# Authoryze MCP Server

Authoryze gives your AI agent a spending limit. It lets you hand an agent a payment method without handing it your card: you define what it can buy, from which merchants, and up to what amount, and every purchase request comes to you for approval before a single-use virtual card is issued. It is built on Visa Intelligent Commerce and Mastercard Agent Pay, and is currently available for US-issued cards. Authoryze is a remote MCP (Model Context Protocol) server that works with Claude, Claude Code, ChatGPT, Cursor, Windsurf, and any MCP-compatible client.

## Installation

OAuth-capable clients such as Claude and ChatGPT need only the endpoint:

```json
{
  "mcpServers": {
    "authoryze": {
      "url": "https://authoryze.ai/api/mcp"
    }
  }
}
```

Clients that don't support OAuth, such as Claude Code, Codex, and custom frameworks, authenticate with a static agent API key as a bearer token:

```json
{
  "mcpServers": {
    "authoryze": {
      "url": "https://authoryze.ai/api/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}
```

## Tools

- **request_purchase** - Ask to make a purchase from a specific merchant, for a specific amount, with a reason. The request either gets approved automatically, gets sent to the account owner for approval, gets denied with a reason, or fails in a way that's safe to retry.
- **check_status** - Look up what happened to a purchase request: approved, denied, still waiting on approval, or failed. Doesn't reveal any card details itself.
- **get_spending_summary** - See how much has been spent so far against the configured limits (daily, weekly, monthly, and total), including any account-wide limit that applies across all of an account's agents.
- **retrieve_card** - Once a purchase is approved, get the actual card number, expiry, and security code to complete the purchase. This can only be done once per approved purchase; the details are shown a single time and can't be retrieved again.

## Requirements

Authoryze is available for US-issued cards only. International support is pending issuer coverage on the agentic token programs.

Authentication requires either OAuth 2.1 with PKCE (S256) and Dynamic Client Registration, or a static agent API key used as a bearer token.

## Links

Homepage: https://authoryze.ai

Docs: https://authoryze.ai/docs

## Smithery

Listed on Smithery: https://smithery.ai/servers/authoryze/authoryze