Razorpay MCP Server: Tools, Setup and Security

The Razorpay MCP server lets an AI app work with Razorpay's payment APIs. It can fetch and capture payments, create orders and payment links, issue refunds, manage QR codes and pull settlement reports. Razorpay publishes it as an official open-source project, with a hosted remote server and a local Docker image.

Checked against: Razorpay's official MCP server README on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

The README lists tools in these groups. Tools marked local-only are not on the remote server.

• Payments: capture_payment, fetch_payment, fetch_payment_card_details, fetch_all_payments, update_payment, initiate_payment, resend_otp, submit_otp.
• Payment links: create_payment_link, create_payment_link_upi, fetch_all_payment_links, fetch_payment_link, send_payment_link, update_payment_link.
• Orders: create_order, fetch_order, fetch_all_orders, update_order, fetch_order_payments.
• Refunds: create_refund (local only), fetch_refund, fetch_all_refunds, update_refund, fetch_multiple_refunds_for_payment, fetch_specific_refund_for_payment.
• QR codes: create_qr_code, fetch_qr_code, fetch_all_qr_codes, fetch_qr_codes_by_customer_id, fetch_qr_codes_by_payment_id, fetch_payments_for_qr_code, close_qr_code (local only).
• Settlements: fetch_all_settlements, fetch_settlement_with_id, fetch_settlement_recon_details, create_instant_settlement (local only), fetch_all_instant_settlements, fetch_instant_settlement_with_id.
• Payouts: fetch_all_payouts, fetch_payout_by_id.
• Saved payment methods: fetch_tokens, revoke_token.
• Other: create_registration_link (local only), plus integration helpers detect_stack and integrate_razorpay_checkout.

How to connect it

Remote server. Create your merchant token from your API key and secret, as Razorpay describes:

echo <RAZORPAY_API_KEY>:<RAZORPAY_API_SECRET> | base64

Then add the server. Razorpay's Claude Desktop example:

{
  "mcpServers": {
    "rzp-mcp-server": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mcp.razorpay.com/mcp",
        "--header",
        "Authorization: Basic <Merchant Token>"
      ]
    }
  }
}

The README also gives configs for Cursor and VS Code. The VS Code example prompts for the token as a password input instead of storing it in the file.

Local server. Razorpay recommends its public Docker image razorpay/mcp. You pass RAZORPAY_KEY_ID and RAZORPAY_KEY_SECRET as environment variables. The local server supports these flags:

• --read-only (or READ_ONLY): run in read-only mode.
• --toolsets (or TOOLSETS): enable only listed toolsets.
• --log-file: write logs to a file.

Security notes

• Money-moving tools. capture_payment moves a payment from authorized to captured. initiate_payment starts a payment with a saved payment method, and submit_otp completes it. create_refund and create_instant_settlement move money but are local-only. The README does not describe a server-side approval step.
• Read-only mode. For reporting and reconciliation, run the local server with --read-only and only the toolsets you need.
• Card and token data. fetch_payment_card_details and fetch_tokens return sensitive payment data. Keep them out of agents that do not need them. See data exfiltration through MCP.
• Credential handling. The merchant token is just your key and secret encoded in Base64. It is not encrypted. Treat it like the secret itself. See secrets and credential leakage in MCP.
• Test mode. Use Razorpay test-mode keys while you build prompts.
• What the spec says. The MCP tools specification says there SHOULD always be a human in the loop who can deny tool calls. The spec's security best practices also recommend scope minimization.

The MCP security center has more on locking down payment servers.

Alternatives

• Stripe MCP server: remote, with server-side approval for refunds.
• PayPal MCP server: local or remote, with sandbox endpoints.
• Paddle MCP server: local, with read-only and non-destructive filters.

Next step

For most teams, the safest first use is read-only settlement and refund reporting. If you want a custom agent that only exposes a handful of Razorpay actions, our MCP development team can build it. Browse the MCP server directory for more.

Frequently asked questions