourdomain.com/mpesa/callback",
        "MPESA_CONSUMER_KEY": "your_key",
        "MPESA_CONSUMER_SECRET": "your_secret"
      },
      "args": [
        "mpesa-mcp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-gabrielmahia-mpesa-mcp)](https://mcppedia.org/s/io-github-gabrielmahia-mpesa-mcp)

Read me

What io.github.gabrielmahia/mpesa-mcp does

MCP server for East African fintech APIs — M-Pesa (Safaricom Daraja) and Africa's Talking

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'mpesa-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

56/100across 5 weighted dimensions

How we score →

0255075100

−44

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked mpesa-mcp against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.gabrielmahia/mpesa-mcp safe to use?: io.github.gabrielmahia/mpesa-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.gabrielmahia/mpesa-mcp?: io.github.gabrielmahia/mpesa-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.gabrielmahia/mpesa-mcp?: io.github.gabrielmahia/mpesa-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.gabrielmahia/mpesa-mcp actively maintained?: io.github.gabrielmahia/mpesa-mcp is actively maintained — last commit was 3 days ago.

Similar servers

Others in finance / communication

View all →

Mcp_agent_mail96

Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite

2.0k 6

Alpha Vantage Mcp95

Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators

158 3

Mac_messages_mcp93

An MCP server that securely interfaces with your iMessage database via the Model Context Protocol (MCP), allowing LLMs to query and analyze iMessage conversations. It includes robust phone number validation, attachment processing, contact management, group chat handling, and full support for sending and receiving messages.

289 4

Investor Agent93

A Model Context Protocol server for building an investor agent

329 7

MCP Security Weekly

Get CVE alerts and security updates for io.github.gabrielmahia/mpesa-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Finance Communication

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mpesa": {
      "env": {
        "AT_API_KEY": "your_at_key",
        "AT_USERNAME": "sandbox",
        "MPESA_PASSKEY": "your_passkey",
        "MPESA_SANDBOX": "true",
        "MPESA_SHORTCODE": "174379",
        "MPESA_CALLBACK_URL": "https://yourdomain.com/mpesa/callback",
        "MPESA_CONSUMER_KEY": "your_key",
        "MPESA_CONSUMER_SECRET": "your_secret"
      },
      "args": [
        "mpesa-mcp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-gabrielmahia-mpesa-mcp)](https://mcppedia.org/s/io-github-gabrielmahia-mpesa-mcp)

Read me

What io.github.gabrielmahia/mpesa-mcp does

MCP server for East African fintech APIs — M-Pesa (Safaricom Daraja) and Africa's Talking

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'mpesa-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

mpesa-mcp

MCP server for East African fintech APIs — M-Pesa (Safaricom Daraja) and Africa's Talking

Give your AI agent the ability to trigger M-Pesa payments, check transaction status, send SMS, and top up airtime across 20+ African telecom networks.

Why this exists

M-Pesa processes more transactions per day than PayPal does in Africa. Africa's Talking reaches users in 20+ countries on basic phones via SMS and USSD. Neither has an MCP server.

This means every AI agent built today — Claude, GPT, Gemini, or any MCP-compatible runtime — cannot trigger an M-Pesa payment or send a Kiswahili SMS without custom integration work.

mpesa-mcp closes that gap in one pip install.

Tools

Tool	Description
`mpesa_stk_push`	Trigger STK Push payment prompt on customer's M-Pesa phone
`mpesa_stk_query`	Check status of an STK Push request
`mpesa_transaction_status`	Query any M-Pesa transaction by receipt number
`sms_send`	Send SMS to 1–1,000 recipients across African networks
`airtime_send`	Send airtime top-up to any subscriber (KES, NGN, GHS, UGX, etc.)

Coverage

M-Pesa: Kenya (Safaricom Daraja v3) — STK Push, C2B, transaction status
SMS/Airtime: Kenya, Nigeria, Ghana, Tanzania, Uganda, Rwanda, South Africa, and 15+ more via Africa's Talking

Glama (hosted MCP)

mpesa-mcp is available as a hosted MCP server on Glama:

Security — NSA MCP Guidance Compliant

mpesa-mcp was updated in response to NSA CSI U/OO/6030316-26 (May 2026) — the NSA Artificial Intelligence Security Center's Cybersecurity Information Sheet on Model Context Protocol security.

This makes mpesa-mcp the first African MCP server to document compliance against the NSA's MCP security framework.

NSA Control	Implementation
Parameter validation	KE phone regex `^254[17]\d{8}$` + amount bounds [1–150,000 KES]
Audit logging	Structured log per tool call; phone numbers SHA-256 hashed
Token lifecycle	OAuth token cached with expiry; auto-refreshed
Error containment	Structured error dicts; no raw exception propagation
HTTPS enforcement	All Daraja API calls HTTPS-only
No hardcoded secrets	All credentials via environment variables

See SECURITY.md for the full compliance table.

Reference: NSA CSI_MCP_SECURITY.pdf — May 2026, UNCLASSIFIED

Install

pip install mpesa-mcp

Or run directly with uvx:

uvx mpesa-mcp

Configuration

Set these environment variables before starting the server:

# M-Pesa (Safaricom Dara

... [View full README on GitHub](https://github.com/gabrielmahia/mpesa-mcp#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

56/100across 5 weighted dimensions

How we score →

0255075100

−44

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked mpesa-mcp against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.gabrielmahia/mpesa-mcp safe to use?: io.github.gabrielmahia/mpesa-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.gabrielmahia/mpesa-mcp?: io.github.gabrielmahia/mpesa-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.gabrielmahia/mpesa-mcp?: io.github.gabrielmahia/mpesa-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is io.github.gabrielmahia/mpesa-mcp actively maintained?: io.github.gabrielmahia/mpesa-mcp is actively maintained — last commit was 3 days ago.