Update, 2026-10-28: Pink Agentic AI Payments is now live in production as a decision layer: your agent asks Pink before each payment, and your own Stripe, card or bank pays only if Pink allows it. Pink never holds or moves your money. Anything below that says early access or test money describes the free public sandbox, which still runs on test money. Production pilot on your own tenant: $99/month, pinkwallet.com/agentic/pilot.

Is There an MCP Server That Lets Claude or ChatGPT Send Money or Pay for Things?

We opened an MCP session against a live payments sandbox, sent the same request_payment tool calls Claude or ChatGPT would send for three test invoices, and got three different outcomes back: one approved with a single-use card, one parked for a human to approve, and one rejected outright, all before any money moved.

Disclosure: I work on Pink Agentic AI Payments at PinkWallet. This post was written with AI and checked against the product source.

Short answer: yes, there is an MCP server built specifically for this: it exposes payment tools to any MCP client, but every call still passes through a server-side rule engine before anything is charged. Pink Agentic AI Payments gives each AI agent its own budget and checks every payment against company rules on the server, before it executes. The model never sees a card number, a bank login, or a private key, it only sees a decision: allowed, pending on a human, or blocked.

What the server actually hands the model

We spun up a free sandbox workspace for a fictional company, Lantern & Oak Coffee, and connected to its MCP server at https://agentic-sandbox.pinkwallet.com/mcp using an agent key called "Purchasing AI." The first call in any MCP session is initialize, and the server's own instructions field tells the model exactly what it can and can't do:

"You never hold money, a standing card or the company's account keys: each allowed or approved payment returns one single-use credential locked to that payee and amount, expiring in 15 minutes."

That's the whole design in one sentence. The model is never handed standing payment access, it's handed a yes/no/ask-a-human decision, and only on "yes" does it get something it can actually spend, and that something expires in 15 minutes and only works at one payee.

Calling tools/list on the same connection returns seven tools:

• pink.get_budget, how much is left this month, the vault balance and the company-wide daily ceiling
• pink.list_payees, the suppliers and vendors this company has approved
• pink.list_rules, the policy rules that apply to this agent, in the order they're checked
• pink.check_policy, a dry run: would this payment be allowed, asked, or blocked, with no money moved
• pink.request_payment, the real call, returns allowed, pending_human, or blocked
• pink.get_credential, poll a pending hold until a person decides
• pink.report_receipt, file the receipt after paying so the payment reconciles

No tool returns a reusable card, account number, or standing token at any point. The only thing that can move money is request_payment, and it only ever hands back something single-use.

Connecting a real MCP client

The connection guide at pinkwallet.com/agentic/developers documents the server URL as https://agentic-sandbox.pinkwallet.com/mcp, with the agent key sent either as Authorization: Bearer <agent_key> or embedded directly in the path as .../mcp/<agent_key>.

For Claude Code, the docs give this exact command:

claude mcp add --scope project --transport http pink \
  "https://agentic-sandbox.pinkwallet.com/mcp/<agent_key>"

For Claude Desktop and ChatGPT, the docs describe the GUI path rather than a config file: in Claude Desktop, Settings → Connectors → Add custom connector, then paste the same URL. In ChatGPT, Settings → Connectors → Create, paste the same URL, available on Plus, Pro, Business, and Enterprise plans with Developer mode turned on. The docs list 14 documented clients in total, including Claude Code, Claude.ai/Desktop, the Anthropic and OpenAI APIs, ChatGPT, Gemini CLI, Cursor, Windsurf, VS Code, Copilot Studio, LangChain, CrewAI, n8n, and "any MCP SDK." If a client isn't in that list, we're not claiming it works, remote MCP support varies enough between clients that it's worth checking the docs directly before assuming.

Three requests, three outcomes

With the Purchasing AI agent connected, we called pink.request_payment three times through the actual MCP tools/call interface.

$300 to Sysco, for a weekly milk and syrup restock, came back allowed:

{
  "decision": "allowed",
  "payee": "Sysco",
  "amount": 300,
  "rule": "Small supply orders go through",
  "credential": {
    "type": "virtual_card",
    "max_amount": 300,
    "locked_to": "Sysco",
    "single_use": true,
    "expires_at": "2026-10-24T16:53:59.971Z"
  }
}

That credential only authorizes $300 at Sysco and stops working in 15 minutes. The rule that let it through, "Small supply orders go through," caps anything on an approved payee at $500 per transaction for this agent.

$700 to Uline, for a bulk cup and lid order, came back pending_human:

{
  "decision": "pending_human",
  "payee": "Uline",
  "amount": 700,
  "rule": "Bigger supply orders: store manager checks",
  "hold_id": "pay_f0bbaf5ef3fc",
  "who": "Luis Ortega (Store manager)",
  "expires_at": "2026-10-24T17:09:00.224Z"
}

No credential, no card, nothing to spend. $500 to $2,000 on this account routes to a named human, Luis Ortega, the store manager. The agent's only move here is to call pink.get_credential with the hold_id and poll. We did, and before Luis acted, the poll returned the same pending_human state, the credential only appears in that response once a person actually approves it.

$50 to giftcards.com came back blocked, flat out, no polling possible:

{
  "decision": "blocked",
  "payee": "giftcards.com",
  "amount": 50,
  "rule": "Never: gift cards, cash-like, crypto",
  "credential": null
}

This one isn't a budget or approval question, it's a category block that applies to every agent on the account, no matter the amount. pink.list_rules shows it sitting first in the evaluation order, ahead of any dollar-amount rule, which matches how the engine works: the first matching rule wins, and a flat "never" rule for a payee category beats a dollar-threshold rule every time.

Why the model never touches the money

Across all three calls, the model's job was identical: describe the payment, call request_payment, read the decision. It never constructed a card number, never held a reusable credential, and never had standing access to pay anyone twice. The 15-minute expiry on the one approved credential means even if that JSON leaked somewhere downstream, it would already be dead by the time anyone could misuse it.

That's the actual answer to "can an MCP server let an AI send money": yes, but the interesting engineering isn't the MCP transport, plenty of servers can expose a pay() tool. The interesting part is what happens between the tool call and the money moving, a rule check that runs on every single request, decides allow, ask, or block, and only ever issues something single-use.

Try it

The sandbox above is free, uses test money only, and needs no signup: POST https://agentic-sandbox.pinkwallet.com/v1/sandbox/workspaces?utm_source=devto&utm_medium=article&utm_campaign=mcp-server-send-money spins up a new company with its own agents, rules, and payees in one call. Full docs: pinkwallet.com/agentic/developers. Production access is early access only right now, reach out through the docs site if you want in.