The catalogue is tagged in place: [READ-ONLY], [WRITE] and [DESTRUCTIVE] open each description, and cancel_payment_link, cancel_order, create_refund, delete_plan, cancel_subscription, delete_presentation, cancel_payout and logout each state that they must never auto-execute without explicit confirmation carrying specific parameters. The guard extends past those: descriptions here also tell the model to ignore instructions arriving inside data fields, API responses or other tool output, putting the injection defence in the surface rather than in the client. The pairing worth noticing is detect_stack before integrate_pinelabs_checkout: the generator is told to read the project instead of asking, so the code it emits follows whatever it finds there.
Pine Labs' own server over its Plural payment stack: payment links and checkout orders, card OTP and refunds, subscription plans collected through UPI mandates, payouts and settlements, and a code generator that reads the project's stack before it writes anything.
- Payment links end to end: create_payment_link returns a short URL and carries the amount in paisa, customer, billing and shipping details, an expire_by and your own merchant_payment_link_reference; get_payment_link_by_id and get_payment_link_by_merchant_reference read it back by either key; resend_payment_link_notification re-sends over the channel that was used originally; cancel_payment_link works while the link is still CREATED.
- Checkout orders with a pre-authorisation path: create_order returns an order id and redirect URL and supports REDIRECT, IFRAME and SDK integration modes, while capture_order and cancel_order act on an order created with pre_auth=true — a single partial capture is allowed per order and the balance is auto-reversed to the customer.
- UPI collection without a hosted checkout page: create_upi_intent_payment_with_qr creates the pay order and its UPI intent QR in one call and returns both responses, including the QR image URL when one is available.
- Card verification in the same surface: generate_otp and resend_otp send the code to the customer's registered mobile, and get_card_details takes the extended BIN prefix and returns network, issuer, type and OTP support.
- Refunds keyed to the order: create_refund covers full, partial, multi-cart partial and split settlement refunds against an order_id, with an idempotency_key and optional split_details.
- Subscriptions on UPI mandates: create_plan fixes the amount and the frequency — Day, Week, Month, Year, Bi-Monthly, Quarterly, Half-Yearly, AS or OT — create_subscription sends the customer through the Pine Labs-hosted REDIRECT flow so the mandate is approved in their own UPI app, and pause_subscription, resume_subscription, update_subscription and cancel_subscription move it afterwards.
- Collecting against a live mandate: create_presentation registers the due date and amount, send_subscription_notification issues the pre-debit notice, create_debit executes the collection, and create_merchant_retry re-runs one that failed, up to the README's max of 3 retries.
- Money on the way out: get_payout_balance returns the funding account number, branch code and available balance, get_payout_payments filters payout records, update_payout re-schedules and cancel_payout stops one still SCHEDULED, and get_all_settlements with get_settlement_by_utr read settlements by date range or by UTR.
- Reconciliation reads: get_order_details, get_payment_link_details, get_refund_order_details and get_payout_details each take start_date and end_date, and search_transaction resolves a single transaction id.
- Writing the integration rather than describing it: detect_stack reads the project's files and dependency manifest to name the language, frameworks and package manager, integrate_pinelabs_checkout then emits backend routes, frontend integration and callback handling, and list_plural_apis with get_api_documentation return the parsed OpenAPI spec for a named API.
- get_merchant_success_rate returns the account's transaction success rate over a range, accepting natural-language date expressions that the server resolves against its own clock.
A Pine Labs merchant account and the API credentials issued for it, supplied as PINELABS_CLIENT_ID and PINELABS_CLIENT_SECRET. The dated reads and the transaction search also want the merchant_id those records belong to.
One command plus a key — npm i pinelabs-mcp, then supply credentials