What makes M-Pesa Daraja notable?

978 downloads. Trust evidence available

How should M-Pesa Daraja be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

M-Pesa Daraja

Advisory reference for Safaricom M-Pesa Daraja integration planning, reviews, sandbox testing, callbacks, reconciliation, and production-readiness. It provid...

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

978

Updated

Oct 11, 2026

Version

1.2.2

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 978 downloads reported by the source. Last updated 10/11/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 11, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 11, 2026
Adoption signal: 978 downloadsadoption · observed Oct 11, 2026
Latest release: 1.2.2release · observed May 25, 2026
Handshake status: UNKNOWNsecurity

What changed

Newest first. Only changes that point at a source are listed.

Release 1.2.2release
Clarify that the skill is advisory-only and does not require external account access to install or use. Soften marketplace-facing wording that ClawHub inferred as required credentials while preserving Daraja planning, review, sandbox, callback, and production-readiness guidance.
Observed May 25, 2026 · source

Install and run

Setup complexity: low.

clawhub skill install s176qs36hypcd7sgpevsvh7fd186rydm:mpesa-daraja

Install using `clawhub skill install s176qs36hypcd7sgpevsvh7fd186rydm:mpesa-daraja` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/nevilpaulo/mpesa-daraja before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-nevilpaulo-mpesa-daraja/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

115,151 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: mpesa-daraja
description: Advisory reference for Safaricom M-Pesa Daraja integration planning, reviews, sandbox testing, callbacks, reconciliation, and production-readiness. It provides implementation guidance only and does not require external account access to use.
version: 1.2.2
---

# M-Pesa Daraja

This is an advisory/reference skill. It does not call Safaricom APIs, initiate payments, or require external account access to install or use.

## Operating Rules

- Treat this as payment-integration guidance, not permission to move money.
- Default to Daraja sandbox endpoints and placeholder configuration unless the user explicitly asks for production guidance.
- Never store sensitive Daraja values, callback payloads with phone numbers, or transaction IDs in committed files.
- Ask before calling any live/production endpoint or sending any request that could trigger a payment prompt, payout, reversal, or customer-facing callback.
- Prefer environment variables and protected deployment settings over \`.env\` files in shared repos. If \`.env.example\` is needed, use placeholder values only.
- Make callbacks idempotent: verify request shape, persist raw event safely, deduplicate by CheckoutRequestID/ConversationID/TransactionID, then process business state transitions.

## Workflow

1. Identify the payment flow:
- **STK Push / Lipa na M-Pesa Online** for customer-initiated checkout.
- **C2B** for paybill/till customer payments with validation and confirmation callbacks.
- **B2C** for business payouts to customers or agents.
- **Transaction Status / Reversal** for reconciliation and recovery.
2. Confirm runtime context: language/framework, sandbox vs production, callback URL availability, persistence layer, and compliance constraints.
3. Design the integration around these boundaries:
- Daraja session setup and caching
- request authorization value generation
- outbound Daraja client
- callback receiver
- idempotency/reconciliation
- observability without leaking personal or payment data
4. Use \`references/examples.md\` when the user asks for sample OpenClaw prompts, implementation examples, or architecture snippets.
5. Use \`references/test-cases.md\` when the user asks for QA scenarios, unit tests, integration tests, sandbox tests, or production-readiness checks.
6. Use \`references/stk-push.md\` for STK Push/Lipa na M-Pesa Online implementation details.
7. Use \`references/api-endpoints.md\` when the user needs current Daraja endpoint names, versions, or flow coverage.
8. Use \`references/production-readiness.md\` before production-readiness reviews, client handoff, or launch checklists.
9. Use \`references/maintenance.md\` before updating or publishing this skill. Always check official Safaricom/Daraja sources for API changes, update the version, and run validation before pushing to ClawHub.

## Implementation Guidance

- Keep Daraja client code small and injectable so app tests can mock HTTP calls.
- Follo

_meta.json

{
  "ownerId": "kn72x5vtcasyn6bm1yyg4xqv0s86rdry",
  "slug": "mpesa-daraja",
  "version": "1.2.2",
  "publishedAt": 1779696781042
}

references/api-endpoints.md

# Daraja Endpoint Reference

Use this reference when a task needs endpoint names, API versions, or flow coverage. Treat it as a quick index, not a replacement for checking the live Safaricom Daraja portal before production work.

## Official Source Snapshot

Checked on 2026-05-25 against:

- Safaricom Daraja developer portal: https://developer.safaricom.co.ke/
- Safaricom developer API catalogue GraphQL query \`getApis\` via https://developer.safaricom.co.ke/api/graphql
- Portal documentation records through \`populateApi\` for STK Push, STK Query, Transaction Status, Reversal, and Account Balance

The portal is branded Daraja 3.0. The public pages are client-rendered, so prefer the live catalogue response over scraped static HTML when checking endpoint versions.

