v0.2.0 — Opt-in initialize-transaction write tool

This release adds the package's first write tool — strictly opt-in, disabled by default.

✨ New: initialize-transaction tool

Create a Credo payment (checkout link) from your AI client:

"Create a ₦1,500 payment link for order ORDER-1"
→ initialize-transaction(amount: 1500.0, email: "buyer@example.com", reference: "ORDER-1")

Returns the authorization_url to send the customer to, plus both transaction references, the CRN, and a suggested next step (verify server-side with verify-transaction before delivering value).

How the gate works

• The tool is not registered unless the server runs with CREDO_MCP_ALLOW_WRITES=true — AI clients cannot even discover it on read-only deployments (verified over a real stdio session).
• It's annotated destructiveHint + openWorldHint (not read-only) so careful AI clients ask before creating payments.
• The server's instructions tell the model to prefer read-only tools unless the user explicitly asks to create a payment.
• The tool itself double-checks the flag at call time and returns a clear error if writes were disabled after startup.

Inputs

Argument	Required	Notes
amount	✅	Major units, e.g. 1500.0 for ₦1,500.00
email	✅	Customer email
currency	—	ISO code, validated against the installed package's supported currencies
reference	—	Reuse a pending business reference instead of creating a duplicate payment
callback_url	—	Defaults to the package's configured callback URL

🔒 Security posture unchanged in spirit

Read-only remains the default for every deployment. The new tool only creates a checkout link — it cannot complete or move a payment by itself; a customer must still authorize it, and you should verify server-side before fulfilling orders. Keys never leave the server.

✅ Quality

• 18 Pest tests (52 assertions) — including gate-off/gate-on registration, Http::assertNothingSent() when disabled, payload assertion (amount correctly converted to kobo), and Credo rejection handling
• Real stdio smoke test: tools/list shows 2 tools with writes off, 3 with writes on
• CI matrix green: PHP 8.2–8.4 × Laravel 11 / 12

📦 Upgrade

composer update zowesoft/laravel-credo-mcp

No breaking changes. To enable the write tool, set CREDO_MCP_ALLOW_WRITES=true in your environment and restart php artisan mcp:start credo.

v0.1.0 — Read-only Credo MCP server

The first release of zowesoft/laravel-credo-mcp — an MCP (Model Context Protocol) server for the Credo payment gateway, built on Laravel MCP and powered by zowesoft/laravel-credo.

Let any AI client — Claude Desktop, Claude Code, Cursor, Laravel Boost — verify Credo transactions and validate webhook signatures through natural language, using your app's configured Credo keys. Every tool is read-only: the server never moves money.

✨ Features

CredoServer

A Laravel MCP server that auto-registers as a local (stdio) server under the credo handle. Connect with:

php artisan mcp:start credo

verify-transaction tool

Verify a payment by its transaction reference (transRef), optionally checking the paid amount and currency against expectations (powered by Transaction::matches() from the core package). Returns a structured summary: status, amount, currency, fees, customer email, both references, and a matches_expectations checklist result.

verify-webhook-signature tool

Validate an inbound Credo webhook (X-Credo-Signature header + JSON body) against your configured secret key. Returns the verified event type and a transaction summary — perfect for debugging webhooks. Works fully offline.

Package niceties

• Publishable config (php artisan vendor:publish --tag=laravel-credo-mcp-config) with CREDO_MCP_ENABLED and CREDO_MCP_LOCAL_HANDLE env overrides
• Both tools annotated readOnlyHint + idempotentHint so AI clients treat them safely
• Secret keys stay server-side; they are never sent to the model or MCP client

📋 Requirements

• PHP 8.2+
• Laravel 11.45+, 12, or 13
• zowesoft/laravel-credo ^1.0

✅ Quality

• 10 Pest tests (32 assertions), covering both tools end-to-end plus server registration
• CI matrix: PHP 8.2 / 8.3 / 8.4 × Laravel 11 / 12 — all green
• Pint (Laravel preset) code style enforced in CI

📦 Install

composer require zowesoft/laravel-credo-mcp

Once the package is approved on Packagist, the command above works as-is. Until then, add a repositories entry pointing at the GitHub repo with "type": "vcs".