Cred MCP Server

Create an end user, or return/update the existing one (email-first lookup, then external_id, so no duplicates). Returns created: true for a new user. Signup attribution is first-touch and optional: signup_url (else the connection's x-app-origin header) is recorded on a new user, or on an existing user that has none. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Delete an end user, identified by user_email (checked first) or external_id. Irreversible: balances, ledger and auto top-up rules go with them. A user with swap history is kept as a financial record — 409 USER_HAS_HISTORY (swap_transactions count). 404 USER_NOT_FOUND. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Read the EVM address on file for an end user, and whether the holder proved it by signature (verified, verified_at). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Attach an EVM address to an end user so on-chain credits mint to them. No signature required — the address is recorded as asserted by the operator, not proved (changing it clears any earlier verification). Only later deposits match it: a deposit already recorded as unattributed stays uncredited. Pass wallet_address as null to detach; balances are unaffected. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Update an existing end user (identify by user_email, checked first, or external_id). Only fields you pass change (none at all is 400 NO_FIELDS_TO_UPDATE); metadata replaces the whole object, except referral_code (kept unless you send it) and stripe_account_id (Cred-only: the stored value stays and a value you send is silently dropped). signup_* fields overwrite attribution (use to correct it). 404 USER_NOT_FOUND. To change a wallet use set_user_wallet. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Create a pricing tier. credits must be a positive integer; price (USD) must be 0 or at least 0.50, and at most $1.00 per credit. credit_type_ids lists the credit types a tier can be bought for; [] means every active credit type. Omit credit_type_ids for all types; malformed or foreign ids are rejected. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Permanently delete a pricing tier by id (404 if not in this project). While auto top-up rules buy the tier it refuses with 409 TIER_IN_USE and the rule count; pass force: true (after the user confirms) to delete those rules and the tier together. Deactivating a tier (update_pricing_tier is_active: false) keeps history but makes its auto top-up charges fail. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List active pricing tiers (credit packs), cheapest first; price is a dollar string. credit_type_ids lists the credit types a tier can be bought for; [] means every active credit type. The credit_type_id filter returns every tier purchasable for that type: tiers scoped to it plus tiers with [] (400 if it is not a UUID). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Update a pricing tier by id; only fields you pass change (same price rules as create). Pass credit_type_ids to re-scope it ([] = all credit types), is_active: false to stop selling it without deleting. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Delete a user's auto top-up rule for credit_type_id, or ALL their rules when credit_type_id is omitted. Returns the number deleted. To pause instead, save_auto_topup with enabled: false. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Get a user's auto top-up rule for credit_type_id (auto_topup, or null), or all their rules (auto_topups) when credit_type_id is omitted, plus their saved card. Rules show threshold, enabled, max_per_day, charges_last_24h, last_status/last_error and disabled_reason (set when cred turned a failing rule off). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Reserve credits: deducts amount from an existing user and parks it in a hold (status held), returning hold_id. Finish with capture_escrow_hold or release_escrow_hold; a hold past expires_at can be released back at any time. Pass idempotency_key on anything an agent might retry: a replay returns the original hold (idempotent_replay: true, with its current status) and holds nothing more; the same key on a different request is 409 IDEMPOTENCY_KEY_REUSED. Without a key every call places another hold. Errors: 400 INSUFFICIENT_CREDITS, 404 USER_NOT_FOUND. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List escrow holds, newest first, with total. Filter by status, holder or reference_id. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Create or replace the auto top-up rule for (user, credit type): whenever a deduct leaves the balance below threshold, cred buys one pack of pricing_tier_id on the user's saved card (at most max_per_day charges per 24h). If enabled and the balance is already below threshold, a charge starts right away. Saving also clears a rule cred disabled after failures. Requires a saved card to charge (a warning is returned if none); the tier must not be recurring-only. 404 USER_NOT_FOUND if the user does not exist. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Create or update a referral program: credits awarded to the referrer and to the referred user. With credit_type_id this writes THAT credit type's program (creating it if needed); without it, the project's default program. Only fields you pass change. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Remove a user's saved card (detached in Stripe). charge_saved_card and auto top-up stop working for them until a new card is saved. Returns deleted: false if there was none. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Get the card saved for a user (brand, last4, expiry), or payment_method: null if none. Cards are saved by a one-time create_checkout_session with save_payment_method: true. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Create a short-lived Stripe customer portal URL for a subscriber to update their card (flow payment_method_update, default) or see invoices and card (overview). Mint it when the customer asks; don't store it. With user_id/email, uses their most recent subscription. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Change a live subscription's quantity (seats/packs, 1–10000). CHANGES FUTURE BILLING: from the next renewal the customer pays unit price × quantity and receives unit credits × quantity; no proration now. With user_id/email the customer must have exactly one live subscription (else 409 — pass subscription_id). Same quantity is a no-op. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List this project's x402 stablecoin payments, newest first: kind, status, payer, amount_usd, transaction_hash, credits_granted, error. Authenticated (API key). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Discover how to pay Cred with x402 (HTTP 402 stablecoin payments): the accepted scheme, network, asset and prices. Pass project_id to also get that project's credit price list. Requires no credentials and costs no CRD.

