Pro UPI QR

in.proupiqr/upi-toolsproupiqr.instreamable-httpv1.1.0Scanned 58 minutes ago

UPI payment links and QR codes, UPI error help, and GST, MSMED and MDR calculators for India.

9 tools: 7 change things and 2 only read.

Reads private data · 1
Reads text others write · 0
Can send data out · 0
4 findings

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

9 tools

Changes things 7Creates or changes something that can be changed back.Claude Code: ask

amount_in_wordsWrite a rupee amount in words the Indian way (lakh and crore), as on invoices, receipts and cheques.1 finding
Why it is in this group
- The description's first verb is "write": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "amount_in_words" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "write": a word for a change.
  What this check looks for
Description, as the server wrote it
Write a rupee amount in words the Indian way (lakh and crore), as on invoices, receipts and cheques. For example 125050.50 → "One Lakh Twenty Five Thousand Fifty Rupees and Fifty Paise Only".
Annotations the server declares
- title: Rupee amount in words
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
calculate_gstCalculate Indian GST on an amount, exact to the paisa: add GST to a price before tax, or take it out of a GST-inclusive price, split into CGST + SGST (sale within a state) or IGST …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Calculate Indian GST on an amount, exact to the paisa: add GST to a price before tax, or take it out of a GST-inclusive price, split into CGST + SGST (sale within a state) or IGST (between states).
Annotations the server declares
- title: Calculate GST
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
calculate_msmed_interestCalculate the interest a buyer owes a micro or small enterprise (Udyam-registered supplier) for paying late, under Section 16 of India's MSMED Act: three times the RBI Bank Rate (1…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Calculate the interest a buyer owes a micro or small enterprise (Udyam-registered supplier) for paying late, under Section 16 of India's MSMED Act: three times the RBI Bank Rate (17.25% a year as of 7 Oct 2026), compounded monthly, from the day after the payment deadline (the agreed credit period, at most 45 days). Exact to the paisa.
Annotations the server declares
- title: Calculate MSMED late-payment interest
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
calculate_upi_mdrWork out the UPI merchant discount rate (MDR) on a payment under the rules from 15 October 2026: 0.4% on person-to-merchant UPI payments above ₹2,000 (capped at ₹300), a flat ₹5 fo…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Work out the UPI merchant discount rate (MDR) on a payment under the rules from 15 October 2026: 0.4% on person-to-merchant UPI payments above ₹2,000 (capped at ₹300), a flat ₹5 for essential-sector merchants and 0.02% for capital markets. Person-to-person payments, payments of ₹2,000 or less and small P2PM merchants (up to ₹1 lakh a month) pay nothing. Shows the 18% GST on the MDR and what the merchant keeps.
Annotations the server declares
- title: Calculate UPI MDR
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_upi_payment_linkCreate a UPI payment link (upi://pay) for an Indian UPI ID.1 finding
Why it is in this group
- The name "create_upi_payment_link" says "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "create_upi_payment_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "create_upi_payment_link" says "create": a word for a change.
  What this check looks for
Description, as the server wrote it
Create a UPI payment link (upi://pay) for an Indian UPI ID. On a phone it opens PhonePe, Google Pay, Paytm, BHIM or any UPI app with the payee, amount and note filled in. Use it to collect a payment, split a bill or put on an invoice. Returns the link and a proupiqr.in page with its QR code and printable poster. Amounts are exact to the paisa; nothing is stored. It never moves money: the payer approves the payment in their own UPI app.
Annotations the server declares
- title: Create UPI payment link
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
explain_upi_errorExplain a failed UPI payment from its error code or message (e.g.1 finding
Why it is in this group
- The name "explain_upi_error" says "explain": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "explain_upi_error" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "explain_upi_error" says "explain": a word for reading.
  What this check looks for
Description, as the server wrote it
Explain a failed UPI payment from its error code or message (e.g. U30, ZM, XH, Z9, U16, or "debit has been failed"): what it means, which side caused it, whether money was debited and when it comes back, and what the payer or merchant should do next. Covers 42 common NPCI and bank codes.
Annotations the server declares
- title: Explain a UPI error code
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
generate_upi_qr_codeGenerate a UPI payment QR code (PNG image) for an Indian UPI ID that PhonePe, Google Pay, Paytm, BHIM and every UPI app can scan, optionally with a fixed amount and note.1 finding
Why it is in this group
- The name "generate_upi_qr_code" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "generate_upi_qr_code" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_upi_qr_code" says "generate": a word for a change.
  What this check looks for
Description, as the server wrote it
Generate a UPI payment QR code (PNG image) for an Indian UPI ID that PhonePe, Google Pay, Paytm, BHIM and every UPI app can scan, optionally with a fixed amount and note. Also returns the upi:// link and a proupiqr.in page to download a printable counter poster or stickers. Nothing is stored. It never moves money: the payer approves the payment in their own UPI app.
Annotations the server declares
- title: Generate UPI QR code
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 2Looks things up and changes nothing.Show 2 read-only tools

