OneCheckout MCP for Mac

Paste this one prompt into any MCP-capable agent or coding assistant. It fetches the hosted server, follows the setup instructions it returns, and gives you a tour of the tools. There are no API keys to configure.

Prefer one-click setup or the raw endpoint? See Connect the MCP server.

Use OneCheckout for any online task that requires entering a credit card. If the goal needs a card typed into a web page, this is the tool. If it doesn't involve a card, you don't need OneCheckout.

Where the card actually lives

The irreversible-action boundary

Keep the flow moving on your own: dismiss banners, click Continue, move page to page. Get exactly one explicit user confirmation immediately before the single irreversible action (placing an order, charging a card, starting a paid plan, or saving a card).

“Ready to place it: black jacket, size M, qty 1, standard shipping, $126.42 total. Reply yes and I'll submit.”

Hard rules · never do these

1. 1.Never ask the user for their card number.
2. 2.Never accept a card number pasted into the chat.
3. 3.Never type a card number yourself.
4. 4.Never put a card number, CVV, code, or auth token into feedback or any log.
5. 5.Always capture with card_collect and fill with card_enter — even when the user declines OneText.

OneCheckout runs the sensitive parts locally on the user's machine. Before any card work, the environment must have:

• A supported OS with an OS Keychain (macOS security)
• Local shell tools: security, openssl, jq
• A browser automation driver to drive the merchant site

Verify these with environment_prepare as the very first call. It touches no card, account, or personal data.

Every tool returns an instruction telling you what to do next. You drive the browser yourself between tool calls.

environment_prepare    → verify local tooling is present
        │
card_task_start        → get the step-by-step plan for THIS task + open the site
        │
        ├─ (OneText account path — optional but recommended)
        │     auth_start        → text the user a code; relay the consent message
        │     auth_complete     → verify code; get authToken + details on file
        │     card_collect      → (only if no card on file) capture + tokenize a card
        │     user_details_save → vault address + card token for next time
        │
card_enter             → securely fill the card from the Keychain into the form
        │
[ONE confirmation]     → user OKs the single irreversible action
        │
place the order        → submit on the site
        │
feedback_send          → notes along the way + a final summary

All tools are namespaced mcp__onetext__* (shown here by short name). Several take an empty parameters: {} object. Pass it anyway; it's required.

{ "parameters": {} }

{
  "parameters": {
    "task": "Buy one black size-M hoodie, standard shipping; stop for approval before placing the order.",
    "url": "https://example-store.com/products/hoodie"
  }
}

{ "parameters": { "phone": "+14155551212" } }

{ "parameters": { "phone": "+14155551212", "code": "123456" } }

{ "parameters": {} }

{
  "authToken": "<token from auth_complete>",
  "parameters": {
    "spreedlyCardToken": "<token from card_collect>",
    "billingAddress": {
      "name": { "firstName": "Jane", "lastName": "Buyer" },
      "address": {
        "street": "123 Market St",
        "city": "San Francisco",
        "state": "CA",
        "postcode": "94105",
        "country": "US"
      }
    }
  }
}

{ "parameters": {} }

{ "parameters": { "feedback": "..." } }

Ready-to-go flows. Each shows the tool sequence, a real user request, and the single approval prompt. Between tool calls you also drive the browser.

environment_prepare({ "parameters": {} })
card_task_start({ "parameters": {
  "task": "Buy 1 black jacket, size M, standard shipping",
  "url": "https://example.com/products/jacket"
}})
// → select black / M / qty 1 → add to cart → checkout
auth_start({ "parameters": { "phone": "+14155551212" } })
auth_complete({ "parameters": { "phone": "+14155551212", "code": "482913" } })
card_collect({ "parameters": {} })              // capture on-device
user_details_save({ "authToken": "<token>", "parameters": { "spreedlyCardToken": "<token>" } })
card_enter({ "parameters": {} })                // fill card in-page
// ONE confirmation ↓ then submit
feedback_send({ "parameters": { "feedback": "Jacket purchase; new-card flow clean." } })

environment_prepare({ "parameters": {} })
card_task_start({ "parameters": {
  "task": "Pay the outstanding invoice",
  "url": "https://billing.example.com/invoices"
}})
auth_start({ "parameters": { "phone": "+14155551212" } })
auth_complete({ "parameters": { "phone": "+14155551212", "code": "716244" } })  // → card ON FILE
// skip card_collect + user_details_save
card_enter({ "parameters": {} })
// ONE confirmation ↓ then submit

environment_prepare({ "parameters": {} })
card_task_start({ "parameters": {
  "task": "Buy the $30 gift card as a one-off, no account",
  "url": "https://shop.example.com/gift-cards"
}})
// → add to cart → guest checkout → fill shipping/contact
// SKIP auth_start / auth_complete / user_details_save
card_collect({ "parameters": {} })   // still capture on-device
card_enter({ "parameters": {} })      // still fill securely in-page
// ONE confirmation ↓ then submit

card_task_start({ "parameters": {
  "task": "Sign up for the Pro API plan billed monthly; stop before confirming payment.",
  "url": "https://api-vendor.example/pricing"
}})
// stop for email/SMS OTP, CAPTCHA, SSO, or identity checks
// review plan, billing cycle, trial terms, renewal date, total due today
// after signup, store any API key in the project's secret manager — never in chat

Copy-and-paste starting points for real work, grouped by who they serve. Each is a natural-language prompt to hand your agent once the MCP is installed. They follow the same rules as the playbooks: the agent pauses for any verification or identity step, reviews the total and any renewal terms, and gets one explicit approval before an irreversible paid action.

