troqpay plugin

MCP server and Codex plugin wrapper for troqpay.

The plugin exposes payment tools to Codex, Claude Desktop, and other MCP clients:

• troqpay_create_checkout
• troqpay_get_checkout
• troqpay_get_balance
• troqpay_create_withdrawal when TROQPAY_ENABLE_WITHDRAWALS=true
• troqpay_get_withdrawal when TROQPAY_ENABLE_WITHDRAWALS=true

API keys are read from environment variables and are not passed as tool inputs.

Environment

export TROQPAY_API_KEY="trq_test_xxxxxxxxx"
export TROQPAY_BASE_URL="https://api.troqpay.com"

For staging:

export TROQPAY_BASE_URL="https://troqpay-api-staging-production.up.railway.app"

Withdrawal tools are disabled by default. Enable them only in trusted server-side environments:

export TROQPAY_ENABLE_WITHDRAWALS="true"

Never store trq_test_ or trq_live_ keys in this package, marketplace manifests, repository files, screenshots, or chat transcripts.

Build

npm install
npm run build

Security model

• The plugin is a thin MCP client. The troqpay API remains the money-risk enforcement boundary.
• The plugin vendors only the minimal HTTP client it needs, so public installation does not depend on a local sibling SDK path.
• API keys stay in the host environment and are never accepted as MCP tool arguments.
• Checkout experiments should use trq_test_ keys.
• Live operations require trq_live_ keys and server-side API enforcement for production approval, API-key scopes, idempotency, rate limits and audit logs.
• Withdrawal tools are opt-in with TROQPAY_ENABLE_WITHDRAWALS=true.
• Runtime startup does not run npm install; dependencies must be installed as part of the plugin installation/release process.

Public release checklist

Before publishing this plugin outside a local marketplace:

1. Remove ignored build artifacts and dependency folders from the release source, especially node_modules.
2. Run npm ci, npm run verify:public, and a clean MCP smoke test from a fresh clone.
3. Confirm no .env, API keys, provider credentials, database URLs, or local checkout artifacts are committed.
4. Confirm the public API returns structured errors such as 401, 403, and 503, not raw stack traces.
5. Keep withdrawal tools disabled by default in marketplace examples.

Claude Desktop

Add this to claude_desktop_config.json:

{
  "mcpServers": {
    "troqpay": {
      "command": "node",
      "args": ["/absolute/path/to/plugins/troqpay/dist/mcp.js"],
      "env": {
        "TROQPAY_API_KEY": "trq_test_xxxxxxxxx",
        "TROQPAY_BASE_URL": "https://api.troqpay.com"
      }
    }
  }
}

Codex

The plugin bundle includes .codex-plugin/plugin.json, .claude-plugin/plugin.json, and .mcp.json. After install, set TROQPAY_API_KEY in the Codex environment before using tools.

The official source repository is:

https://github.com/troqpay/agent-plugin