@theyahia/yookassa-mcp

MCP server for YooKassa API -- payments, refunds, receipts (54-FZ), payouts, webhooks, recurring, SBP, marketplace splits. 20 tools.

Part of Russian API MCP series by @theYahia.

Quick Start

Claude Desktop

{
  "mcpServers": {
    "yookassa": {
      "command": "npx",
      "args": ["-y", "@theyahia/yookassa-mcp"],
      "env": {
        "YOOKASSA_SHOP_ID": "your-shop-id",
        "YOOKASSA_SECRET_KEY": "your-secret-key"
      }
    }
  }
}

Claude Code

claude mcp add yookassa -e YOOKASSA_SHOP_ID=your-id -e YOOKASSA_SECRET_KEY=your-key -- npx -y @theyahia/yookassa-mcp

VS Code / Cursor

{
  "servers": {
    "yookassa": {
      "command": "npx",
      "args": ["-y", "@theyahia/yookassa-mcp"],
      "env": {
        "YOOKASSA_SHOP_ID": "your-shop-id",
        "YOOKASSA_SECRET_KEY": "your-secret-key"
      }
    }
  }
}

Windsurf

{
  "mcpServers": {
    "yookassa": {
      "command": "npx",
      "args": ["-y", "@theyahia/yookassa-mcp"],
      "env": {
        "YOOKASSA_SHOP_ID": "your-shop-id",
        "YOOKASSA_SECRET_KEY": "your-secret-key"
      }
    }
  }
}

Streamable HTTP (remote / Docker)

⚠️ The HTTP transport exposes money-moving tools. It requires a Bearer token, binds to 127.0.0.1 by default, and validates Host/Origin (DNS-rebinding protection). Never expose it directly to the internet — put it behind an authenticating reverse proxy / mTLS. See SECURITY.md.

MCP_AUTH_TOKEN="$(openssl rand -hex 32)" HTTP_PORT=3000 npx -y @theyahia/yookassa-mcp --http

Then call /mcp with Authorization: Bearer <MCP_AUTH_TOKEN>.

Endpoints:

• POST /mcp -- MCP Streamable HTTP transport (Bearer auth required; stateless — POST only)
• GET /health -- unauthenticated health check ({ "status": "ok", "tools": <count> })

Environment Variables

| Variable | Required | Description | |----------|:--------:|-------------| | YOOKASSA_SHOP_ID | Yes | Shop ID (Settings -> Shop) | | YOOKASSA_SECRET_KEY | Yes | Secret key (Integration -> API Keys) | | YOOKASSA_PAYOUT_AGENT_ID | Payouts | Gateway id (agentId) for the Payouts product (Settings -> Payouts) | | YOOKASSA_PAYOUT_SECRET_KEY | Payouts | Secret key for the Payouts gateway | | HTTP_PORT | No | Port for HTTP transport (default 3000); enables --http mode | | MCP_AUTH_TOKEN | HTTP only | Required in HTTP mode. Bearer token clients must send on /mcp | | HTTP_HOST | No | Bind address for HTTP mode (default 127.0.0.1; set 0.0.0.0 to expose — only behind a proxy) | | MCP_ALLOWED_HOSTS | No | Comma-separated Host allowlist (default 127.0.0.1:<port>,localhost:<port>) | | MCP_ALLOWED_ORIGINS | No | Comma-separated browser Origin CORS allowlist (default: none — browser origins rejected) | | YOOKASSA_DEBUG | No | Set to 1 to trace each request (method/path/status/latency/idempotency-key) to stderr — never logs secrets, the auth header, or request bodies |

Test mode / safety

This server drives real money operations. While developing:

1. Create a test shop in the YooKassa dashboard and use its YOOKASSA_SHOP_ID / YOOKASSA_SECRET_KEY.
2. Confirm you are in test mode by calling get_shop_info — expect "test": true — before switching to a live shop.
3. In a live shop, create_payment, create_refund, create_payout, create_recurring_payment, save_payment_method, and capture_payment move real funds and are irreversible. These tools are annotated as destructive so MCP clients can prompt before running them.
4. The HTTP transport is unauthenticated-by-default-refused and binds to localhost — see SECURITY.md before any remote deployment.

