MCP server for Pomelo — pan-LATAM card issuing as a service: card-holder users, virtual and physical Visa/Mastercard issuance, lifecycle management, and the transactions feed. Argentina, Brazil, Mexico, Colombia, Peru, Chile.

Quick Start

Claude Desktop

Add to ~/.config/claude/claude_desktop_config.json:

{
  "mcpServers": {
    "pomelo": {
      "command": "npx",
      "args": ["-y", "@codespar/mcp-pomelo"],
      "env": {
        "POMELO_CLIENT_ID": "your-client-id",
        "POMELO_CLIENT_SECRET": "your-client-secret",
        "POMELO_ENV": "sandbox"
      }
    }
  }
}

Claude Code

claude mcp add pomelo -- npx @codespar/mcp-pomelo

Cursor / VS Code

Add to .cursor/mcp.json or .vscode/mcp.json:

{
  "servers": {
    "pomelo": {
      "command": "npx",
      "args": ["-y", "@codespar/mcp-pomelo"],
      "env": {
        "POMELO_CLIENT_ID": "your-client-id",
        "POMELO_CLIENT_SECRET": "your-client-secret",
        "POMELO_ENV": "sandbox"
      }
    }
  }
}

Environment

Variable	Required	Description
`POMELO_CLIENT_ID`	yes	OAuth2 client id
`POMELO_CLIENT_SECRET`	yes	OAuth2 client secret
`POMELO_ENV`	no	`sandbox` (default) or `production`
`POMELO_BASE_URL`	no	API base override (defaults per env)
`POMELO_AUTH_URL`	no	Auth base override (defaults per env)
`POMELO_AUDIENCE`	no	OAuth2 audience override (defaults per env)

Authentication is OAuth2 client-credentials; the server exchanges and caches the Bearer token automatically.

Tools (9)

Tool	What it does
`create_user`	Create a card-holder identity (`POST /users/v1`)
`get_user`	Fetch a user by id
`update_user`	Patch user fields (status, contact, address)
`create_card`	Issue a `VIRTUAL` or `PHYSICAL` card (`POST /cards/v1`)
`get_card`	Fetch a card (masked PAN, status, program)
`list_cards`	List cards, filterable by user/status
`update_card_status`	`ACTIVE` / `BLOCKED` / `DISABLED` lifecycle changes
`list_transactions`	Search the card-transactions feed
`get_transaction`	Fetch one transaction by id

Mutating calls carry an x-idempotency-key (auto-generated, overridable per call via idempotency_key).

Example

"Issue a virtual card for the new contractor and freeze the old one."

The agent calls create_user (if needed) → create_card (card_type: "VIRTUAL") → update_card_status (status: "BLOCKED", status_reason: "CLIENT_INTERNAL_REASON").

Notes

Card credentials (full PAN/CVV) are never returned by these tools; Pomelo exposes sensitive data only through its PCI-scoped widgets.
Authorization decisioning (approving each swipe in real time) is a webhook you host, not an API call — pair this server with CodeSpar's governed authorizer if you want mandate checks per transaction.

Authentication

OAuth2 client-credentials: the server exchanges POMELO_CLIENT_ID / POMELO_CLIENT_SECRET for a Bearer token at {AUTH_URL}/oauth/token and caches it until shortly before expiry. Mutating calls carry an x-idempotency-key.

Enterprise

Need governance, budget limits, and audit trails for agent-driven card issuing on Pomelo? CodeSpar Enterprise adds a policy engine, payment routing, and compliance templates on top of these MCP servers.