Skip to content

walletmcppass: Apple Wallet passes

by walletmcppass.com · remote · no sign-in to list tools · v1.1.0 · published by com.walletmcppass

Create signed Apple Wallet passes (.pkpass): boarding passes, tickets, coupons, store cards.

Deletes · 1Final · 1

2 tools: 1 can delete or cancel things and 1 do something that can't be undone.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http wallet https://walletmcppass.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info
  • The description is 12,308 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...life, e.g. until a flight lands or an event ends. Only with updatable=True."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

2 tools

Deletes or cancels 1Claude Code: deny
  • update_wallet_passChange a pass made with create_wallet_pass(updatable=True); every iPhone that added it refreshes.No findings

    Why it is in this group

    • The name "update_wallet_pass" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change a pass made with create_wallet_pass(updatable=True); every iPhone that added it refreshes. Takes the serial_number and edit_token returned when the pass was created, plus any of create_wallet_pass's parameters, with the same meanings. Each parameter given replaces the stored value completely (a fields list replaces the whole list, so resend unchanged fields too); parameters left out keep their current values. Clear a text value with "" and a list with []. To cancel a pass, set voided=True: Wallet marks it void on every iPhone. Wallet asks the server for the new version as soon as Apple delivers the push, usually within seconds. A field's changeMessage is shown on the lock screen when that field's value changes. Only works until the pass's updatable_until time (set by updatable_hours at creation). Returns {download_url, expires_in_seconds, serial_number, pass_type_identifier, notified_devices, updatable_until}. notified_devices counts the iPhones the push was sent to, not ones that have already refreshed. The download_url (valid 1 hour) is only needed to add the pass to a new device.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Update Apple Wallet pass
Can't be undone 1Claude Code: ask
  • create_wallet_passCreate a signed Apple Wallet pass (.pkpass) and return a link to download it.1 finding

    Why it is in this group

    • The name "create_wallet_pass" says "create": a word for a change.
    • The description says "can't be recovered".

    Findings

    • Info

      The description is 12,308 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...life, e.g. until a flight lands or an event ends. Only with updatable=True."

      What this check looks for
    Description, as the server wrote it
    Create a signed Apple Wallet pass (.pkpass) and return a link to download it. Builds one pass in one of the five Wallet styles -- boardingPass, eventTicket, coupon, storeCard or generic -- from the text fields, colors, barcode and optional PNG images given below, signs it with this service's Apple Pass Type ID certificate, and returns an https download_url valid for 1 hour. Opening the link on an iPhone shows "Add to Apple Wallet". Passes install on any iOS version; the iOS 26/27 layouts fall back to the classic style on older iPhones. Barcodes: QR, PDF417, Aztec and Code128 on every iOS version; Code39, Codabar, EAN13 and ITF on iOS 27+. The barcode encodes exactly barcode_message. Gate and till scanners read that data, so a copy of an existing boarding pass, ticket or loyalty card only scans if barcode_message is the original barcode's content (airline boarding passes are usually PDF417 or Aztec, holding an IATA BCBP string such as "M1DOE/JANE ..."). This tool does not issue tickets, check anyone in, or contact airlines or venues. The link must be opened in Safari on the iPhone: Wallet adds a pass from Safari, but not from a .pkpass file handed over by another app. Google Wallet on Android also imports these files. Not supported: NFC passes. With updatable=True the pass can be changed later with update_wallet_pass, and copies already in Wallet refresh themselves. Its contents are then stored on this server for updatable_hours (1 hour by default, at most 30 days), then deleted. Returns {download_url, expires_in_seconds, serial_number, pass_type_identifier}, plus edit_token and updatable_until when updatable=True. Pricing: a call is one create or one update. Free for 30 calls a day per caller IP, while a shared pool of 500 free calls a day lasts; failed calls count too, and counts reset at 00:00 UTC. Past either limit, a call costs $0.01 in USDC on Base, paid with x402; the refusal carries the payment requirements, and a paid result includes the payment receipt. Payment is settled only after the pass is built, so a failed build is never charged. Args: style: one of "boardingPass", "eventTicket", "coupon", "generic", "storeCard". organization_name: shown as the pass issuer. description: accessibility description (required by Wallet, not usually shown). logo_text: text shown next to the logo image. transit_type: only for style="boardingPass" -- "Air", "Boat", "Bus", "Generic", or "Train" (default "Air"). barcode_message: raw text/data encoded into the barcode. Omit for no barcode. barcode_format: a format name or an ordered list of them; each becomes a barcode with the same message, and Wallet shows the first one the device supports. Nothing is added that you don't list. Formats: "QR" (default), "PDF417", "Aztec", "Code128" (all iOS versions), and iOS 27+ only: "Code39", "Codabar", "EAN13", "ITF" -- older iPhones skip these, so e.g. ["EAN13", "Code128"] shows EAN13 on iOS 27 and Code128 before it. EAN13 needs 12-13 digits, ITF an even number of digits, Code39 uppercase letters/digits. barcode_alt_text: human-readable text shown under the barcode (e.g. the card number). background_color / foreground_color / label_color: hex colors, e.g. "#1a1a19". relevant_date / expiration_date: ISO 8601 timestamps. locations: up to 10 places where the pass appears on the lock screen when the iPhone is nearby, each {"latitude": float, "longitude": float, "altitude": optional float, "relevantText": optional str shown on the lock screen, e.g. "Your gym card"}. Look up the coordinates of the actual branch, not just the brand. For boardingPass and eventTicket the pass is relevant near a location around relevant_date if one is set; the other styles use location alone. Wallet only shows a pass within its own default radius of a location, which is small for store cards and coupons. max_distance: meters; shrinks the default radius around every location (Wallet uses the smaller of the two, so it cannot enlarge it). Requires locations. voided: mark the pass voided/used (shows a "VOID" stamp). primary_fields / secondary_fields / auxiliary_fields / header_fields / back_fields: lists of {"key": optional str, "label": optional str, "value": str, "changeMessage": optional str} shown on the pass. changeMessage only matters on updatable passes: when an update changes that field's value, the iPhone shows it as a lock-screen notification, with %@ replaced by the new value (e.g. "You now have %@ points"); without %@ Wallet shows a generic message. Updates match fields by key, so give fields that will change an explicit key (auto keys are by position). serial_number: unique id for this pass; auto-generated if omitted. icon_color / icon_text: control the auto-generated icon (a colored square with initials) when icon_png_b64 is not supplied. logo_color: color of the auto-generated logo image, a wordmark of logo_text (or organization_name) drawn on a transparent background over background_color. Defaults to icon_color. Wallet also renders logo_text as text beside the logo image, so the generated wordmark repeats it -- set generate_logo=False to show only the text. icon_png_b64 / logo_png_b64: PNG to use instead of auto-generated art. Every *_png_b64 parameter takes either base64 PNG data or an https:// URL of an image (PNG, JPEG, WebP or GIF, up to 5 MB; non-PNG is converted to PNG). The URL is fetched once, when the pass is built. generate_logo: set False to include no auto-generated logo… [6308 more characters not shown]

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Create Apple Wallet pass

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http wallet https://walletmcppass.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__wallet__create_wallet_pass"
    ],
    "deny": [
      "mcp__wallet__update_wallet_pass"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as wallet. Review it before you use it.