## Core Sandbox Endpoints

| Flow | Method | Sandbox endpoint |
| --- | --- | --- |
| Daraja authorization session | GET | Check the current Daraja portal for the session endpoint before implementation. |
| STK Push / Lipa na M-Pesa Online | POST | \`https://sandbox.safaricom.co.ke/mpesa/stkpush/v1/processrequest\` |
| STK Push query | POST | \`https://sandbox.safaricom.co.ke/mpesa/stkpushquery/v1/query\` |
| C2B register URL | POST | \`https://sandbox.safaricom.co.ke/mpesa/c2b/v2/registerurl\` |
| B2C payment request | POST | \`https://sandbox.safaricom.co.ke/mpesa/b2c/v3/paymentrequest\` |
| Transaction status | POST | \`https://sandbox.safaricom.co.ke/mpesa/transactionstatus/v1/query\` |
| Account balance | POST | \`https://sandbox.safaricom.co.ke/mpesa/accountbalance/v1/query\` |
| Reversal | POST | \`https://sandbox.safaricom.co.ke/mpesa/reversal/v1/request\` |

## Guidance

- Use sandbox endpoints by default. Switch to production hostnames only when the user explicitly asks for production guidance, and ask before any live call.
- Re-check the official catalogue before writing production instructions. Endpoint versions can differ from older examples and SDK snippets.
- The May 2026 catalogue listed C2B register URL as \`v2\` and B2C payment request as \`v3\`; avoid hard-coding older \`v1\` B2C/C2B URLs unless maintaining legacy code.
- If the catalogue and a detailed documentation page disagree, report the disagreement and avoid claiming a migration is required without confirmation from Safaricom.

references/examples.md

# M-Pesa Daraja Examples

## OpenClaw Usage Examples

Use these as realistic prompts for another OpenClaw/Codex session:

- "Use $mpesa-daraja to add sandbox STK Push checkout to my FastAPI app. Keep all sensitive settings in env vars and add tests for Daraja session setup, authorization value generation, outbound request shape, and callback idempotency."
- "Use $mpesa-daraja to review this M-Pesa callback route. Focus on duplicate callbacks, leaked phone numbers in logs, missing shape validation, and unsafe production endpoint usage."
- "Use $mpesa-daraja to create a Django model and service layer for tracking M-Pesa payments from pending to paid/failed/reversed."
- "Use $mpesa-daraja to draft a client implementation plan for Paybill C2B validation and confirmation callbacks."
- "Use $mpesa-daraja to generate QA test cases for STK Push before we request production access."

## Minimal STK Push Architecture

Recommended components:

- MpesaClient: handles Daraja session setup, STK authorization value generation, and Daraja HTTP requests.
- PaymentService: creates internal payment intent records and calls MpesaClient.
- CallbackController: receives Daraja callbacks, validates payload shape, persists raw event, and invokes reconciliation.
- PaymentRepository: enforces idempotency with unique CheckoutRequestID/MerchantRequestID/TransactionID constraints.
- ReconciliationJob: checks pending/unclear payments using transaction status or internal review queues.

State flow:

    order_created -> payment_pending -> stk_prompt_sent -> paid
                                          |-> failed
                                          |-> cancelled
                                          |-> expired
                                          |-> manual_review
    paid -> reversed

## Environment Variables

Use placeholders in examples:

    MPESA_ENV=sandbox
    MPESA_CONSUMER_KEY=replace-me
    MPESA_PRIVATE_APP_VALUE=replace-me
    MPESA_SHORTCODE=174379
    MPESA_STK_AUTH_VALUE=replace-me
    MPESA_CALLBACK_URL=https://example.test/api/mpesa/stk-callback
    MPESA_INITIATOR_NAME=replace-me
    MPESA_PROTECTED_OPERATOR_VALUE=replace-me

Do not commit real values.

## Python STK Authorization Value Example

    import base64
    from datetime import datetime, timezone


    def daraja_timestamp() -> str:
        return datetime.now(timezone.utc).strftime("%Y%m%d%H%M%S")


    def stk_authorization_value(shortcode: str, private_value: str, timestamp: str) -> str:
        raw = f"{shortcode}{private_value}{timestamp}".encode("utf-8")
        return base64.b64encode(raw).decode("utf-8")

## STK Push Request Shape

    {
      "BusinessShortCode": "174379",
      "Password": "base64-shortcode-private-value-timestamp",
      "Timestamp": "20260520101630",
      "TransactionType": "CustomerPayBillOnline",
      "Amount": 100,
      "PartyA": "254708374149",
      "PartyB": "174379",
      "PhoneNumber": "254708374149",
      "CallBackURL": "https://example.test

references/maintenance.md

# Skill Maintenance

Use this reference when updating mpesa-daraja or preparing a ClawHub release.

## Source Update Check

Before changing examples, production guidance, endpoint assumptions, or publishing a new version, check current official sources:

- Safaricom Daraja developer portal: https://developer.safaricom.co.ke/
- The specific Daraja API page for the flow being updated: STK Push, C2B, B2C, Transaction Status, Reversal, or Account Balance.
- Safaricom developer announcements or release notes when available.

Prefer official Safaricom sources over blogs, snippets, or copied SDK examples. If official pages are unavailable, say that clearly in the release notes and avoid making strong claims about changed behavior.

## Versioning

Use semantic versioning:

- Patch: typo fixes, safer wording, small test fixture updates. Example: 1.0.1.
- Minor: new references, scripts, flow coverage, or reusable examples. Example: 1.1.0.
- Major: breaking changes in skill behavior, trigger scope, file structure, or safety policy. Example: 2.0.0.

Always update the version field in SKILL.md before publishing to ClawHub.

## Pre-Publish Validation

Run:

python3 scripts/scan_skill_safety.py .
python3 scripts/validate_daraja_fixture.py stk-request path/to/request.json
python3 scripts/validate_daraja_fixture.py stk-callback path/to/callback.json

Only run fixture validation when fixture files exist. The safety scan should run every time.

## Release Notes Template

mpesa-daraja vX.Y.Z

Changed:
- ...

Sources checked:
- Safaricom Daraja portal
- ...

Validation:
- scan_skill_safety.py
- fixture validation, if applicable

Notes:
- No production account values or live payment calls used.

## Publishing Rule

Do not publish externally unless Nevil explicitly asks for a ClawHub push in that turn or the current task clearly includes publishing. If publishing is requested, check sources, bump version, run validation, then publish.

Github ReposUpdated 3d agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular