[ MODEL CONTEXT PROTOCOL · REMOTE SERVER ]

KEYLABFOR CODING AGENTS.

Claude Code, Cursor, VS Code and ChatGPT call KeyLab's payment-cryptography tools over MCP: PIN blocks, key check values, TR-31, DUKPT, EMV cryptograms, a payShield simulator. Proven code, called instead of guessed.

CONNECT AN AGENT TOOL REFERENCE
tools/call
→ keylab_tr31_parse {"keyBlock":"B0080P0TE00E000094B420079CC80BA3461F86FE26EFC4A3B8E4FA4C5F5341176EED7B727B8A248E","kbpk":"DD7515F2BFC17F85CE48F3CA25CB21F6"}
← {
  "header": {
    "version": "B",
    "keyUsage": "P0",
    "keyUsageLabel": "PIN Encryption Key",
    "algorithm": "T",
    "algorithmLabel": "Triple DEA (3DES)",
    "modeOfUse": "E",
    "modeOfUseLabel": "Encrypt / Wrap Only",
    "keyVersion": "00",
    "exportability": "E",
    "exportabilityLabel": "Exportable under trusted key",
    "numOptBlocks": 0,
    "blockLength": 80
  },
  "optionalBlocks": [],
  "macVerified": true,
  "clearKey": "3F419E1CB7079442AA37474C2EFBF8B8",
  "keyLengthBytes": 16,
  "mac": "6EED7B727B8A248E"
}

computed in this browser now · same code as the endpoint

[ WHAT IT ANSWERS ]

Every tool, as the agent lists it.

Key management

  • keylab_kcvKey check value
  • keylab_key_parityDES key parity — check or enforce
  • keylab_key_componentsKey components — split or combine (XOR)
  • keylab_xorXOR hex strings

Key blocks

  • keylab_tr31_parseTR-31 / X9.143 key block — parse and unwrap
  • keylab_tr31_createTR-31 / X9.143 key block — wrap a key

Derivation

  • keylab_dukpt_deriveDUKPT working keys (3DES X9.24-1, AES X9.24-3)
  • keylab_emv_udkEMV ICC master key (UDK) derivation
  • keylab_emv_session_keyEMV session key from the ATC

EMV

  • keylab_emv_arqcEMV ARQC / application cryptogram
  • keylab_emv_arpcEMV ARPC (issuer response cryptogram)
  • keylab_tlv_parseBER-TLV parser (EMV tags)

PIN & card

  • keylab_pin_blockPIN block (ISO 9564 formats 0–4)
  • keylab_cvvCVV / CVV2 / iCVV
  • keylab_pvvVisa PVV (PIN verification value)

Ciphers & MAC

  • keylab_macMessage MAC (X9.9, X9.19, ISO 9797-1)
  • keylab_des3DES encrypt / decrypt
  • keylab_aesAES encrypt / decrypt

Parsing

  • keylab_iso8583_parseISO 8583 message parser
  • keylab_luhnLuhn check (PAN / IMEI)

Bench · PRO

  • keylab_hsm_commandspayShield host commands — catalogue, schema, worked example
  • keylab_hsm_runRun a host command on the simulated payShield
  • keylab_kmip_buildKMIP request — compose to TTLV
  • keylab_kmip_readKMIP TTLV — decode a request or response

Inputs take spaces and either case. A wrong input comes back as a sentence naming the field, so the agent fixes its own call. Full contract on the tool reference.

[ CONNECT ]

A token, one line, done.

  1. 1Sign in and create an agent token on the MCP page. It is shown once.
  2. 2Add the server to your client with the line on the right, token in the header.
  3. 3Ask for a PIN block, a KCV, a TR-31 unwrap. The agent calls the tool and shows the answer.
claude mcp add --transport http keylab https://keylab.cloud/api/mcp --header "Authorization: Bearer klt_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Endpoint https://keylab.cloud/api/mcp · Streamable HTTP · stateless · bearer token

FREE

Every calculator tool, 100 calls a day per account.

Keys, PIN, EMV, wire and ciphers. The daily count resets at 00:00 UTC.

PRO

The bench too, with no daily limit.

Run host commands on the simulated payShield; compose and decode KMIP.

See plans

[ QUESTIONS ]

What does the agent send to KeyLab?
The arguments of each tool call — a PIN block, a key, a TR-31 block — over TLS to keylab.cloud, where the same code the browser calculator runs computes the answer. KeyLab records which tool was called and when, never the arguments or the result.
Is it the same code as the browser tools?
Yes. Every tool wraps the function the calculator already runs, proven against third-party test vectors (psec, openemv, BP-Tools, EMVCo, X9.24). Nothing is reimplemented for the agent.
Which clients work?
Any MCP client that speaks Streamable HTTP with a bearer header: Claude Code, Cursor, VS Code, ChatGPT in developer mode, and the MCP Inspector. The endpoint is stateless, so nothing is kept between calls.
What is free and what is Pro?
Every calculator tool is free with a daily limit of 100 calls per account. Running a host command on the simulated payShield and composing or decoding KMIP need a Pro plan, which also removes the daily limit.

Give your agent the oracle.

CONNECT AN AGENT