Diagnose Google Play Billing incidents locally, with evidence. Not affiliated with Google.
MCPpedia last refreshed this data
io.github.lazytitan30/billing-doctor is an MCP server that diagnose Google Play Billing incidents locally, with evidence. Not affiliated with Google. Its tool list has not been published yet over stdio and sse, requires no API key, and scores 87/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"io-github-lazytitan30-billing-doctor": {
"args": [
"-y",
"billing-doctor"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Diagnose Google Play Billing incidents locally, with evidence. Not affiliated with Google.
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y 'billing-doctor' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories - click any category to see the underlying evidence.
No known CVEs.
Checked billing-doctor against OSV.dev.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in finance
OKX trading MCP server — connect AI agents to spot, swap, futures, options & grid bots via the Model Context Protocol.
Ledger of AI-agent money on Base: payments, detections, Gate, signed Pass, Agent Books, free checks
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
Crypto briefs and data, Solana pre-trade checks, sanctions, papers, NLP. 102 tools, USDC, 20 chains.
MCP Security Weekly
Get CVE alerts and security updates for io.github.lazytitan30/billing-doctor and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Billing Doctor reads what happened to a Google Play purchase and tells you where it broke. It runs on your machine, calls nothing, changes nothing at Google, and shows its evidence. Not affiliated with Google.
It is for developers who run their own Google Play Billing backend, in Node, Python, PHP, Go or Java, with Capacitor, Flutter, React Native or native Android in front, and did not choose a subscription platform. It is the tool you run at 11 pm when a subscription broke.
The fixture below ships in the repository, so start from a checkout:
git clone https://github.com/lazytitan30/billing-doctor && cd billing-doctor
npx billing-doctor diagnose fixtures/rules/G2-void-then-active.json
(The same fixtures ship inside the npm package: after npm install -g billing-doctor they are under $(npm root -g)/billing-doctor/fixtures/.)
billing-doctor 0.1.1: fixtures/rules/G2-void-then-active.json, 11 events, 1 finding: 1 high
HIGH
G2 Voided purchase, then a fetch reading ACTIVE, and no revoke [certain]
evidence #8 rtdn voidedPurchase tok_a1 [m-2] answered 200 (2026-09-04T10:00:00Z)
#9 api subscriptionsv2.get tok_a1 → 200 SUBSCRIPTION_STATE_ACTIVE ack ACKNOWLEDGED (2026-09-04T10:00:01Z)
mechanism tok_a1 was voided at #8 (the money went back); the fetch at #9 still answered ACTIVE and the ledger never revoked, so the refunded user keeps the tier.
Google "(1) REFUND_TYPE_FULL_REFUND - The purchase has been fully voided."
RTDN reference: VoidedPurchaseNotification, read 2026-09-09: https://developer.android.com/google/play/billing/rtdn-reference
observed Seen in a live app, 2026-08: after the voided-purchase notification, purchases.subscriptionsv2.get still answered SUBSCRIPTION_STATE_ACTIVE ...
next Revoke tok_a1 now. In the handler, act on voidedPurchaseNotification directly: mark refunded and revoke, regardless of what subscriptionsv2.get answers afterwards.
fix runbook G2 (billing-doctor rule G2)
1 finding: 1 high
exit 1: a high finding is present
Every finding carries the events it rests on, the mechanism, Google's rule quoted with a dated link, a confidence (certain, likely, possible) and the next thing to check. Exit code 1 means a high finding exists, so the command can gate CI.
You give it a timeline: one JSON file with what happened to one purchase, assembled from your logs, your database, the Cloud Console and the support ticket. The notifications Google sent, the API answers, what your backend wrote, what the user said. Tokens are pseudonyms; nothing real goes in the file.
It checks the timeline against 97 rules in eleven groups. Every one of them rests on a sentence from Google's own documentation, quoted verbatim with the URL and the date it was read:
| Group | What it catches |
|---|---|
| A. Configuration and permissions | no notifications at all, 401/403, the topic in another project, negative acks, an unauthenticated endpoint, a release below Billing Library 8 after the 2026-08-31 gate, one-time notifications never switched on |
| B. Purchase and acknowledgement | unacknowledged purchases Google refunded, acknowledging or granting while PENDING, consumables acknowledged not consumed, grants before verification, double grants, acknowledgement failures the client never heard about, prepaid windows, multi-quantity purchases granted as one, plan changes blocked by an unacknowledged subscription, purchases never acknowledged with no refund in the file yet |
| C. Notifications | the same message applied twice, out-of-order notifications, writes without re-fetching, revoking on a message with no id, unhandled types, chargeback reviews treated as refunds, test notifications applied, messages never acknowledged and never applied |
| D. State interpretation | expiry from the wrong source, CANCELED and grace period treated as no access, hold and pa |