What Is Iyzico MCP (qwertyvan)? Card Data, Sandbox vs. Live, and Payment Risk

You give your assistant an installment-plan, payment or refund task; Iyzico MCP (qwertyvan) calls the iyzico payment API. It has eight tools: three read (BIN lookup, installment plan, payment retrieval), five write, and four of those move money: charging a card without 3D Secure, refunds, payment cancellation and starting a subscription. In the payment and subscription tools, the card number, expiry date and CVC are tool inputs, so card data passes through the assistant's tool call. It is a community MCP server, not an official iyzico product, and the repository carries no notice saying so. The default is sandbox; going live needs both the live URL and an extra confirmation variable. The package is not published on npm; you build it from source.

What it does: Lets the assistant use the iyzico payment API
Type: MCP server (community, unofficial)
Maker: qwertyvan (individual)
Environment: Sandbox by default; extra confirmation flag for live
Card data: Tool input, passes through the assistant
Maturity: Version 0.1.0, 4 commits, 0 stars
Price: Software free (MIT); iyzico terms are separate

What does Iyzico MCP (qwertyvan) do?

MCP is the standard that lets AI programs connect to outside tools. This server opens an iyzico (a Turkish online payment provider) merchant account to the assistant. The read tools return the brand, type and bank for a BIN (the first 6-8 digits of a card), installment plans for a BIN and amount, and a payment record. The write tools take a payment, refund, cancel a payment, start a subscription and cancel a subscription.

YouYou write the payment, installment or refund task

AssistantAn assistant that supports MCP

Iyzico MCP (qwertyvan)Runs on your computer

iyzico payment APISandbox by default; extra confirmation for live

Four tools move money; card data passes through the assistant as tool input.

Ask the assistant about iyzico dataWhat you get: Card/installment/payment detailsNeeds a separate setup Have the assistant run payment operations in iyzicoWhat you get: Real money movement (in live mode)Needs a separate setup

Tool	Type	Moves money
iyzico_bin_inquiry, iyzico_get_installment_info, iyzico_retrieve_payment	Reads	No
iyzico_create_payment	Writes	Yes: card charge without 3D Secure
iyzico_refund_payment	Writes	Yes: refund (full/partial)
iyzico_cancel_payment	Writes	Yes: payment cancellation (before settlement)
iyzico_create_subscription	Writes	Yes: subscription starts; if ACTIVE, the card is charged immediately
iyzico_cancel_subscription	Writes	No refund; stops future charges

This tool is not an official iyzico product; iyzico's GitHub organization shows no MCP repository and there is no official MCP page. The repository has no "unofficial" notice either. A tool that moves real money at this maturity (version 0.1.0, 4 commits) should be reviewed very carefully before use on a production account.

Who it's for: developers building an iyzico integration who want to try API calls in the sandbox with an assistant. Not recommended for live customer payments; this page states facts from the sources, not a recommendation.

How do you install Iyzico MCP (qwertyvan)?

You need: an iyzico merchant account (for sandbox, sandbox-merchant.iyzipay.com; the API key and secret key come from the dashboard) and Node.js 20+. The README command claude mcp add iyzico -- npx -y @qwertyvan/iyzico-mcp does not work right now: the @qwertyvan/iyzico-mcp package is not on npm (404, October 15, 2026). The README gives the steps to build from source but no command for connecting it to an MCP client.

Build from source (README)› git clone https://github.com/qwertyvan/iyzico-mcp.git && cd iyzico-mcp && npm install && npm run build

After building, you connect the client with the node bin/iyzico-mcp.js command and put the environment variables in the env block of the client's configuration (the README's sandbox example):

env block (placeholder values)› IYZICO_API_KEY=sandbox-xxxxxxxx IYZICO_SECRET_KEY=sandbox-xxxxxxxx IYZICO_BASE_URL=https://sandbox-api.iyzipay.com

The keys sit in plain text in the MCP client's configuration file (such as the Claude Desktop JSON). The key is not a tool argument, and a .env file is not read automatically. Don't paste the secret key into the chat.