Apply a referral code for a referred user, issuing the configured credits to the referee and the referrer. credit_type_id picks the credit type's program (default: the project's default program). defer_referrer_credits pays only the referee now; the referral stays pending until complete_referral pays the referrer. A user can be referred once per program (without credit_type_id: in the default program); a credit_type_id retry with the same code replays (replayed: true): errors 400 ALREADY_REFERRED, SELF_REFERRAL, INVALID_REFERRAL_CODE, or program inactive. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Get a user's credit balance(s). Identify the user by email (checked first) or user_id (your external user ID). An unknown user returns an empty balances array, not an error. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Create or update up to 1000 users in one call (one CRD for the batch). Returns counts of created/updated and per-row errors; a bad row does not fail the batch. A row's own signup_url/signup_host overrides the request-level signup_url. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

MOVES MONEY: buy a project's credits by paying in stablecoin over x402. Call once without x402_payment to receive the payment requirements (returned as an error result containing the x402 PaymentRequired object), sign them with your wallet, then call again passing the base64 payment payload as x402_payment. Requires no API key — the payment is the credential — and costs no CRD.

Cancel a subscription. By default it cancels at period end (credits already issued stay; no further renewals). at_period_end: false cancels immediately with no refund. With user_id/email instead of subscription_id, every live subscription of that customer is canceled. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Settle a hold (status captured). amount captures part (default: all); the uncaptured remainder returns to the holder. With to_user_id/to_user_email the captured credits go to that user (created if new) — marketplace/P2P settlement; otherwise they stay deducted (settled to the platform). 409 HOLD_NOT_ACTIVE if already settled, 400 CAPTURE_EXCEEDS_HELD. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

MOVES MONEY: charge a user's saved card off-session for one pack of a one-time pricing tier and credit it. idempotency_key is required; a retry with the same key never charges twice and returns the first outcome (replayed: true). Outcomes: 200 status succeeded (credits, new_balance); 202 status processing (not yet settled — retry later with the SAME key to check, never a new key); 402 status failed with code/decline_code (requires_action: true means the buyer must pay through checkout instead). Other errors: 404 no_saved_payment_method, 409 saved_payment_method_unusable, 400 tier_not_one_time, 502 charge_not_started (retry with the same key). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Create a Stripe Checkout link for an end user to buy credits; returns checkout_url and session_id. Nothing is charged until the buyer pays on that page; credits are issued when payment completes. Price either a pricing tier (pricing_tier_id, optionally × quantity) or a custom amount (credit_type_id + amount credits, priced at the credit type's exchange_rate). billing: "recurring" creates a subscription (tier required; billing_type recurring or both), credited on every paid invoice; otherwise it is a one-time purchase even on a recurring tier. save_payment_method: true (one-time only) keeps the card for charge_saved_card and auto top-up. success_url and cancel_url must be https on a Cred host or a domain listed under Dashboard → Payments → Allowed redirect domains; on any other domain the link is still created and silently redirects to Cred's default pages. Requires an sk_live_ API key. Not CRD-metered.

Pay the referrer of a referral applied with defer_referrer_credits. user_id is the REFERRED user. Safe to repeat: the payout is keyed per referral; an already completed referral answers already_completed true. 404 NO_REFERRAL. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List the project's active credit types: id, name, symbol, description, exchange_rate (USD per credit), is_redeemable, and on-chain fields (is_on_chain, blockchain, contract_address, chain_id, token_decimals, mint_on_issue, deployment_type). Use the id as credit_type_id in other tools. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Deduct (spend) credits from an existing user, identified by user_email (checked first) or user_id. Fails with 400 INSUFFICIENT_CREDITS (nothing deducted) or 404 USER_NOT_FOUND. Pass idempotency_key on anything an agent might retry: a replay returns the original transaction with idempotent_replay: true and charges nothing more. Without a key, every call deducts again. auto_topup_triggered: true means the balance fell below the user's auto top-up threshold and a saved-card purchase started. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List on-chain token deposits observed for the project, newest first (read-only; the chain ingest writes them). status: credited (credits granted), unattributed (sent from an address no user had; held, not credited, and attaching the address with set_user_wallet only matches later deposits), observed (awaiting processing) or rejected. A user filter for an unknown user is 404 USER_NOT_FOUND. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Swap a user's credits along a swap pair: deducts source_amount of the source type and credits the converted amount (after fee) in the target type. Errors: 400 INSUFFICIENT_CREDITS, 404 USER_NOT_FOUND, 400 outside min/max. On a bidirectional pair, direction "reverse" spends the target type for the source type at 1/rate (else 400 SWAP_NOT_BIDIRECTIONAL). Pass an idempotency_key so a retry replays the original swap (idempotent_replay: true); the same key on a different request is 409 IDEMPOTENCY_KEY_REUSED. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Get a user's referral code, generating one if they have none (creates the user if needed). Safe to repeat. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Issue (add) credits to a user; creates the user if they don't exist (email-first lookup). Pass idempotency_key on anything an agent might retry: a replay returns the original transaction with idempotent_replay: true and issues nothing more (no second webhook or mint). Without a key, every call issues again. For on-chain credit types with mint_on_issue, the response includes on_chain mint status. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Create (or reuse) a Stripe Express connected account for an end user and return an onboarding URL for them to complete. The resulting stripe_account_id (acct_…) is stored on the user; pass it as destination to redeem_credits. return_url and refresh_url must be https on a Cred host or a domain listed under Dashboard → Payments → Allowed redirect domains, else 400 REDIRECT_NOT_ALLOWED. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

