MCP server¶

@oura/mcp · source

The Oura MCP server lets AI agents such as Claude Code, Claude Desktop and Cursor work with Oura for you. They can add Oura checkout to your app, create test payments, debug webhooks and answer questions like "how much came in through Khalti this week?"

What an agent can do depends on the key you give it.

The Oura API enforces the same boundary on the server, so a test key can never touch live data.

Set up¶

Build the server:

git clone https://github.com/oura-pay/oura-mcp.git
cd oura-mcp && npm install && npm run build

Then add it to your MCP client. For Claude Code, create .mcp.json in your project:

{
  "mcpServers": {
    "oura": {
      "command": "node",
      "args": ["/path/to/oura-mcp/dist/index.js"],
      "env": {
        "OURA_API_KEY": "sk_test_..."
      }
    }
  }
}

OURA_API_URL is optional and defaults to https://api.ourapayment.com. Plain http is only allowed for localhost. The server won't start with a malformed key.

Tools¶

Build your integration

• get_integration_guide(platform): returns the official integration guide for Next.js, Node/Express, React, Python or plain REST, so "add Oura checkout to my app" produces correct code.

Test payments (test key only)

• create_test_payment, cancel_test_payment
• get_payment: check a payment's status

Debug webhooks

• get_webhook_config
• list_webhook_deliveries: delivery status, attempts, retry schedule and the payload sent. Filter by payment_id to trace one payment.

Your data

• list_transactions: filter by status, method and date
• get_payment_volume: totals by rail and period
• get_merchant_profile
• list_payment_methods

All amounts are integer paisa.

Try it¶

Add Oura checkout to this Next.js app with eSewa and Khalti, and verify the webhook.

Create a NPR 500 test payment and tell me when it succeeds.

Why didn't my webhook for pay_8Kq2xV arrive?

Security¶

• The API key is read only from the OURA_API_KEY environment variable. It's never accepted as a tool argument and never shown in output or errors, so it can't end up in the conversation.
• Live keys get read-only tools. Tools that change anything exist only in test mode.
• No tool can read your webhook signing secret or change your webhook URL. Those are dashboard-only.
• IDs are validated and URL-encoded, redirects are refused, requests time out after 15 seconds, and no tool fetches arbitrary URLs.