@codespar/mcp-pomelo

MCP server for Pomelo — pan-LATAM card issuing as a service: card-holder users, virtual and physical Visa/Mastercard issuance, lifecycle management, and the transactions feed. Argentina, Brazil, Mexico, Colombia, Peru, Chile.

Quick Start

Claude Desktop

Add to ~/.config/claude/claude_desktop_config.json:

{
  "mcpServers": {
    "pomelo": {
      "command": "npx",
      "args": ["-y", "@codespar/mcp-pomelo"],
      "env": {
        "POMELO_CLIENT_ID": "your-client-id",
        "POMELO_CLIENT_SECRET": "your-client-secret",
        "POMELO_ENV": "sandbox"
      }
    }
  }
}

Claude Code

claude mcp add pomelo -- npx @codespar/mcp-pomelo

Cursor / VS Code

Add to .cursor/mcp.json or .vscode/mcp.json:

{
  "servers": {
    "pomelo": {
      "command": "npx",
      "args": ["-y", "@codespar/mcp-pomelo"],
      "env": {
        "POMELO_CLIENT_ID": "your-client-id",
        "POMELO_CLIENT_SECRET": "your-client-secret",
        "POMELO_ENV": "sandbox"
      }
    }
  }
}

Environment

| Variable | Required | Description | |---|---|---| | POMELO_CLIENT_ID | yes | OAuth2 client id | | POMELO_CLIENT_SECRET | yes | OAuth2 client secret | | POMELO_ENV | no | sandbox (default) or production | | POMELO_BASE_URL | no | API base override (defaults per env) | | POMELO_AUTH_URL | no | Auth base override (defaults per env) | | POMELO_AUDIENCE | no | OAuth2 audience override (defaults per env) |

Authentication is OAuth2 client-credentials; the server exchanges and caches the Bearer token automatically.

Tools (9)

| Tool | What it does | |---|---| | create_user | Create a card-holder identity (POST /users/v1) | | get_user | Fetch a user by id | | update_user | Patch user fields (status, contact, address) | | create_card | Issue a VIRTUAL or PHYSICAL card (POST /cards/v1) | | get_card | Fetch a card (masked PAN, status, program) | | list_cards | List cards, filterable by user/status | | update_card_status | ACTIVE / BLOCKED / DISABLED lifecycle changes | | list_transactions | Search the card-transactions feed | | get_transaction | Fetch one transaction by id |

Mutating calls carry an x-idempotency-key (auto-generated, overridable per call via idempotency_key).

Example

"Issue a virtual card for the new contractor and freeze the old one."

The agent calls create_user (if needed) → create_card (card_type: "VIRTUAL") → update_card_status (status: "BLOCKED", status_reason: "CLIENT_INTERNAL_REASON").

Notes

• Card credentials (full PAN/CVV) are never returned by these tools; Pomelo exposes sensitive data only through its PCI-scoped widgets.
• Authorization decisioning (approving each swipe in real time) is a webhook you host, not an API call — pair this server with CodeSpar's governed authorizer if you want mandate checks per transaction.

Authentication

OAuth2 client-credentials: the server exchanges POMELO_CLIENT_ID / POMELO_CLIENT_SECRET for a Bearer token at {AUTH_URL}/oauth/token and caches it until shortly before expiry. Mutating calls carry an x-idempotency-key.

Enterprise

Need governance, budget limits, and audit trails for agent-driven card issuing on Pomelo? CodeSpar Enterprise adds a policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT