Platform MCP

The Mural Platform MCP server lets AI assistants and agents that speak the Model Context Protocol read your Mural platform data: your account, the organizations under it, accounts and balances, transactions, counterparties, RFIs, members and roles, API keys, and webhooks. Every tool is read-only — the server can never move money, create resources, or change settings.

🚧
Beta
The MCP server is in beta. Tool names and response shapes may change while we iterate. Reach out to [email protected] with feedback or issues.

Endpoint

Environment	URL
Sandbox	`https://api-staging.muralpay.com/api/platform/mcp`
Production	`https://api.muralpay.com/api/platform/mcp`

The server uses the MCP Streamable HTTP transport (JSON responses, no server-initiated streams) and the current MCP specification.

Connecting

Add the URL above to any client that supports remote MCP servers, then sign in with your Mural account when prompted. There is nothing to install and no key to copy.

Claude (web, desktop, or mobile) — Settings → Connectors → Add custom connector, paste the URL, then complete the sign-in.

Claude Code — run:

claude mcp add --transport http mural https://api.muralpay.com/api/platform/mcp

Other clients — anything implementing the MCP Streamable HTTP transport with OAuth 2.1 works. Point it at the URL and let it run the authorization flow.

Once connected, start with a question like "which organizations can I see?" or "show me my failed payouts this month."

Authentication

The server authenticates with OAuth 2.1 bearer tokens — the same login your team uses for the Mural dashboard. There are no API keys for MCP: each caller acts as themselves, with exactly the access their Mural user already has.

MCP clients discover the authorization server automatically:

An unauthenticated request returns 401 Unauthorized with a WWW-Authenticate header pointing at the protected-resource metadata.
The metadata document at /.well-known/oauth-protected-resource/api/platform/mcp names the authorization server.
The client completes the OAuth flow and retries with a bearer token.

Clients that support remote MCP servers handle this flow for you. Sessions stay signed in across restarts, so you log in once per machine.

Available tools

All money amounts are cents as strings (for example "1050" is $10.50). Every response includes the organizationId it was resolved for.

Throughout this server, organization means one of the child organizations under your account, the same ones the Mural console lists on its Organizations page. The accounts your own login can switch between are a separate thing, listed only by list_accessible_organizations. Call that first and pass one of its ids as the organizationId argument of every other tool.

Tool	Description
`list_accessible_organizations`	Bootstrap only: the accounts this token may act on, for choosing an `organizationId`
`get_account_overview`	Your account's own profile, programs, and compliance status
`list_organizations`	The organizations under your account, with verification status
`get_organization`	One organization with TOS/KYC links and account balances
`get_organizations_summary`	Organization counts per verification status
`list_accounts`	The wallets that hold and receive funds, with organization, blockchain, address, and balances
`get_account`	One account in full, including payin methods and funding instructions
`get_treasury_balance`	Your own total balance, broken down by account and currency
`get_child_organizations_balance`	Total held across every child organization, separate from your own treasury
`list_rfis_for_organization`	Requests for information (RFIs) for one organization
`list_rfis`	RFIs across all of your organizations, filterable by status (one page of 50; `total` counts all)
`list_transactions`	Payins and payouts as summary rows, filterable by status, currency, date, and more
`get_transaction`	One transaction with approval metadata and failure details
`get_transaction_volume`	Aggregate payin/payout volume in USD
`get_transaction_failure_breakdown`	Failed payouts counted by reason, with corrective actions and example ids
`list_counterparties`	Payment counterparties as summary rows (name, type, payout count)
`get_counterparty`	One counterparty with masked payout methods and payout count
`list_members`	Organization members and pending invitations
`list_roles`	Built-in and custom roles, the permissions each grants, and how many members hold it
`list_api_keys`	Active API keys (masked; organization admins only)
`list_webhook_endpoints`	Webhook endpoints with status and subscribed categories
`list_webhook_deliveries`	Recent webhook deliveries with state and payload
`resolve_entity`	Identify what an id refers to across all of the above

Data protection

Responses are scoped to the organizations your Mural user can access — the same boundary as the dashboard and the Platform API.
API keys are shown masked (last four characters only) and bank account numbers are masked to their last four digits.
Requests are rate-limited per user.