Airwallex MCP Server: Tools, Setup and Security

Airwallex's AgentOS MCP server lets an AI app act on a production Airwallex account: read balances, create beneficiaries, issue cards and build cashflow reports. Airwallex publishes and hosts it, along with a sandbox Developer MCP and a documentation-only Docs MCP for people building integrations.

Checked against: Airwallex's AgentOS docs on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

Airwallex describes three connectors:

The AgentOS page says AgentOS MCP reads and writes production resources and can search Airwallex product, API and SDK docs. Airwallex does not publish a tool-by-tool list on that page.

AgentOS also ships skills, which are pre-built workflows that run through the MCP server or the Airwallex CLI:

• contract-to-billing: pull billing details from contracts or quotes and create invoices and subscriptions.
• beneficiary-creation: extract bank details from supplier documents and create beneficiaries.
• card-provisioning: create cardholders and issue virtual or physical cards with spend limits.
• manage-cashflow: aggregate balances, receivables and obligations and analyze FX exposure.
• awx-best-practices: an always-on guardrail for other tasks.

The Developer MCP page says its testing tools "run in sandbox only."

How to connect it

Claude Code (AgentOS MCP):

claude mcp add-json airwallex '{ "type": "http", "url": "https://mcp.airwallex.com/mcp" }'

Airwallex also offers a plugin that installs the connector and skills together:

claude plugin install airwallex-agentos@claude-plugins-official

Claude.ai and Claude Cowork: find the official airwallex-agentos connector in Settings > Connectors and connect. Claude starts the OAuth flow.

Cursor:

{
  "mcpServers": {
    "airwallex": {
      "type": "http",
      "url": "https://mcp.airwallex.com/mcp"
    }
  }
}

Other agents: connect to https://mcp.airwallex.com/mcp and complete the OAuth flow. For sandbox work, swap in the Developer MCP URL.

Security notes

Airwallex's safety guidance is specific:

• No money out. AgentOS components don't initiate transfers, FX conversions or payouts, and are instructed not to where the API allows them.
• Approve tool calls. Write tools are annotated so clients can ask for confirmation. Airwallex says to disable "Auto-Run or Dangerously Skip Permissions."
• Prompt injection. Treat untrusted documents and web pages as a risk, and review every tool call, "including reads that could exfiltrate account data."
• One trusted server set. A malicious server in the same client could steer the agent into leaking Airwallex data.
• No shared channels. Don't add the agent to multi-user channels such as Slack. Anyone who can prompt it could act with your privileges.
• Narrow scopes. Grant only the OAuth scopes you need, and disconnect if you lose trust in a session.

See our guides to tool poisoning and approval fatigue, and the MCP security center.

Alternatives

• Mercury, where payment requests need approval in Mercury.
• Ramp, for cards, spend and approvals.
• Stripe, for payments and billing.

Browse the MCP server directory.

Next step

Thinking about letting an agent touch live payment accounts? Our MCP readiness audit checks scopes, approvals and logging first.

Frequently asked questions