Secure Serverless Dodo Payments MCP Server

Overview

The Secure Serverless Dodo Payments MCP Server is a lightweight Node.js component that exposes payment-related operations as machine-executable tools for AI agents using the Model Context Protocol (MCP). It acts as a small facade between your Dodo Payments account and an AI agent, converting agent tool calls into securely authenticated calls to the Dodo Payments API. Because it is intentionally minimal and dependency-light, it is suitable for serverless deployments (Vercel, Netlify, AWS Lambda) and local testing.

Using an MCP server for payments gives you two primary benefits: secure credential handling and a constrained surface for agent-driven actions. Instead of giving an AI direct access to raw API keys or broad API endpoints, you publish a curated set of tools (for example: createPayment, capturePayment, refundPayment) that the agent can invoke. The MCP server validates and translates those invocations into Dodo Payments API calls, returning structured results the agent can reason about.

Features

• Exposes payment operations as MCP-compatible tools for AI agents
• Minimal, serverless-friendly Node.js implementation
• Centralized credential and request validation to protect API keys
• Standardized JSON inputs/outputs for reliable agent integration
• Ready to deploy to serverless platforms (Vercel, Netlify, AWS Lambda)
• Simple local dev workflow for testing and debugging

Installation / Configuration

Clone and run the MCP server locally from the repository package:

git clone https://github.com/dodopayments/dodopayments-node.git
cd dodopayments-node/packages/mcp-server
npm install

Configure environment variables (example .env):

# Required
DODO_API_KEY=sk_live_xxx            # Your Dodo Payments secret key
DODO_API_BASE=https://api.dodopayments.example.com

# Optional / Server settings
PORT=3000
MCP_SERVER_PREFIX=/mcp               # base path for MCP endpoints
ALLOW_ORIGINS=https://your-app.example.com

Start locally (development):

npm run dev
# or
node src/index.js

Deploy to serverless platforms by providing the same environment variables. The codebase is intentionally simple so it can be wrapped with serverless handlers (see example below).

Example serverless handler (AWS Lambda via serverless-http):

// handler.js
const server = require('./dist/server'); // express app built by package
const serverless = require('serverless-http');

module.exports.handler = serverless(server);

Configuration Table

Available Tools / Resources

The MCP server publishes a small, curated toolset (names and inputs are illustrative and match typical payment flows):

• createPayment

  • Description: Initiates a payment intent or charge.
  • Input: { amount: number, currency: string, customer: {name, email}, metadata?: object }
  • Output: { id, status, amount, currency, checkoutUrl? }

• getPayment

  • Description: Retrieve payment details by ID.
  • Input: { paymentId: string }
  • Output: { id, status, amount, currency, createdAt, metadata }

• capturePayment

  • Description: Capture a previously authorized payment.
  • Input: { paymentId: string, amount?: number }
  • Output: { id, status, capturedAmount }

• refundPayment

  • Description: Issue a (partial) refund.
  • Input: { paymentId: string, amount?: number, reason?: string }
  • Output: { id, refundId, status, refundedAmount }

• listPayments

  • Description: List recent payments with pagination.
  • Input: { limit?: number, after?: string }
  • Output: { data: […], hasMore: boolean }

The MCP server also exposes a discovery endpoint (typically under the MCP prefix) where agents can fetch the JSON tool catalog to learn names, input schemas, and descriptions. Consult the running server’s /tools or /describe endpoints for the exact path.

Example: Invoking a Tool

A typical MCP tool call is an HTTP POST to the server’s invoke endpoint. Example (curl):

curl -X POST "http://localhost:3000/mcp/invoke" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "createPayment",
    "input": {
      "amount": 1200,
      "currency": "USD",
      "customer": {"name": "Alice", "email": "[email protected]"},
      "metadata": {"orderId":"ORD-123"}
    }
  }'

Sample response:

{
  "ok": true,
  "result": {
    "id": "pay_abc123",
    "status": "pending",
    "amount": 1200,
    "currency": "USD",
    "checkoutUrl": "https://pay.dodopayments.example.com/checkout/pay_abc123"
  }
}

Use Cases

• AI Checkout Assistant: Integrate with a conversational agent that can create payment intents or send checkout links when customers request to complete an order.
• Automated Refunds: An operations bot receives structured dispute data and invokes refundPayment with reason and amount to handle routine refunds.
• Reconciliation Workflows: A backend agent periodically calls listPayments and getPayment to reconcile transactions and update order statuses.
• Guided Support Flows: A support assistant leverages getPayment and capturePayment to review and complete pending authorizations while enforcing business rules server-side.

Security Considerations

• Never embed DODO_API_KEY in client-side code. Keep keys in server environment variables and restrict access.
• Use CORS and origin checks (ALLOW_ORIGINS) to limit which UIs can call the MCP server directly.
• Consider rate-limiting and authentication on the MCP endpoints to protect against abuse by compromised agents or clients.
• Log minimally and avoid