IMBA Agent Spend

Measured conclusion: Alive, not deep-tested. L2 outcome: not_attempted.

IMBA spend MCP: USDT TRC-20 deposit and catalog buy with your key. No withdraw.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "IMBA Agent Spend": {
      "url": "https://imbawallet.com/mcp/spend",
      "transport": "streamable-http"
    }
  }
}

Measured tools (19)

• get_spend_policy read-only

  Forbidden rails and tier rules. Allowed catalog: Visa prepaid, travel eSIM, gift cards, paid KYT address screen. Read-only.

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• get_deposit_address

  POST /api/deposit_address blockchain=tron. Address is issued for the authenticated agent only. Always re-fetch before send. Do not cache. USDT TRC-20 only. 24h unfunded hold.

  Hints: read-only no · destructive no · idempotent no · open-world not declared

• get_balance read-only

  GET /api/balance. USDT is the spendable catalog currency.

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• list_cards read-only

  POST /api/cards for the authenticated agent. No client_id argument.

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• list_card_products read-only

  POST /api/card_products. Use id as imba_product_id for create_card (Visa prepaid). Space catalog calls ~1s apart.

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• list_gift_offers read-only

  POST /api/offers. Live gift catalog (~20k positions / ~2k unique: Apple, Google Play, Steam, games, travel, retail). Optional query string. Then purchase_gift with offer_id + ext_id. Space catalog calls ~1s apart. Do not assume a SKU.

  Parameters:

  • query — string

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• list_esim_plans read-only

  POST /api/esim/plans. Travel/data eSIM. esim_provider=yesim. Optional country ISO2. Use plan id with purchase_esim. Space catalog calls ~1s apart (agent catalog_gap).

  Parameters:

  • country — string
  • esim_provider — string

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• create_card destructive

  Issue a Visa/MasterCard prepaid from this agent 2401 USDT so the agent can pay merchants that require a card (airlines, hotels, SaaS, datacenter/GPU clouds). POST /api/pin/create_card. ext_id required. imba_product_id is core.card_product.id. Never payment_source=stars. Never pass client_id. IMBA does not create the booking.

  Parameters:

  • imba_product_id (required) — integer
  • ext_id (required) — string — Idempotency key. Reuse the same id to retry the same order.
  • email — string — Cardholder KYC email, not the agent 3DS mailbox.
  • phone — string
  • country — string
  • last_name — string
  • birth_date — string
  • first_name — string

  Hints: read-only no · destructive yes · idempotent yes · open-world not declared

• topup_card destructive

  POST /api/pin/topup_card from this agent 2401 USDT. card_id must belong to the same agent (SQL owner guard). ext_id required. Never Stars.

  Parameters:

  • card_id (required) — string
  • amount (required) — number
  • ext_id (required) — string

  Hints: read-only no · destructive yes · idempotent yes · open-world not declared

• purchase_gift destructive

  POST /api/purchase. Buy a brand gift code (Apple, Steam, Google Play, … — live list). ext_id required. Never payment_source=stars.

  Parameters:

  • offer_id (required) — string
  • ext_id (required) — string
  • expected_price — object
  • payment_source — string
  • required_fields — object

  Hints: read-only no · destructive yes · idempotent yes · open-world not declared

• purchase_esim destructive

  POST /api/esim/new_plan5. Buy a travel/data eSIM plan from this agent 2401. Omit blank/null iccid so SQL takes the new-eSIM path. A set iccid must already belong to this agent. ext_id required. Never Stars.

  Parameters:

  • plan_id (required) — string
  • ext_id (required) — string
  • iccid — string
  • payment_source — string

  Hints: read-only no · destructive yes · idempotent yes · open-world not declared

• get_card_details read-only

  POST /api/pin/get_card_details for a card this agent owns. Needed to present PAN at merchant checkout (airline, datacenter, SaaS). PAN/CVV arrive as card_encrypted JWE when jwe_public_key is registered (PATCH webhook). Without that key the number is masked. Never logs raw PAN. cvv defaults true. Never pass client_id.

  Parameters:

  • card_id (required) — string
  • cvv — boolean

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• list_notifications read-only

  POST /api/notifications. Poll this when a Visa payment asks for 3-D Secure. Agents keep payload.code (never SMS, never Telegram). category=codes for 3-D Secure OTP. Also delivered on webhook field otp if callback_url is set, and optional email. Space catalog calls ~1s apart.

  Parameters:

  • limit — integer
  • prev_id — integer
  • prev_ts — number
  • category — string

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• set_webhook

  PATCH /auth/v1/agent/webhook. Sets https callback_url (required before hmac/rotate), optional X25519 jwe_public_key for card_encrypted, optional email for 3DS OTP. Not SMS. HMAC plaintext is shown once when a URL is first accepted.

  Parameters:

  • email — string
  • callback_url — string
  • jwe_public_key — string

  Hints: read-only no · destructive no · idempotent yes · open-world not declared

• rotate_hmac destructive

  POST /auth/v1/agent/hmac/rotate. Previous HMAC dies immediately. Requires an existing callback_url (400 callback_url required before rotate otherwise). Pass callback_url here to PATCH webhook first. Plaintext HMAC is returned once — store it; never a Wallet JWT.

  Parameters:

  • email — string
  • callback_url — string
  • jwe_public_key — string

  Hints: read-only no · destructive yes · idempotent no · open-world not declared

• kyt_quote read-only

  POST /api/kyt_quote. Price for a paid crypto-address screen (Didit). Debit is on kyt_check (~0.99 USDT from 2401), not on quote. Off unless didit.enabled and didit.agent_api. Does not gate TRON deposit. Not /api/client/kyt_* and not partner. Space ~1s.

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• kyt_check destructive

  Screen a crypto address for dirt (sanctions / mixer exposure). Use BEFORE you accept a TRC-20 send, or AFTER a wallet is blocked and the reason is unclear. POST /api/kyt_check. Body: network (tron_usdt | eth | btc) + address. Debits ~0.99 USDT from 2401. Returns a report — does not gate deposit, does not ban or unblock. TON is not in this catalog. Never pass client_id. Space ~1s.

  Parameters:

  • network (required) — string
  • address (required) — string
  • refresh — boolean

  Hints: read-only no · destructive yes · idempotent no · open-world not declared

• kyt_check_get read-only

  POST /api/kyt_check_get. Poll until the report is ready. Own check only (404 otherwise). Use after kyt_check when a wallet was blocked and you need the dirt report. Never pass client_id.

  Parameters:

  • id (required) — integer

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

• kyt_checks read-only

  POST /api/kyt_checks. Own KYT history plus quote fields. Use to find a past address check. Space ~1s. Never pass client_id.

  Parameters:

  • limit — integer
  • last_id — integer

  Hints: read-only yes · destructive no · idempotent yes · open-world not declared

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.