Daraja MCP Server

MCP server for the Safaricom M-Pesa Daraja 3.0 API. Full product surface including M-Pesa Ratiba, a hardened callback receiver, and an offline simulator so you can test without a Safaricom account. The daraja mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 14 defined tools rather than through you.

What it actually does

Covers the full product surface including M-Pesa Ratiba, verifies the source of inbound callbacks, and ships a simulator so you can run every tool without a Safaricom account.

Adding it to your client

daraja-mcp on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.

Its toolset

Everything the assistant can do here goes through one of these:

• stk_push — Send a payment prompt. Returns an acknowledgement only
• stk_push_and_wait — Send a prompt and wait for the customer. Returns the receipt
• stk_query — Check the status of a previous prompt
• ratiba_create — Create a standing order for recurring collection
• ratiba_create_and_wait — Create one and wait for the customer to approve
• generate_qr — Generate a dynamic QR code
• b2c_payment — Pay a customer: refunds, withdrawals, salaries
• b2c_payment_and_wait — Same, but returns the settled result
• b2b_payment — Pay a PayBill, a till, or top up a B2C working account
• tax_remittance — Remit tax to KRA against a PRN
• business_to_pochi — Pay a Pochi la Biashara number
• account_balance — Query your business account balance

Configuration

You will need 6 environment variables: DARAJA_CONSUMER_KEY, DARAJA_CONSUMER_SECRET, DARAJA_SHORTCODE, DARAJA_PASSKEY, DARAJA_CALLBACK_PUBLIC_URL, DARAJA_CALLBACK_PATH_SECRET. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.

Caveats

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Daraja.
• Missing credentials fail quietly in some clients — if no tools show up, check the environment block first.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the daraja mcp server does with a few real requests.

When to reach for it

This sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Daraja's toolset — stk_push, stk_push_and_wait, stk_query and 11 more — is a fair guide to whether it matches your workflow. It is maintained by parseen254; worth a glance at recent repository activity before you build anything load-bearing on it.

We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.