Robokassa Mcp 100/100 — SaferSkills

Is Robokassa Mcp safe to install?

SaferSkills independently audited Robokassa Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md9.3 KB · Markdown

<h1 align="center">robokassa-mcp</h1>

<p align="center"> <b>📚 <a href="https://ag-ae4b3bf7.mintlify.app">Documentation</a></b>  ·  <a href="https://pypi.org/project/robokassa-mcp/">PyPI</a>  ·  <a href="https://github.com/artgas1/robokassa-mcp/pkgs/container/robokassa-mcp">Docker</a>  ·  <a href="https://registry.modelcontextprotocol.io/v0/servers?search=robokassa">MCP Registry</a> </p>

Comprehensive Python client and Model Context Protocol server for Robokassa — the Russian payment gateway.

Covers the full API surface: checkout, XML status interfaces, refunds, holding (pre-auth), recurring subscriptions, 54-ФЗ fiscal receipts, Partner API, and auxiliary endpoints.

Install (once published)

# As an MCP server for Claude Desktop / Claude Code / Cursor / Windsurf
uvx robokassa-mcp

# As a Python library
pip install robokassa-mcp

Use as a Python library

import asyncio
from decimal import Decimal
from robokassa import create_invoice, RobokassaClient

# Build a signed checkout URL (no HTTP — just URL construction).
invoice = create_invoice(
    merchant_login="my-shop",
    out_sum=Decimal("599.00"),
    inv_id=12345,
    password1="...",
    description="Premium subscription",
    email="[email protected]",
)
print(invoice.url)  # https://auth.robokassa.ru/Merchant/Index.aspx?...

# Check the state of a payment (hits the OpStateExt XML endpoint).
async def check() -> None:
    async with RobokassaClient("my-shop", password2="...") as client:
        state = await client.check_payment(inv_id=12345)
        print(state.is_paid, state.info.op_key)

asyncio.run(check())

Full refund flow

from robokassa import RobokassaClient

async def refund_flow(inv_id: int) -> None:
    async with RobokassaClient("my-shop", password2="p2", password3="p3") as client:
        # 1. Fetch the payment state to get its OpKey.
        state = await client.check_payment(inv_id)
        assert state.info.op_key, "payment not complete yet"

        # 2. Initiate a refund.
        created = await client.refund_create(state.info.op_key)
        print("refund requestId:", created.request_id)

        # 3. Poll status until finished / canceled.
        while True:
            status = await client.refund_status(created.request_id)
            if status.is_terminal:
                print("final:", status.state)
                break

Webhook signature verification (FastAPI example)

from fastapi import FastAPI, Request, HTTPException, PlainTextResponse
from robokassa import verify_result_signature, build_ok_response

app = FastAPI()

@app.post("/robokassa/result")
async def result_url(req: Request) -> PlainTextResponse:
    form = dict(await req.form())
    if not verify_result_signature(form, password2="..."):
        raise HTTPException(status_code=403, detail="Bad signature")
    # ... persist the notification, mark invoice paid ...
    return PlainTextResponse(build_ok_response(form["InvId"]))

Use as an MCP server

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "robokassa": {
      "command": "uvx",
      "args": ["robokassa-mcp"],
      "env": {
        "ROBOKASSA_LOGIN": "your-shop-login",
        "ROBOKASSA_PASSWORD1": "password1",
        "ROBOKASSA_PASSWORD2": "password2",
        "ROBOKASSA_PASSWORD3": "password3"
      }
    }
  }
}

Claude Code

claude mcp add robokassa \
  -e ROBOKASSA_LOGIN=my-shop \
  -e ROBOKASSA_PASSWORD1=... \
  -e ROBOKASSA_PASSWORD2=... \
  -e ROBOKASSA_PASSWORD3=... \
  -- uvx robokassa-mcp

Cursor

Edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "robokassa": {
      "command": "uvx",
      "args": ["robokassa-mcp"],
      "env": {
        "ROBOKASSA_LOGIN": "your-shop-login",
        "ROBOKASSA_PASSWORD1": "password1",
        "ROBOKASSA_PASSWORD2": "password2",
        "ROBOKASSA_PASSWORD3": "password3"
      }
    }
  }
}

VS Code (GitHub Copilot)

In user or workspace settings.json:

{
  "github.copilot.chat.mcp.servers": {
    "robokassa": {
      "command": "uvx",
      "args": ["robokassa-mcp"],
      "env": {
        "ROBOKASSA_LOGIN": "your-shop-login",
        "ROBOKASSA_PASSWORD1": "password1",
        "ROBOKASSA_PASSWORD2": "password2",
        "ROBOKASSA_PASSWORD3": "password3"
      }
    }
  }
}