How do you use Iyzico MCP (qwertyvan)?

Try it only with a sandbox account and approve every tool call that moves money yourself. Don't use real card details.

Installment lookup"In the iyzico sandbox, show the installment options for BIN 454360 and an amount of TRY 1,000. Don't create any payment."

Payment record"Retrieve the payment record for this paymentId and list its item transactions. Don't refund or cancel anything."

Don't let the assistant run the refund, cancel and payment tools automatically: require approval for every call in the client.

Where does Iyzico MCP (qwertyvan) work?

Claude DesktopPartly	The README example relies on the npm package, which doesn't exist; connect the version built from source with the node command.
Claude CodePartly	The README command fails because the package doesn't exist; the built file can be added with `claude mcp add`.
Other clientsUnclear	Not stated in the documentation.

What does Iyzico MCP (qwertyvan) access, and where does card data go?

Reads

BIN details, installment plans and payment records (from the iyzico account).

Writes

Taking payments, refunds, payment cancellation, starting and canceling subscriptions. The code marks these as destructive.

Deletes

There is no delete tool, but refunds and cancellations cannot be undone.

Data

The schemas of the payment and subscription tools require the cardholder name, card number, expiry date and CVC; so card data passes through the assistant's tool call and may reach the AI service you use. The repository does not mention PCI compliance; the README says card data is not logged and does not appear in output (the repository's own claim).

The default environment is sandbox. Going live requires both IYZICO_BASE_URL set to exactly api.iyzipay.com and IYZICO_ALLOW_PROD=1; without the second, the server won't start. This guard only works when the hostname matches exactly. With a live key, real customer cards enter the assistant's context: that decision has to be yours.

GitHub Security Advisories are empty (the repository has a SECURITY.md). OSV doesn't apply because the package isn't published. This does not mean "secure". The 7 open pull requests come from bots; there are no issues opened by people.

Is Iyzico MCP (qwertyvan) free?

The software is free and MIT-licensed. iyzico API fees and account terms are not in the repository; they depend on your contract with iyzico. No Turkish lira price is listed. This is not financial or legal advice.

Common issues

What happens	What to do
The npx -y @qwertyvan/iyzico-mcp package can't be found	The package isn't published on npm; build from source.
The server won't start with the live URL	IYZICO_ALLOW_PROD=1 is missing; this is an intentional guard.
Node error	package.json requires Node 20 or later.

How do you remove Iyzico MCP (qwertyvan)?

In the client: Delete the iyzico entry from the MCP configuration and restart the client.
Keys: Rotate or revoke the API and secret keys you used in the iyzico dashboard; delete the plain-text key from the configuration file.
Folder: Delete the cloned repository folder.

Frequently asked questions

Is Iyzico MCP (qwertyvan) an official iyzico tool?

No, it is a community project by an individual developer. iyzico's GitHub organization shows no MCP repository and there is no official MCP page. The repository also has no notice saying it is unofficial.

Does my card data pass through the assistant?

Yes: the schemas of the payment and subscription tools require the card number, expiry date and CVC. That data passes through the assistant's context with the tool call. The repository does not mention PCI compliance.

How are sandbox and live separated?

Sandbox is the default. Live requires both IYZICO_BASE_URL=https://api.iyzipay.com and IYZICO_ALLOW_PROD=1; without the second, the server won't start.

How do you install it?

The npx command in the README doesn't work because the package isn't on npm. You clone the repository and build it with npm install and npm run build; Node 20+ is required.

Is it safe?

There is no safety stamp. No security advisory is recorded on GitHub, but the project is very new, at version 0.1.0 with 4 commits and 0 stars, and it includes tools that move money.

Sources

Not clear in the official sources: Whether the tools actually work · the README's "not logged" claim · iyzico API fees and account terms · connecting the built file with Claude Code · Turkish support. Each is covered in its section.