← Back to the overview

Toolkit

pinch-mcp & the Remi Toolkit

One Pinch payments core, wrapped once as an MCP server, plus everything you need to put a responsible AI payments agent in front of it — the agent pack, host recipes, a security guide and a live playground.

Get the toolkit See it live

pinch-mcp — the server

A community MCP server over the Pinch Payments API (Australia). 23 tools — 13 read, 10 approval-gated writes — behind stdio and Streamable HTTP, so Claude Desktop, Cursor, LyboAI or any MCP client gets the same capabilities. Every write refuses without confirm:true and returns a preview first; the gate lives in the tool layer, not the prompt.

Read (13)

Payments, payers, subscriptions (with stall detection), cashflow & settlement summaries, payer statements, split-bill status, events — plus a dishonour-diagnosis map that turns Pinch codes into plain English.

Guarded writes (10)

Payment links, subscriptions (term / deposit / instalments), splits, refunds, retries, discounts, QR links, plus design_billing, import_payers and one-touch onboard_business. All approve-then-act.

Hardened

Per-tenant token cache keyed by secret, per-IP rate limiting, body-size caps, output caps, per-call audit logging, a toolsHash manifest on /meta, and a non-root container. BYO keys — no fund aggregation.

stdioStreamable HTTPOAuth2 client-credentialsmetadata attributionTime-Travel sandbox

The toolkit — everything around it

So any platform can put a safe AI payments agent on Pinch without starting from scratch.

Agent pack

Remi's system prompt, the Design·Do·Ask·Fix playbooks, the dishonour taxonomy, and the guardrail language — byte-identical across every deployment shape.

Host recipes

Drop-in configs for Claude Desktop, LyboAI, and website/app widget embeds — back-office Remi and a restricted customer-facing Front Desk.

Security guide

SECURITY.md mapped to OWASP GenAI, the SlowMist checklist and Palo Alto's MCP analysis — plus a production hardening roadmap.

Seeders & playground

A sandbox seed script, a per-coach real-payments seeder, and the live playground to call the tools yourself.

See it live

Go and poke at the real thing — no slides.

The live server — /meta (23 tools) ↗ Remi in the LyboAI Agent Family ↗ CoachPlus — the live reference ↗ The tools playground ↗ The day-by-day build log ↗

Get the toolkit

The toolkit is what we share — the agent pack, recipes, security guide and seeders. The hosted MCP server itself stays proprietary (a gated service, not an open relay), so you run your own or connect to ours with a key.

Clone the toolkit

git clone https://github.com/lybotechgroup/pinch-remi-toolkit
cd pinch-remi-toolkit/packages/pinch-mcp
cp .env.example .env   # add your Pinch sandbox keys
npm install && npm run smoke

The agent pack, recipes and security guide live at the repo root; the server is under packages/pinch-mcp.

What you need

  • A Pinch account + sandbox API keys (web.getpinch.com.au → API keys)
  • Node 20+ for the server; an MCP host (Claude Desktop / Cursor / LyboAI)
  • Read SETUP.md and SECURITY.md before going live

Access: replace the clone URL above with the real repo once it's shared. If the repo is private, point this button at a release zip on this site or a request-access form — see the note in SETUP.md.