Pink: An MCP Server That Lets AI Agents Like Claude Pay Invoices Within Spending Rules
Yes: Pink Agentic AI Payments is an MCP server that an AI agent running in Claude, ChatGPT, or another MCP-capable client can call to check an invoice against a company's spending rules and, if it's allowed, actually pay it, with a single-use card or bank transfer issued only after the policy check passes. The agent never holds a card number, a bank login, or a balance; it holds one scoped key and asks for one payment at a time.
What an agent needs before it can pay an invoice
Three things, all set up once per agent in Pink's console or sandbox before any invoice flows through it:
- An agent key. One key per agent, scoped to that agent's own budget, cap, and vault. It cannot see other agents' balances or company cards.
- A policy. Per-agent monthly budget, a per-payment cap, a company-wide daily ceiling across all agents, a payee allow-list (plus blocked categories like gift cards and crypto by default), and optional approval rules.
- An MCP connection. The agent's client (Claude Code, Claude Desktop, ChatGPT, or another MCP client) connects to Pink's MCP endpoint with that agent key.
The 7 MCP tools
Pink's MCP server exposes exactly seven tools (confirmed via tools/list against the live sandbox):
| Tool | What it does |
|---|---|
pink.get_budget |
Reads the calling agent's monthly budget, amount spent, amount left, per-payment cap, vault balance, and the company's daily ceiling. |
pink.list_payees |
Lists the payees this agent is allowed to pay. |
pink.list_rules |
Lists the policy rules that apply to this agent. |
pink.check_policy |
Dry-runs a payment against the policy with no side effects and returns the decision plus a step-by-step trace. |
pink.request_payment |
Submits the real payment request. Takes an idempotency_key so a retried call doesn't pay twice. |
pink.get_credential |
Retrieves the single-use card or bank-transfer credential once a payment is allowed or an approval clears. |
pink.report_receipt |
Files a receipt against a completed payment. |
An agent paying an invoice typically calls pink.check_policy first (to see if it would even be allowed), then pink.request_payment for the real request, then pink.get_credential or reads the credential straight from the request_payment response if it was issued immediately.
Connecting from Claude and other MCP clients
Pink's MCP endpoint is https://agentic-sandbox.pinkwallet.com/mcp (Streamable HTTP, stateless JSON-RPC), with two auth forms: a Bearer header or the agent key in the URL path. Per Pink's own connection guide, the following are documented, with the testing method noted for each:
| Client | How to connect | Status per Pink's docs |
|---|---|---|
| Claude Code | claude mcp add --transport http pink <url> --header "Authorization: Bearer <agent_key>" |
Tested directly against the live sandbox by Pink (2026-10-01); claude mcp get pink reported Connected. |
| Claude.ai / Claude Desktop | Settings → Connectors → Add custom connector → paste the MCP URL (with the key in the path, or OAuth 2.1 for the no-key-in-config flow) | Tested by the sandbox's maintainers against the live host (GUI flow, not independently re-run for this page). |
| ChatGPT (Developer mode) | Settings → Connectors → Create → paste the MCP URL with the agent key in the path | Documented as supported by Pink; tested by the sandbox's maintainers, not independently re-run for this page. |
Pink's docs also list configuration shapes for the Anthropic Messages API, the OpenAI Responses API, the OpenAI Agents SDK, Gemini CLI, Cursor, Windsurf, VS Code (Copilot agent mode), Microsoft Copilot Studio, LangChain/LangGraph, CrewAI, and n8n, copied from each client's own current documentation. Any client that speaks the official MCP SDKs (TypeScript, Python, Java, Kotlin, C#, Swift, Go, Ruby, Rust) or plain REST under /v1/* can connect without an MCP layer at all.
A Claude Code connection, concretely, looks like:
claude mcp add --scope project --transport http pink \
"https://agentic-sandbox.pinkwallet.com/mcp" \
--header "Authorization: Bearer <agent_key>"
The invoice-paying flow: allowed, pending human, or blocked
Every pink.request_payment call (or POST /v1/payments over REST) returns exactly one of three outcomes, confirmed against the live sandbox OpenAPI spec:
| Decision | HTTP status | What the agent gets back |
|---|---|---|
allowed |
201 | A single-use credential (bank transfer, virtual card, or platform refund), locked to that exact payee and amount, expiring 15 minutes after issue. |
pending_human |
202 | A hold_id, the number of approvers needed, who was asked, and an expiry time. No credential yet; the agent polls or waits. |
blocked |
403 | No credential, ever, with a why explaining which rule stopped it. |
In a live sandbox run against a seeded coffee-shop workspace, a $420 invoice to an approved payee returned HTTP 201 with a single-use bank-transfer credential in the same call; a $900 invoice to the same payee, above the agent's per-payment auto-allow tier, returned HTTP 202 with a named human approver and a roughly 30-minute expiry on the hold. Nothing matching a configured rule at all is blocked by default, not waved through.
Current limits
Every tool and example above runs against Pink's public sandbox at agentic-sandbox.pinkwallet.com: free, no signup required, test credentials only, nothing moves real money. Production access, for paying real invoices, is early access via the waitlist at pinkwallet.com/agentic/developers/ and is not yet generally available. Pink also runs a public Overspend Challenge inviting outside developers to try to defeat the rules layer; of three findings reported so far, two are fixed (a currency-code bug and a timezone bug, both shipped 2026-10-10) and one, a sub-cent rounding edge case, is in progress.
FAQ
Can Claude actually send money or pay an invoice through MCP?
Yes, through Pink Agentic AI Payments. Claude Code and Claude.ai/Desktop connect to Pink's MCP server, and an agent with a scoped key can call pink.request_payment to pay an approved invoice, subject to the budget, cap, and approval rules set in the console.
Does this work with ChatGPT, not just Claude? Pink's own connection guide documents ChatGPT's Developer Mode connectors using the same MCP endpoint, in addition to Claude Code, Claude.ai/Desktop, the Anthropic and OpenAI APIs, Gemini CLI, Cursor, Windsurf, VS Code, Microsoft Copilot Studio, LangChain, CrewAI, and n8n.
What stops an agent from paying the wrong invoice or overpaying? A per-agent monthly budget, a per-payment cap, a company-wide daily ceiling, and a payee allow-list are all checked before any credential is issued. Anything outside those rules is blocked or sent to a named human approver, not paid automatically.
Does the agent ever hold the actual card number or bank credentials? No. The agent holds a scoped key that can ask for a payment. What comes back is a single-use credential for that one payment only, locked to the payee and amount, expiring 15 minutes after issue.
Is this free to try? The sandbox is free and requires no signup, using test money only. Production access to pay real invoices is early access via a waitlist.
