Audit of 49 payment MCP servers finds 37 can move money, only 4 document a spend budget

What the census found

A census of 49 payment-adjacent MCP servers, published on dev.to, found that 37 of them (76%) can move real money by creating payments, transfers, payouts, charges or cards. Documented spending controls, however, are rare: among those 37 money-moving servers, only 4 (11%) document a configurable spending budget, 6 (16%) document a human-approval step, and just 1 (3%) documents a velocity or rate limit.

The remaining controls are similarly thin. Per-payment caps are documented by 5 of 37 (14%), payee allowlists or blocklists by 3 (8%), and a sandbox or test mode by 8 (22%). Separately, 5 of the 49 listed servers (10%) had GitHub repositories that returned a 404 when checked.

The audit covered 24 official vendor servers and 25 community-built ones, reviewed on October 8 and 9, 2026. The author read each project's own documentation or README and recorded whether the server can move money and whether it documents six controls: budgets, per-payment limits, payee restrictions, human approval, rate limits and sandbox mode. The definition matters: a server may implement a control without documenting it, but as the author argues, an undocumented control is difficult for an agent builder to rely on.

Community servers were slightly more likely to move money than official ones: 20 of 25 community entries versus 17 of 24 official entries.

Which vendors document which controls

According to the census table, the money-moving servers that document at least one spending control include:

• Budgets: Marqeta (spending caps), Gatewards (per-agent spend caps), MCPay (a hard budget) and Pink (per-agent monthly budget)
• Per-payment limits: Coinbase AgentKit/CDP, Crossmint Checkout, MCPay, x402search-mcp and Pink
• Payee allowlists: Coinbase AgentKit/CDP, Marqeta and Pink
• Human approval: Stripe, Crossmint, Ramp, GoCardless, SpendNod and Pink
• Velocity limits: Marqeta alone

No single control is widespread. The most-documented one, human approval, still appears in fewer than one in six money-moving servers.

Agent frameworks do not fill the gap

A companion survey of 12 popular agent frameworks, including LangChain/LangGraph, CrewAI, the OpenAI Agents SDK, the Vercel AI SDK, Google ADK, AutoGen, Semantic Kernel, LlamaIndex, Pydantic AI, Mastra, the Claude Agent SDK and smolagents, found that none of the 12 document a spending budget in currency terms for tool calls. Ten of twelve offer some form of human approval and nine of twelve a max-steps limit.

The census author's conclusion: frameworks can pause an agent, but they do not know what a tool call costs. In practice, spending controls have to come from the payment layer itself.

A caveat on who ran the audit

The census author discloses an affiliation with Pink Agentic AI Payments at PinkWallet, one of the 49 servers counted, scored by the same criteria as every other row. Pink's public sandbox currently runs on test credentials only, with production not yet available. The dataset, methodology and source URLs have been published openly on GitHub under a CC BY 4.0 licence, and the author invites corrections via repository issues for any server that believes its row is wrong. The conflict of interest is worth weighing, though the open dataset makes the underlying numbers independently checkable.

Why it matters

The core argument of the census is that prompts are not spending limits. An instruction such as "never spend more than $50" lives in the model's context, where it can be misread, forgotten or talked out of by a prompt injection hiding in a web page or an email. A control that actually holds has to sit outside the model, in the system that holds the money, and be evaluated before the payment executes.

As AI agents gain payment capabilities through MCP, the current baseline is capability without documented guardrails: roughly three-quarters of surveyed servers can move money, while nearly nine in ten of those document no budget at all. The author suggests five questions for anyone evaluating a payment MCP server: whether a budget can be set per agent rather than per account, whether a per-payment cap is enforced server-side, whether payees can be restricted, whether payments above a threshold can wait for a human with a default of "no" on silence, and whether a sandbox exists for testing the rules with fake money first.