orcaqubits/ap2-mcp-server
dist/cursor/ap2-agentic-payments/skills/ap2-mcp-server/SKILL.md
Implement AP2 MCP servers — payment tools exposed via Model Context Protocol for agent access to payment capabilities. Use when building MCP-based payment tool integrations for AP2.
$ install --global
skillsauthnpx skillsauth add orcaqubits/agentic-commerce-claude-plugins ap2-mcp-serverInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 9, 2026, 6:51 AM151.3s1 file scanned
SKILL.md
- name:
- ap2-mcp-server
- description:
- >
AP2 MCP Server Integration
Before writing code
Fetch live docs:
- Fetch
https://ap2-protocol.org/specification/for MCP server references - Fetch
https://ap2-protocol.org/topics/ap2-a2a-and-mcp/for MCP integration details - Fetch
https://ap2-protocol.org/roadmap/to check MCP server availability status - Web-search
site:github.com google-agentic-commerce AP2 MCP serverfor MCP implementations
Conceptual Architecture
AP2 + MCP
While AP2's primary integration is with A2A (agent-to-agent), it also integrates with MCP (Model Context Protocol) for tool-based access to payment capabilities:
- A2A — Agent-to-agent: Shopping Agent ↔ Merchant Agent communication
- MCP — Agent-to-tool: Agent accessing payment APIs as tools
MCP's Role in the Stack
MCP provides the foundational layer for connecting agents to external resources:
Agent
├── A2A → Other Agents (Merchant, CP, MPP)
└── MCP → Payment Tools (APIs, databases, services)
AP2 MCP Server
The AP2 MCP server exposes payment-related tools that agents can call:
- Payment method management tools
- Mandate creation and signing tools
- Transaction status tools
- Receipt retrieval tools
Roadmap Status
The AP2 roadmap includes:
- V0.1: A2A extension (primary), MCP server v0.1
- V1.x: MCP-based implementation sequence diagrams, expanded MCP support
Check the latest roadmap and GitHub for current MCP server availability.
MCP Tool Patterns for Payments
Note: The following tool names are entirely speculative/hypothetical examples illustrating what an AP2 MCP server might expose. They are not from any published AP2 MCP server specification or implementation. Always check the latest AP2 roadmap and GitHub repositories for actual MCP tool definitions.
Hypothetical AP2 MCP tools:
| Tool | Description |
|------|-------------|
| list_payment_methods | Get available payment methods for a user |
| create_intent_mandate | Build an Intent Mandate from shopping parameters |
| create_cart_mandate | Build a Cart Mandate from product/price details |
| validate_mandate | Verify mandate signatures and contents |
| process_payment | Submit a payment for processing |
| get_transaction_status | Check payment processing status |
| get_receipt | Retrieve a payment receipt |
When to Use MCP vs A2A for Payments
| Scenario | Use | |----------|-----| | Agent calling another agent (Merchant, CP) | A2A | | Agent calling a payment API/tool directly | MCP | | Multi-step agent negotiation | A2A | | Simple payment status check | MCP | | Complex multi-party flow | A2A | | Tool-based payment method query | MCP |
Integration Architecture
Shopping Agent
├── A2A → Merchant Agent
├── A2A → Credentials Provider Agent
├── MCP → Payment Tools Server
└── MCP → Product Catalog Server
Best Practices
- Use A2A for multi-party payment flows (the primary AP2 pattern)
- Use MCP for single-call tool operations (status checks, receipts)
- Don't expose raw payment credentials through MCP tools
- Follow the same security model (VDCs, signing) regardless of transport
- Check the roadmap for MCP server maturity before relying on it
- Test MCP tools alongside A2A flows for consistency
Fetch the latest roadmap and any published MCP server implementations for exact tool schemas and availability before implementing.
Related Skills
orcaqubits/spree-headless-storefront
development
VerifiedTrustedCommunity
Build with Spree's headless Next.js storefront — the official `spree/storefront` repo (Next.js 16 App Router with Server Actions and Turbopack, React 19 Server Components, Tailwind CSS 4, TypeScript 5, `@spree/sdk`, Sentry), server-only auth (httpOnly JWT cookies + publishable key), MeiliSearch faceted catalog, one-page checkout with Apple/Google Pay/Klarna/Affirm/SEPA, multi-region market routing, GA4 + JSON-LD SEO, and Vercel/Docker deployment. Use when forking or customizing the storefront, or evaluating headless adoption.
27SKILL.mdUpdated May 14, 2026
orcaqubits/spree-extensions
tools
VerifiedTrustedCommunity
Build Spree extensions as Rails engines — gem scaffolding, `bin/rails g spree:extension`, mounting routes/migrations/assets, the modern `prepend` decorator pattern (`*_decorator.rb` with `self.prepended(base)`), generators (`spree:model_decorator`, `spree:controller_decorator`), the four customization surfaces in preference order (Events > Webhooks > Dependencies > Decorators), Spree::Dependencies for swapping service objects, gem release/versioning, and the deprecated Deface engine. Use when building a reusable Spree extension or adding non-trivial customization to an app.
27SKILL.mdUpdated May 14, 2026
orcaqubits/spree-events-webhooks
development
VerifiedTrustedCommunity
Build with Spree's event bus and Webhooks 2.0 — `Spree::Events` publication, `Spree::Subscriber` DSL with `subscribes_to` and `on`, wildcard matching, lifecycle events (`{model}.created/.updated/.deleted` via `publishes_lifecycle_events`), the canonical event catalog (order.*, payment.*, shipment.*, product.*), Webhooks 2.0 endpoints, HMAC-SHA256 signing (`X-Spree-Webhook-Signature`), exponential-backoff retries, and Sidekiq job orchestration. Use when wiring event-driven business logic, building webhook consumers, or replacing ActiveSupport callback chains.
27SKILL.mdUpdated May 14, 2026
orcaqubits/spree-dev-patterns
tools
VerifiedTrustedCommunity
Cross-cutting Spree development patterns — the customization preference hierarchy (Events > Webhooks > Dependencies > Decorators), `Spree::Dependencies` service-object swapping, the `_decorator.rb` + `prepend` + `self.prepended` idiom, idempotent subscribers and webhook receivers, multi-store scoping discipline, prefixed IDs, calculator polymorphism (shipping/promotion/tax share the base), service-object composition with `dry-monads` or simple results, why to avoid `class_eval` reopening and Deface, and Spree-on-Rails idioms (Hotwire/Turbo Stimulus, ActiveStorage, Action Cable, Sidekiq). Use when designing the architecture of a Spree extension or solving cross-cutting concerns.
27SKILL.mdUpdated May 14, 2026