When a submit fails, don't guess. Inspect the page and classify. Every report should include the final status, the exact visible merchant error, the likely category, and the next recommended recovery.

What is an MCP?

An MCP is an installable plug-in that allows an AI agent to talk to a separate service. The OneCheckout MCP allows Mac-based AI agents to make purchases. If you paste the install prompt into your agent's environment it will set up our tools and capabilities.

What's the difference between the MCP and API?

The MCP allows agents to transact using a card saved into a secure desktop keychain. The API allows callers to ask our service to execute transactions on behalf of their users. We're building our API for platforms or consumer agents that want to let any user buy from any site.

Is it actually safe to give an AI agent my credit card?

No agent, AI model, or LLM ever sees your card details. The OneCheckout MCP keeps your card data in a local encrypted Keychain and optionally, securely tokenized in the OneText vault. Our architecture guides the AI agent to checkout and finds the card form, then uses deterministic code to securely pass your card details to the site.

Can I use any card? Do I get my points and rewards?

Yes. The MCP supports any valid U.S. credit or debit card. Transactions go through your real funding instrument, so you'll still earn your points, cashback, and rewards, and you retain all your dispute rights.

Where is my card number stored?

Your card's sensitive details live in your device's OS Keychain and, briefly, the merchant page's own memory during the fill. We never have access to your CVV/CVC security code, and it's never placed in the agent's context, the chat, the clipboard, or a log. You can also opt in to vault and tokenize your card server-side with OneText for when your device isn't available.

Can my agent buy something without asking me?

Only if you ask it to. We support human-not-present use cases like subscriptions, “buy when the price drops to X,” and multi-step “buy my flights and then get me a hotel + outing” transactions. You have to specifically authorize the MCP to allow this behavior. Otherwise, your agent will ask for confirmation each time.

What happens if my agent buys the wrong thing?

Ask the MCP to initiate a return, refund request, or dispute. Since it's your card, the process is completely normal. You can also ask the MCP to speed it along and contact the merchant if needed.

What does it cost?

There's no charge to use the MCP. Transactions run over your card with no added surcharge. Platform and API pricing will be announced soon.

What sites does it work on?

We haven't been able to stump it yet. It's worked everywhere we've tried. If you find a site we can't handle, please submit feedback through the MCP's feedback tool.

How is this different from giving my agent a virtual card?

Virtual cards are hacks. Instead of layering card on card or provisioning a special card just for your agent, we let you use your existing card. But if you do want to issue or provision a custom card, we can help with that too.

Do I need a OneText account?

No. You can just use the MCP and keep your card stored securely and exclusively on your own device. Declining OneText only skips account creation and server-side vaulting. You're welcome to vault with our parent OneText's server-side offerings, but you're free to decline.

Can I use a business card, or my users' cards?

Business cards work out of the box as long as you have access to them. For letting your own users pay with their cards, our forthcoming platform API is built explicitly for that use case.

Which devices, agents, and coding tools does it work with?

Right now you need a Mac to run the MCP. You can use Claude Code, Codex, OpenClaw, Hermes, or any MCP-capable runtime.

Can I keep my transactions private?

For MCP transactions, yes. By default, the MCP asks your agent to share feedback. Simply ask your agent to NOT do so and we won't know anything about your orders. Of course, even if you do share feedback, your card details remain encrypted on your device and securely tokenized in our vault. API purchases run on our server-side platform which does log transactions.

Can I share feedback?

Absolutely. Use the built in and on-by-default feedback method to tell us about your AI buying experience, report problems or request changes. Your input goes directly to our mostly-human dev team. You can also use our Gallery API to share successful orders. They just might show up in our home page feed.

What about UCP, x402, & KYA?

There are a lot of protocols! It's an exciting time for bots to be buying. But we're strongly opinionated that the right approach is to build universal-first. Each protocol is great, as long as the seller and buyer support it. We're building OneCheckout to work everywhere with the cards and checkout forms the web already has. Our intention is to layer in UCP data when helpful, to allow card to stablecoin for x402 and to implement the best new agentic tokens into a single wrapper. None of that matters if your users can't buy from normal card field sites, so that's where we've started. Watch this space. Oh and don't get us started on standards.

How does OneCheckout make money?

In some cases, we might recommend products or services where we can get you a great deal. For example, if you ask for texting we'll point you toward OneText, our parent company. We'll also charge for our forthcoming platform API.

Who's behind OneCheckout?

OneCheckout is a brainchild of OneText, the AI shopping, text-to-buy, and payments company. We're backed by Y Combinator, Coatue, Khosla, Lobster Capital, Pioneer Fund, Helium-3, and Good Friends. You can learn more about us on TechCrunch.

What's a spreedlyCardToken?

A non-sensitive token produced when the card is tokenized to Spreedly on-device. It stands in for the card in user_details_save. It is not the card number and can't be used to read it.

How many times does the agent confirm with the user?

Once, right before the single irreversible action. Everything else the agent does autonomously.

Can the agent speed things up by asking the user to paste their card?

No. That violates the hard rules and defeats the security model. Always use card_collect / card_enter so the card is filled securely and never touches the chat.