Tools (20)

Payments (9)

| Tool | Description | |------|-------------| | create_payment | Create a payment with amount, description, payment method. Returns payment URL. Supports receipts and metadata | | get_payment | Get payment details by ID -- status, amount, confirmation URL, metadata | | capture_payment | Confirm a two-step payment (capture held funds). Partial capture supported | | cancel_payment | Cancel a payment (pending or waiting_for_capture) | | list_payments | List payments with filters by status, date range, and pagination | | save_payment_method | Save a payment method for recurring charges (card binding) | | create_recurring_payment | Charge a saved payment method (no user interaction) | | create_sbp_payment | Create a payment via SBP (Russian fast payment system) | | create_split_payment | Split payment for marketplaces -- distribute funds among partners |

Refunds (3)

| Tool | Description | |------|-------------| | create_refund | Full or partial refund by payment ID | | get_refund | Get refund details by ID | | list_refunds | List refunds with optional payment filter |

Receipts (2)

| Tool | Description | |------|-------------| | create_receipt | Fiscal receipt (54-FZ) -- items, VAT codes, customer contacts | | list_receipts | List receipts by payment or refund ID |

Payouts (2)

⚠️ Payouts are a separately-activated YooKassa product with their own gateway credentials (YOOKASSA_PAYOUT_AGENT_ID + YOOKASSA_PAYOUT_SECRET_KEY), not the shop's payment key. Sending a raw card number requires a PCI DSS certificate — without it, collect the recipient via the payout widget and pass payout_token. Payouts are asynchronous (poll get_payout).

| Tool | Description | |------|-------------| | create_payout | Payout to bank card / YooMoney wallet / SBP, or via payout_token | | get_payout | Get payout status and details by ID |

Webhooks (3)

| Tool | Description | |------|-------------| | create_webhook | Register a webhook URL for events (payment.succeeded, refund.succeeded, etc.) | | list_webhooks | List all registered webhooks | | delete_webhook | Delete a webhook by ID |

Account (1)

| Tool | Description | |------|-------------| | get_shop_info | Shop info -- ID, status, test mode, fiscalization (YooKassa has no balance endpoint) |

Demo Prompts

Create a payment for 5000 RUB for order #123 with SBP as payment method

Set up a recurring subscription: bind the card with 1 ruble, then charge 999 RUB monthly using the saved method

Show all successful payments for the last 7 days and create a refund of 2500 RUB for payment pay_xxx

Architecture

• Auth: HTTP Basic Auth (YOOKASSA_SHOP_ID:YOOKASSA_SECRET_KEY)
• Base URL: https://api.yookassa.ru/v3/
• Idempotence-Key: one stable UUID v4 per logical POST/DELETE request, preserved across retries (a retried request is de-duplicated by YooKassa, never double-charged). Callers may pass an explicit key.
• Timeout: 35 seconds (above YooKassa's ~30s server-side answer window, so slow-but-successful operations are not aborted client-side)
• Retry: 3 attempts on 429/5xx/timeout with exponential backoff (1s, 2s, 4s); retries reuse the same Idempotence-Key, so they are safely de-duplicated
• Transport: stdio (default) or Streamable HTTP (--http / HTTP_PORT)

Part of Russian API MCP Series

| MCP | Status | Description | |-----|--------|-------------| | @metarebalance/dadata-mcp | ready | Addresses, companies, banks, phones | | @theyahia/cbr-mcp | ready | Currency rates, key rate | | @theyahia/yookassa-mcp | ready | Payments, refunds, receipts, payouts, webhooks | | @theyahia/cloudpayments-mcp | ready | Payments, subscriptions, orders | | ... | | +46 servers -- full list |

License

MIT