KeyLab MCP · For payment engineering

Your agent.
Repeatable checks.
Clear evidence.

Move payment cryptography checks into your coding workflow. Let the agent call KeyLab tools for PIN blocks, DUKPT and HSM simulation, then inspect the computed result.

Connect your agent Explore use cases

21 Free tools · 100 calls/day · Pro adds 3 bench tools

For test and development data. Remote calls are processed on KeyLab servers.

Try a computed example

01 · Your request

“Encode test PIN 1234 for test PAN 4012345678909 as an ISO 0 PIN block. Show the computed value.”

02 · Tool call

keylab_pin_block

{
  "action": "encode",
  "format": "0",
  "pin": "1234",
  "pan": "4012345678909"
}

03 · Computed result

{
  "format": "0",
  "pinBlock": "041274EDCBA9876F"
}

What this result means

The encoded test PIN block is 041274EDCBA9876F. It combines the supplied test PIN and PAN using format 0. Compare this value with your test system’s output; encoding a block does not encrypt or protect it.

An exact value to compare with your integration test, with the inputs visible.

Local demonstration with test data and the endpoint’s tool code. The request is illustrative; no agent is connected and no remote call is recorded.

From a question to a checkable result

Start with one real task.

Your agent sends test inputs to KeyLab tools and receives computed outputs to inspect and compare.
A tool result you can inspect, instead of relying on an explanation alone.
01

Investigate a DUKPT mismatch

Derive keys from a test BDK and KSN, inspect the variants, and compare with the values in your terminal test. Free.

Try this example
02

Check a PIN-block mismatch

Encode a test PIN and PAN, inspect the format and compare the computed block with your integration. Free.

Try a PIN-block walkthrough
03

Inspect an HSM host response

Look up a command schema for free, then run it against the fresh test-LMK simulator with Pro. Separate transport testing from hardware provisioning.

Try this example

One product, different decisions

Find your reason to try it.

Keep the calculation in a tool.

Inspect explicit inputs, computed outputs and host responses in your coding workflow. Use test vectors to investigate an integration.

Start with a DUKPT or PIN-block example.

Connection → activation

Finish with a successful remote call.

  1. 1. Choose your agent and sign in to KeyLab.
  2. 2. Create a scoped token and add the generated configuration to your client.
  3. 3. Ask the agent to run a supplied test-data example.
  4. 4. Check the successful remote call in KeyLab’s activity. Then repeat the task with your own test data.

Where do you work?

Setup uses Streamable HTTP with a bearer token. The application generates your configuration after you create a token and helps you verify the first call.

Set up this client

https://keylab.cloud/api/mcp

Capabilities

The tools behind the workflow.

Key management

Check values, parity, components, XOR

Included in Free

Key blocks

TR-31 / X9.143 wrap and unwrap

Included in Free

Derivation

DUKPT, EMV master and session keys

Included in Free

EMV

Cryptograms and TLV

Included in Free

PIN & card

PIN blocks, CVV, PVV

Included in Free

Ciphers & MAC

DES, AES, retail MAC

Included in Free

Parsing

ISO 8583, Luhn

Included in Free

Bench

Simulated payShield and KMIP

Command catalogue: Free · HSM execution and KMIP: Pro

Explore tool schemas, inputs and limitations

Choose the scope of your evaluation

Start free. Expand with a reason.

Free

$0

21 tools, including the HSM command catalogue. 100 tool calls per account per day.

Learn and validate your first workflow.

Pro

$29/month

Or $290/year. Adds HSM command execution and KMIP compose/decode; no daily MCP quota.

For an individual engineer using the bench.

Business

$415/seat/year

Annual billing; minimum 3 seats ($1,245/year). Includes Pro and KeyLab shared workspaces, roles and seat administration.

MCP tokens and usage stay account-scoped; this is not a shared MCP governance console.

All plans: 60 endpoint requests/minute. The agent subscription is separate from KeyLab. Compare all plan features and seat pricing.

Review the boundaries before connecting.

Agent → encrypted HTTPS request → KeyLab tool execution → result returned to your agent. Token scopes limit permitted tools; revoking the token stops future access. Keep tokens out of prompts, repositories and screenshots.

Where do the inputs go?

Your agent sends tool arguments over HTTPS to KeyLab servers; the computed result returns to the agent. The MCP usage record contains the tool name, time, status and token identifier, not arguments or results. Your agent provider has its own data policy. Use test data; do not send production keys, PINs or cardholder data.

Does the demo prove my agent is connected?

No. This page computes examples locally in your browser. After configuring your agent, make a remote tool call and check its successful call record in the MCP application. Copying a configuration or running a local example is not activation.

Is the HSM a production service?

No. It is a software simulator for learning and integration testing. Each remote HSM call starts fresh with a public Thales test LMK. State does not persist between calls; carry compatible test key blocks explicitly. It does not provide physical HSM security or certification.

Which clients can connect?

The endpoint uses Streamable HTTP and a bearer token. Setup is available for Claude Code, Cursor and VS Code. Client configuration support does not prove a connection in your environment. ChatGPT authentication compatibility has not been verified; do not assume it accepts a custom bearer header.

What are the limits?

Free includes 100 tool calls per account per day, resetting at 00:00 UTC. Pro and Business remove the daily quota. All plans remain subject to the endpoint limit of 60 requests per minute. Token permissions can restrict the tools available to an agent.

Prove one useful workflow.

Connect, run a test example, and verify the remote result.

Start with Free