Windsurf

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "robokassa": {
      "command": "uvx",
      "args": ["robokassa-mcp"],
      "env": {
        "ROBOKASSA_LOGIN": "your-shop-login",
        "ROBOKASSA_PASSWORD1": "password1",
        "ROBOKASSA_PASSWORD2": "password2",
        "ROBOKASSA_PASSWORD3": "password3"
      }
    }
  }
}

HTTP transport (MCP Inspector, remote clients)

uvx robokassa-mcp --transport http --port 8000

Flags: --transport {stdio,http,streamable-http,sse}, --host, --port.

MCP tools exposed to agents

All 18 tools are wrapped as @mcp.tool() and available to any MCP-capable agent (Claude Desktop, Claude Code, Cursor, Windsurf, etc.).

Tool	Purpose	Auth
`create_invoice`	Build a signed checkout URL (optional 54-ФЗ receipt).	Password#1
`check_payment`	Get current state of a payment by InvId (via OpStateExt).	Password#2
`list_currencies`	List payment methods available to the shop.	—
`calc_out_sum`	Compute amount credited to shop for a given payment.	Password#1
`refund_create`	Initiate a refund (requires Refund API access).	Password#3 JWT
`refund_status`	Poll refund progress by requestId.	—
`verify_result_signature`	Validate a ResultURL webhook.	Password#2
`verify_success_signature`	Validate a SuccessURL redirect.	Password#1
`hold_init` / `hold_confirm` / `hold_cancel`	Two-step card pre-authorization.	Password#1
`init_recurring_parent` / `recurring_charge`	Subscription auto-charges.	Password#1
`build_split_invoice`	Marketplace multi-recipient checkout.	—
`send_sms`	Paid SMS service.	Password#1
`second_receipt_create` / `second_receipt_status`	54-ФЗ final receipt after advance.	Password#1
`partner_refund`	Alternative refund path for partner integrators.	Partner JWT

Low-level signature helpers are available from Python only: compute_signature, op_state_signature, build_checkout_signature, build_refund_jwt, build_sms_signature, compute_result_signature, compute_success_signature, encode_fiscal_body.

API coverage

Mapped against the 8 public Robokassa API groups:

Group	Coverage	Module
Merchant Checkout	✅ `create_invoice` (+ 54-ФЗ)	`robokassa.checkout`
XML Interfaces	✅ `check_payment`, `list_currencies`, `calc_out_sum`	`robokassa.xml_interface`
Refund API	✅ `refund_create`, `refund_status`	`robokassa.refund`
Holding / Pre-auth	✅ init / confirm / cancel	`robokassa.holding`
Recurring	✅ parent + child	`robokassa.recurring`
Fiscal 54-ФЗ	✅ second receipt create / status	`robokassa.fiscal`
Partner API	🟡 `partner_refund` only — see coverage notes	`robokassa.partner`
Auxiliary	✅ `send_sms`, webhook signatures, split payments	`robokassa.sms`, `robokassa.webhooks`, `robokassa.split`

Environment variables

Most high-level entry points fall back to these env vars when credentials aren't passed explicitly:

Variable	Required for
`ROBOKASSA_LOGIN`	All operations
`ROBOKASSA_PASSWORD1`	Checkout, webhook SuccessURL verification, CalcOutSumm, fiscal, SMS
`ROBOKASSA_PASSWORD2`	`check_payment` (OpStateExt), webhook ResultURL verification
`ROBOKASSA_PASSWORD3`	`refund_create`

Signature algorithms

All signature-producing helpers accept algorithm= with "md5" / "sha256" / "sha384" / "sha512" — match whatever is configured in your Robokassa cabinet.

Development

git clone https://github.com/artgas1/robokassa-mcp.git
cd robokassa-mcp
uv sync --all-extras --dev
uv run pytest            # 107+ unit tests
uv run ruff check .
uv run pyright

License

MIT — see LICENSE. Drop-and-forget maintenance; PRs welcome but not guaranteed to be reviewed promptly.

Robokassa Mcp— agent skill

Is Robokassa Mcp safe to install?

Install (once published)

Use as a Python library

Full refund flow

Webhook signature verification (FastAPI example)

Use as an MCP server

Claude Desktop

Claude Code

Cursor

VS Code (GitHub Copilot)

Windsurf

HTTP transport (MCP Inspector, remote clients)

MCP tools exposed to agents

API coverage

Environment variables

Signature algorithms

Development

License

Audit the pieces. Scan the whole. Decide.