find_merchant_toolsFind the free Pro UPI QR tool for a task: invoices, receipts, rent receipts, salary slips, quotations, GST and MSME tools, UPI QR posters and stickers, calculators and guides.No findings
Why it is in this group
- The name "find_merchant_tools" says "find": a word for reading.
Description, as the server wrote it
Find the free Pro UPI QR tool for a task: invoices, receipts, rent receipts, salary slips, quotations, GST and MSME tools, UPI QR posters and stickers, calculators and guides. Returns matching tools with links; they run in the browser with no signup.
Annotations the server declares
- title: Find a free Pro UPI QR tool
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
read_upi_linkRead a UPI payment link (the upi://pay… text inside a payment QR code) and check it: who gets paid, the amount, the note and any merchant fields, with warnings about anything malfo…Reads private dataNo findings
Why it is in this group
- The name "read_upi_link" says "read": a word for reading.
What it can reach
- private-dataThe description's first sentence says "read" and "note": it reads notes.
Description, as the server wrote it
Read a UPI payment link (the upi://pay… text inside a payment QR code) and check it: who gets paid, the amount, the note and any merchant fields, with warnings about anything malformed or risky, such as an AutoPay mandate posing as a payment. Use it before paying from a QR someone sent, or to find out why apps reject a QR.
Annotations the server declares
- title: Read and check a UPI link
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; read_upi_link
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

4 warn

Warncreate_upi_payment_link
The server marks "create_upi_payment_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "create_upi_payment_link" says "create": a word for a change.
What this check looks for
Warngenerate_upi_qr_code
The server marks "generate_upi_qr_code" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_upi_qr_code" says "generate": a word for a change.
What this check looks for
Warnexplain_upi_error
The server marks "explain_upi_error" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "explain_upi_error" says "explain": a word for reading.
What this check looks for
Warnamount_in_words
The server marks "amount_in_words" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "write": a word for a change.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http upi-tools https://www.proupiqr.in/mcp/

claude mcp add --transport http upi-tools https://www.proupiqr.in/mcp/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__upi-tools__read_upi_link",
      "mcp__upi-tools__find_merchant_tools"
    ],
    "ask": [
      "mcp__upi-tools__create_upi_payment_link",
      "mcp__upi-tools__generate_upi_qr_code",
      "mcp__upi-tools__explain_upi_error",
      "mcp__upi-tools__calculate_gst",
      "mcp__upi-tools__calculate_msmed_interest",
      "mcp__upi-tools__calculate_upi_mdr",
      "mcp__upi-tools__amount_in_words"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as upi-tools. Review it before you use it.

Capability tags behind 1 rule

mcp__upi-tools__read_upi_link private-data

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/in.proupiqr/upi-tools/verify?hash=cee34321dfc2b91e8a162dc9d99347eebb285fe7c22d23a51836bb2b1380ef1c" | jq -e '.changed == false'

Pinned hash cee34321dfc2, from Oct 30, 2026, 14:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/in.proupiqr/upi-tools/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/in.proupiqr/upi-tools.svg)](https://anlyon.dev/servers/in.proupiqr/upi-tools)

Source: MCP Registry. Synced Oct 30, 2026, 14:17 UTC.