@codespar/mcp-pomelo
MCP server for Pomelo — pan-LATAM card issuing as a service: card-holder users, virtual and physical Visa/Mastercard issuance, lifecycle management, and the transactions feed. Argentina, Brazil, Mexico, Colombia, Peru, Chile.
Quick Start
Claude Desktop
Add to ~/.config/claude/claude_desktop_config.json:
{
"mcpServers": {
"pomelo": {
"command": "npx",
"args": ["-y", "@codespar/mcp-pomelo"],
"env": {
"POMELO_CLIENT_ID": "your-client-id",
"POMELO_CLIENT_SECRET": "your-client-secret",
"POMELO_ENV": "sandbox"
}
}
}
}
Claude Code
claude mcp add pomelo -- npx @codespar/mcp-pomelo
Cursor / VS Code
Add to .cursor/mcp.json or .vscode/mcp.json:
{
"servers": {
"pomelo": {
"command": "npx",
"args": ["-y", "@codespar/mcp-pomelo"],
"env": {
"POMELO_CLIENT_ID": "your-client-id",
"POMELO_CLIENT_SECRET": "your-client-secret",
"POMELO_ENV": "sandbox"
}
}
}
}
Environment
| Variable | Required | Description |
|---|
POMELO_CLIENT_ID | yes | OAuth2 client id |
POMELO_CLIENT_SECRET | yes | OAuth2 client secret |
POMELO_ENV | no | sandbox (default) or production |
POMELO_BASE_URL | no | API base override (defaults per env) |
POMELO_AUTH_URL | no | Auth base override (defaults per env) |
POMELO_AUDIENCE | no | OAuth2 audience override (defaults per env) |
Authentication is OAuth2 client-credentials; the server exchanges and caches the Bearer token automatically.
| Tool | What it does |
|---|
create_user | Create a card-holder identity (POST /users/v1) |
get_user | Fetch a user by id |
update_user | Patch user fields (status, contact, address) |
create_card | Issue a VIRTUAL or PHYSICAL card (POST /cards/v1) |
get_card | Fetch a card (masked PAN, status, program) |
list_cards | List cards, filterable by user/status |
update_card_status | ACTIVE / BLOCKED / DISABLED lifecycle changes |
list_transactions | Search the card-transactions feed |
get_transaction | Fetch one transaction by id |
Mutating calls carry an x-idempotency-key (auto-generated, overridable per call via idempotency_key).
Example
"Issue a virtual card for the new contractor and freeze the old one."
The agent calls create_user (if needed) → create_card (card_type: "VIRTUAL") → update_card_status (status: "BLOCKED", status_reason: "CLIENT_INTERNAL_REASON").
Notes
- Card credentials (full PAN/CVV) are never returned by these tools; Pomelo exposes sensitive data only through its PCI-scoped widgets.
- Authorization decisioning (approving each swipe in real time) is a webhook you host, not an API call — pair this server with CodeSpar's governed authorizer if you want mandate checks per transaction.
Authentication
OAuth2 client-credentials: the server exchanges POMELO_CLIENT_ID / POMELO_CLIENT_SECRET for a Bearer token at {AUTH_URL}/oauth/token and caches it until shortly before expiry. Mutating calls carry an x-idempotency-key.
Enterprise
Need governance, budget limits, and audit trails for agent-driven card issuing on Pomelo? CodeSpar Enterprise adds a policy engine, payment routing, and compliance templates on top of these MCP servers.
License
MIT