3neti / x-mcp

v0.3.1 2026-10-12 05:13 UTC

Requires

• php: ^8.3
• illuminate/contracts: ^13.0
• illuminate/http: ^13.0
• illuminate/routing: ^13.0
• illuminate/support: ^13.0
• laravel/mcp: ^0.7

Requires (Dev)

• laravel/pint: ^1.0
• orchestra/testbench: ^11.0
• pestphp/pest: ^4.0
• pestphp/pest-plugin-laravel: ^4.0

MIT

• Lester B. Hurtado

Published on Packagist.org on 2026-10-12 06:49 UTC

README

3neti/x-mcp exposes AI-native tools for the X-Change Partner API. It is a transport adapter, never an alternate financial authority.

Boundary

Every tool calls the configured Partner API over authenticated HTTP. This package does not depend on 3neti/x-change and cannot call its Actions, models, Treasury services, provider adapters, or legacy lifecycle API.

Installation

composer require 3neti/x-mcp

XMCP_ENABLED=true
XMCP_PUBLIC_DISCOVERY_ENABLED=true
XMCP_API_BASE_URL=https://your-host.example/api/partner/v1
XMCP_ACCESS_CONTACT=[e-mail]
XMCP_EXPECTED_PARTNER_CONTRACT_VERSION=1.5.0

Confirm local commissioning before connecting an AI client:

php artisan x-mcp:doctor

The MCP client sends the same short-lived OAuth client-credentials bearer token used by the Partner API to /mcp/x-change. The token must include capabilities:read plus the scopes required by the tools it will use.

Initial tools

• inspect_capabilities
• estimate_pay_code
• issue_pay_code
• get_pay_code
• cancel_pay_code
• create_funded_order
• get_funded_order

Issuance, cancellation, and funded-order creation require explicit confirmation and caller-supplied stable idempotency keys. The funded-order tools require separate scopes and use customer payment under the commissioned Commercial Principal. Partner API ownership, payment verification, Treasury, pricing, scope, and mandate controls remain authoritative.

There is no self-service OAuth client registration.

Public discovery is available at /.well-known/x-change-mcp. It exposes only the endpoint, authentication model, tool names, and access-contact policy—never client credentials, bearer tokens, account identity, Treasury data, or claim evidence.

Public On-Demand Issuance

An optional, separate server at /mcp/x-change/public exposes only anonymous, read-only discovery, estimation, and browser-handoff tools. It never creates a funding order, accepts payment, reserves funds, issues a Pay Code, or returns a possession credential.

XMCP_PUBLIC_ISSUANCE_ENABLED=true
XMCP_PUBLIC_ISSUANCE_API_BASE_URL=https://your-host.example/api/x/v1/public-issuance

Its discovery document is /.well-known/x-change-public-mcp. Native financial mutations require a separately approved Partner OAuth client and use the authenticated /mcp/x-change server.

The canonical URL, API, and Voucher-instruction parameter contract belongs to x-change. See the Public AI Issuance Integration Guide. In particular, the browser accepts amount and currency, while the API and MCP tools accept amount_minor and currency; arbitrary Voucher instructions are not public query parameters.