PagoKit plugin
PagoKit picks a payment provider for the project country in Claude Code and writes the integration with webhook checks
- 70 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The plugin writes project files, database migrations and payment code, so a mistake costs real money
- Hooks block insecure writes but can be bypassed with a comment, and provider keys live in the project environment
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/pagokitDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The plugin writes project files, database migrations and payment code, so a mistake costs real money
- Hooks block insecure writes but can be bypassed with a comment, and provider keys live in the project environment
This is third-party code. Review the repository files before installing.
What it does
PagoKit is a Claude Code plugin that analyzes a project, asks three questions and generates a whole payment integration: a payment form, a server checkout route, a webhook with signature verification, a database migration, a customer portal, a refund path, an error taxonomy and a go-live checklist. For a Next.js App Router project with Prisma it creates `app/api/checkout`, `app/api/webhook/<provider>`, `lib/payments` and `PAGOKIT_PRODUCTION_CHECKLIST.md`. Provider choice comes from a deterministic advisor, `scripts/advise.js`: it ranks providers by country, currency and payment method, computes fees and names a reason for every rejection. The catalog holds 42 providers and the plugin builds full code for four: Lemon Squeezy, Mercado Pago, Stripe and Wompi. The other 38 it compares and recommends while leaving the code to you. The critical parts are not left to the model. Checks on PreToolUse and PostToolUse hooks block an insecure write, for example a webhook with no signature check or amounts that ignore currency minor units. The signed-event generator `scripts/sign-event.js` tests a handler with a valid, a forged and a replayed event. Commands: `/pagokit:start`, `add`, `compare`, `coverage`, `doctor`, `harden`, `migrate`, `test`.
Who it is for. Founders and SaaS developers who need to take payments in Latin America, Europe or the US without leaving the usual holes in webhooks.
Good fit when
- The product enters the Colombian or Brazilian market and you must choose between Wompi, Mercado Pago and Stripe with real fees
- Payment code already exists and `/pagokit:harden` should check the webhook signature, replay window and idempotency
- You need to migrate from one provider to another while the old one keeps running
- A webhook has to be tested with synthetic events: valid, forged and replayed
- You need the providers, local payment methods and e-invoicing duties for a country
Not a fit when
- You need a provider outside the catalog of 42, or full code for one of the 38 reference ones: the plugin only compares them
- The project is not on Node.js 18 or newer: the plugin needs it to run
- You work in Cursor or Codex: the plugin is built on Claude Code hooks and commands
- Payments already run through your own gateway with a custom signature
Example request
Run `/pagokit:compare` for an online shop in Colombia with a 50 dollar check and pick a payment methodLimitations
- Node.js 18 or newer and Claude Code 2.x are required; the plugin is attached with the `--plugin-dir` flag from a cloned folder.
- Four of the 42 providers get full code generation. For the rest the advisor compares terms and says plainly that you write the code.
- If a webhook signature scheme is not verified against the provider documentation, the generator writes no signature check: it inserts an event re-fetch, deduplication and an explicit TODO.
- Generated code talks only to your own provider, but hook checks can be bypassed with a `pagokit-ignore` comment, and every bypass is written to `.pagokit/audit.log`.
How to disable. The plugin attaches for a single launch through `--plugin-dir`, so you disable it by starting claude without that flag. Generated files in the project are removed with ordinary git: they are listed in `PAGOKIT_INTEGRATION.md`.
FAQ
How do I run PagoKit?
Clone the repository, go to your project and run `claude --plugin-dir ~/agente-pagokit`, then `/pagokit:start`. Node.js 18 or newer and Claude Code 2.x are required.
For which providers does PagoKit write code?
Lemon Squeezy, Mercado Pago, Stripe and Wompi get a full build. The plugin also compares and recommends 38 more providers but does not generate their code.
Does the plugin send data anywhere?
There is no account, key or telemetry. Only the generated code makes network calls, to your own provider.
How is `/pagokit:doctor` different from `/pagokit:harden`?
`doctor` is read-only and audits a PagoKit integration: gitignore, keys, webhook secret, raw body, replay protection. `harden` audits hand-written payment code and fixes what it finds, so it writes files.
How do I test a webhook without a real payment?
`/pagokit:test` sends synthetic events to the local handler: valid, forged and replayed. It works for every provider in the catalog, including those without their own CLI.
Discussion
No questions or reviews yet.
Related
PluginsA modular plugin set for Claude Code: skills, agents, commands and rules for Java, TypeScript, Python, PHP and AWS
A Claude Code plugin marketplace by Frad LEE: Git and GitFlow, GitHub, refactoring, memory, research, image generation and interface work
A large Claude Code and Cursor plugin: development skills, specialist agents and hooks with quality gates and git protection
ClaudeKit Skills
ClaudeKit - Agent Skills
A plugin marketplace for Claude Code with a set of thirty-plus skills: frontend, backend, devops, databases, documents, debugging and MCP work
A marketplace of 23 plugins for Claude Code: git and pull requests, code review, TDD, specs and delegation to other models
Ten Claude Code plugins: panes and bands above the prompt, secret handling, a vague-prompt filter and memory cleanup.
README in short
The README explains why payment integrations break after the provider is chosen and shows three deterministic engines: validators, an advisor and a signed-event generator. It goes on with coverage (42 providers, 74 countries), integration levels, install, security rules, commands and the list of generated files.