
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@paystack/mcp-server
Advanced tools
A Model Context Protocol (MCP) server that enables AI assistants to interact with the full range of Paystack APIs.
[!WARNING] Public Preview: This MCP server is currently in public preview. We're seeking early feedback to improve the next iteration, so use cautiously and report any issues you encounter.
Install and run via npm (recommended):
npx @paystack/mcp-server --api-key sk_test_your_key_here
Or for local development, clone and build:
git clone https://github.com/PaystackOSS/paystack-mcp-server.git
cd paystack-mcp-server
npm install
npm run build
Then configure your MCP client to use the server (see Client Integration).
sk_test_)| Environment Variable | Purpose |
|---|---|
PAYSTACK_TEST_SECRET_KEY | Your Paystack test secret key (fallback if no CLI arg) |
You can provide your API key in two ways:
--api-key sk_test_...PAYSTACK_TEST_SECRET_KEYSecurity note: Only test keys (
sk_test_*) are allowed. The server validates this at startup and will reject live keys.
The Paystack MCP Server works with any MCP-compatible client. Below is the standard configuration schema used by most clients (Claude Desktop, ChatGPT Desktop, Cursor, Windsurf, etc.).
For npm-installed server:
{
"mcpServers": {
"paystack": {
"command": "npx",
"args": ["@paystack/mcp-server", "--api-key", "sk_test_..."]
}
}
}
If you've cloned and built the server locally:
{
"mcpServers": {
"paystack": {
"command": "node",
"args": ["/path/to/paystack-mcp-server/build/index.js"],
"env": {
"PAYSTACK_TEST_SECRET_KEY": "sk_test_..."
}
}
}
}
[!IMPORTANT] When setting
command: "node", you should ensure you're using Node v18+. If you are using a package manager, you might need to get the path of your Node binary by running this command in your CLI:Linux and MacOS
which nodeWindows
where nodeOnce you have the path, use it as the value of the MCP Server command in the JSON configuration. e.g.,
command: "path/to/installation/bin/node"
| Client | Config file location |
|---|---|
| VS Code | .vscode/mcp.json |
| Claude Desktop | claude_desktop_config.json |
| ChatGPT Desktop | MCP settings in app preferences |
| Cursor | .cursor/mcp.json or global MCP settings |
| Windsurf | MCP configuration in settings |
| Claude Code | ~/.claude/mcp.json or project-level .mcp.json |
The Paystack MCP Server exposes the entire Paystack API to AI assistants by parsing Paystack's OpenAPI specification at runtime. Instead of hardcoding individual endpoints, the server dynamically discovers all available operations and makes them accessible through a small set of tools.
| Tool | Description |
|---|---|
get_paystack_operation | Fetch operation details (method, path, parameters) by operation ID |
make_paystack_request | Execute a Paystack API request |
| Resource | URI | Description |
|---|---|---|
paystack_operation_list | paystack://operations/list | List all available Paystack operations and their details |
When you ask your AI assistant something like "Get me the last 5 transactions on my Paystack integration", here's what happens behind the scenes:
get_paystack_operation("transaction_list") to look up the endpoint detailsGET), path (/transaction), and available query parametersmake_paystack_request with { method: "GET", path: "/transaction", data: { perPage: 5 } }To get the best results when using this MCP server, be specific in your prompts and always include "Paystack" in your requests. This helps the LLM quickly identify and use the appropriate Paystack tools.
Good prompts:
Less effective prompts:
Being explicit ensures the LLM narrows down to the right tool quickly and reduces ambiguity.
For local development and testing, you can run the TypeScript source directly:
PAYSTACK_TEST_SECRET_KEY=sk_test_... npm run dev
npm run inspect
npm run build
npm test
| Issue | Solution |
|---|---|
| Server exits silently at startup | Check that PAYSTACK_TEST_SECRET_KEY is set |
| "Invalid key" error | Key must start with sk_test_ — live keys are not allowed |
| Tools not appearing in client | Ensure the server is running and the client config path is correct |
| Request timeouts | Check network connectivity to api.paystack.co |
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.
See CONTRIBUTING.md for more details.
MIT
FAQs
Model Context Protocol (MCP) server for Paystack API integration
The npm package @paystack/mcp-server receives a total of 19 weekly downloads. As such, @paystack/mcp-server popularity was classified as not popular.
We found that @paystack/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.