MOVES MONEY: cash out a user's credits as a Stripe transfer to a connected account. Deducts `amount` credits and pays amount × the credit type's exchange_rate (USD per credit; the rate cannot be overridden). The credit type must be redeemable (else 400 NOT_REDEEMABLE). destination must be this user's own account from onboard_payout_account (else 400 INVALID_DESTINATION). Pass idempotency_key: a retry with the same key returns the first result (idempotent_replay: true) and never deducts or pays twice; without one, reference_id is the key, and with neither every call redeems again. 502 PAYOUT_PENDING means Stripe's answer was lost: retry with the SAME key (idempotency_key in the error) to finish it — if nobody retries, the reconciliation sweep settles it after ~15 minutes (paid, or credits returned only if Stripe definitely refused); a claim it cannot settle safely is flagged for manual review. Errors: 400 INSUFFICIENT_CREDITS, 400 PAYOUT_TOO_SMALL, 404 USER_NOT_FOUND, 402 STRIPE_TRANSFER_FAILED (credits restored), 409 IDEMPOTENCY_KEY_REUSED. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Get a referral program's settings (is_active, referrer/referee credits, credit type). A project can run one program per credit type: pass credit_type_id for that credit type's program (settings null when it has none); omit it for the project's default program. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List the project's referrals, filterable by status, referrer or credit type (program). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Refund or reverse credits. MOVES MONEY for purchases: with purchase_id or stripe_payment_intent_id it refunds the Stripe charge (prorated when partial; refund_payment: false skips the money) and claws the purchased credits back. With transaction_id (or reference_id = latest matching transaction) it reverses that ledger entry: an issue is clawed back, a deduct is returned to the user. Pass exactly one source. amount refunds part (default: all). idempotency_key is required here: retry with the same key to get the first result (idempotent_replay: true). Errors: 404 PURCHASE_NOT_FOUND / TRANSACTION_NOT_FOUND, 409 ALREADY_REFUNDED, 400 REFUND_EXCEEDS_ORIGINAL, 400 INSUFFICIENT_CREDITS (user already spent them), 400 NOT_REFUNDABLE (redeem/escrow entries), 402 STRIPE_REFUND_FAILED (no credits changed). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Release a held hold in full back to its holder (status released). 404 HOLD_NOT_FOUND, 409 HOLD_NOT_ACTIVE if it was already released, captured or expired — so a retry after success is rejected, not repeated. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Step 1 of proving an end user controls an address: get a single-use message for them to sign. The message names the operator's project and must be shown to the user unmodified. Expires in ten minutes. Then call verify_wallet_signature with the nonce and the signature their wallet produces. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Signup attribution breakdown per signup_host (which of your apps users came from): users, purchases and revenue per host over the last `days` (default 30; 0 = all time). Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List recurring credit subscriptions (newest 100): status, credits_per_period, quantity, price, interval, current_period_end, cancel_at_period_end. status: "active" matches active, trialing and past_due. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List credit swap pairs (exchange_rate, fee_percent, min/max_swap_amount, is_bidirectional). Optionally filter by source or target credit type. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

List ledger transactions, newest first (types include issue, deduct, refund). Filter by user (email or user_id) and credit_type_id; paginate with limit/offset. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Look up one end user by email or external_id (404 USER_NOT_FOUND if absent), or list users newest first with total, filterable by signup_host / signup_credit_type_id. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.

Step 2: submit the personal_sign signature over the challenge message. On success the address is stored and marked verified. A challenge is single-use and a rejected signature consumes it too — a retry needs a fresh challenge. Costs 1 CRD (platform credit) per call, charged even when the call is then rejected (a 429 RATE_LIMITED costs nothing). Error results include request_id; quote it to support.