M-Pesa Daraja runs on your own machine — the client starts it, so there is no endpoint to ping. 436 installs a week from pypi. Last commit 3 Nov 2026.
Safaricom M-Pesa Daraja tools: STK Push, C2B, B2C, B2B, QR, Ratiba. Sandbox-first, idempotent.
What the code does
We read the source, 4 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
res = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add mpesa-daraja-mcp -e 'DARAJA_CONSUMER_KEY=<DARAJA_CONSUMER_KEY>' -e 'DARAJA_CONSUMER_SECRET=<DARAJA_CONSUMER_SECRET>' -- uvx mpesa-daraja-mcp{
"mcpServers": {
"mpesa-daraja-mcp": {
"command": "uvx",
"args": [
"mpesa-daraja-mcp"
],
"env": {
"DARAJA_CONSUMER_KEY": "<DARAJA_CONSUMER_KEY>",
"DARAJA_CONSUMER_SECRET": "<DARAJA_CONSUMER_SECRET>"
}
}
}
}[mcp_servers.mpesa-daraja-mcp]
command = "uvx"
args = ["mpesa-daraja-mcp"]
env = { DARAJA_CONSUMER_KEY = "<DARAJA_CONSUMER_KEY>", DARAJA_CONSUMER_SECRET = "<DARAJA_CONSUMER_SECRET>" }{
"mcpServers": {
"mpesa-daraja-mcp": {
"command": "uvx",
"args": [
"mpesa-daraja-mcp"
],
"env": {
"DARAJA_CONSUMER_KEY": "<DARAJA_CONSUMER_KEY>",
"DARAJA_CONSUMER_SECRET": "<DARAJA_CONSUMER_SECRET>"
}
}
}
}{
"servers": {
"mpesa-daraja-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"mpesa-daraja-mcp"
],
"env": {
"DARAJA_CONSUMER_KEY": "<DARAJA_CONSUMER_KEY>",
"DARAJA_CONSUMER_SECRET": "<DARAJA_CONSUMER_SECRET>"
}
}
}
}Put your own values in place of
<DARAJA_CONSUMER_KEY> (Daraja app Consumer Key), <DARAJA_CONSUMER_SECRET> (Daraja app Consumer Secret).
The author’s registry entry marks them as required.
Optional settings from the registry entry, left out of the block above:
DARAJA_ENV (sandbox (default) or production), DARAJA_SHORTCODE (Paybill / store number (174379 in sandbox)), DARAJA_PASSKEY (M-Pesa Express passkey (STK Push)), DARAJA_INITIATOR_NAME (API operator username (B2C, B2B, status, balance, reversal)), DARAJA_SECURITY_CREDENTIAL (Encrypted initiator password), DARAJA_CALLBACK_BASE_URL (Public HTTPS base for callback URLs), DARAJA_CALLBACK_LISTEN (host:port for the built-in callback receiver), DARAJA_CALLBACK_TOKEN (16+ random characters; secret path for callbacks), DARAJA_TOOLSETS (Comma list: stk,c2b,payouts,ops,qr,ratiba,billmanager), DARAJA_READ_ONLY (true hides every tool that moves money or writes), DARAJA_APPROVAL_THRESHOLD (Payouts above this many shillings need approval in the chat), DARAJA_ALLOWED_RECIPIENTS (Comma list of phones/shortcodes that payouts may go to), DARAJA_ALLOW_LIVE_MONEY_MOVEMENT (true to allow production charges and payouts), DARAJA_INITIATOR_PASSWORD (Initiator password, encrypted into SecurityCredential at startup (alternative to DARAJA_SECURITY_CREDENTIAL)), DARAJA_CERT_PATH (Path to Safaricom's public certificate, used with DARAJA_INITIATOR_PASSWORD), DARAJA_STATE_DB (Path of the SQLite file that stores request state and callbacks), DARAJA_OUTPUT_DIR (Directory where generated QR PNGs are saved), DARAJA_CONFIG_DIR (Directory holding the saved config (default: user config dir)), DARAJA_DOTENV (Path of a .env file to load instead of the project one), DARAJA_MCP_TOKEN (Bearer token for HTTP mode (32+ random characters)), DARAJA_MCP_HOST (HTTP mode bind address (default 127.0.0.1)), DARAJA_MCP_PORT (HTTP mode port (default 8000)), DARAJA_FORWARD_URL (Your app's URL: every callback is POSTed on to it, HMAC-signed), DARAJA_FORWARD_SECRET (HMAC secret for forwarded callbacks (16+ characters)).
Alternatives to M-Pesa Daraja
same job, measured the same wayM-Pesa Daraja and Africa's Talking MCP server: 24 tools; live payments and SMS need confirmation.
Persistent Python sandbox for token-efficient codebase exploration in MCP clients
Your code review comments from Reado, the read-first IDE, as context and tools for your agent.
Coldrig — cold-email infra run by your agent: 28 MCP tools, live sending, free sandbox, from $99/mo.
Build and publish static sites on dotsy with draft-first MCP tools, OAuth Connect, and API keys.
Live stock quotes, a stock screener, crypto prices and FX rates as agent tools.
Drafts a network allow list for agent tools and runs them in a network-blocked sandbox.
MCP-first toolbox for agents: KV storage, auth, queue, and utility tools. Free in early access.
M-Pesa Daraja — questions
Answers built from our own checks of this server.