Swiggy Adds Its Swiggy Money Wallet to MCP: How Far Agentic Payments Actually Got
Swiggy put its Swiggy Money wallet on its MCP servers so AI agents can pay from a stored balance. Here is what changed in eight months, what friction a hands-on test still found, and how India's NPCI framework may shape it.
Key Takeaways
- India's Swiggy added its own wallet, Swiggy Money, to its MCP servers so AI agents can pay for Food, Instamart and Dineout orders from a stored balance. Top it up once and later transactions run through without breaking the conversation.
- When MediaNama placed a real order through ChatGPT, the payment went through, but the agent handed address selection back to the user, could not use order history, and briefly returned an error after payment had already succeeded. Adding a payment rail does not finish the job of autonomy.
- India's NPCI is preparing a Unified Agent Protocol for agentic UPI payments, with spending caps and a liability framework under discussion. For merchants, the question is now who owns limits, confirmation and transaction state before an agent is given a balance.
A balance that keeps the conversation going
Swiggy adds Swiggy Money to its MCP integrations, letting AI agents pay for Food, Instamart and Dineout orders.
www.medianama.comAgentic shopping tends to break in the same place. Payment. Searching, comparing and filling a cart all happen inside the conversation, and then the checkout moment throws the user into an app or a bank screen. Once the human hand comes back, the transaction is no longer autonomous.
On September 4, 2026, Swiggy, India's food delivery and quick commerce group, announced an update that closes that break. Posted on X by the company's head of agentic commerce, it says that Swiggy Money, the company's own wallet, has been added to its MCP (Model Context Protocol) integrations so AI agents can pay for Food, Instamart and Dineout orders from the balance.
Until now, agents could help you discover, decide, and build an order. Now they can actually get things done.
MCP is the shared specification that lets AI models connect to external systems and tools. Swiggy has been running it across its three businesses since January 2026 and opened it to outside developers as Builders Club in April. What arrived this month is the payment layer stacked on top of that work.
Swiggy Money itself is not new. It is a wallet the company launched in 2020, reportedly built on ICICI Bank's wallet service and designed so that a topped-up balance can be spent without repeated authentication. Swiggy did not invent a payment method here. It moved a prepaid balance it already had into a place an agent can reach.
Eight months from cash on delivery
Swiggy did not arrive here in one step. Laying out the stages shows what the company was guarding against as it opened up payments.
| Date | What MCP made possible | Payment method | Confirmed constraints |
|---|---|---|---|
| January 2026 | Three servers live for Food, Instamart and Dineout, connectable from ChatGPT by hand | Cash on delivery only | Frequent menu-retrieval failures; Instamart could not reach checkout |
| April 2026 | Opened to outside developers and enterprises as Builders Club (3 servers, 49 tools) | Cash on delivery only | Rs 1,000 cart cap on Food orders originating from Builders Club |
| July 2026 | Shared payment stage across all three servers (get_payment_options / check_payment_status / confirm_order) | UPI (GPay, PhonePe, Paytm, scan-QR) | Orders held in PENDING_PAYMENT until payment clears; no direct UPI ID entry |
| September 2026 | Agents can draw on a Swiggy Money balance across subsequent transactions | Wallet balance | Not yet reflected in the public docs or changelog |
MediaNama tested that January setup in detail. It required switching ChatGPT into developer mode, adding three MCP endpoints by hand and clearing Swiggy's OTP login. Even once connected, menu retrieval frequently failed at large chains such as Third Wave Coffee and Starbucks, stalling orders. Limiting payment to cash on delivery reads naturally as a statement of caution. If an agent misfires, nothing has been captured, so reversal stays cheap.
July was the turning point. Swiggy shipped a payment stage shared across all three servers, enabling in-chat payment over UPI, India's instant payment rail. The design choices there carry straight into the current debate. An order is created in PENDING_PAYMENT and only becomes PLACED once payment succeeds. An order still pending at the polling cap is marked failed rather than left hanging. Confirmation is idempotent, so a retry never places an unpaid order. The whole design leans on one guarantee: an unpaid order must never look placed.
Swiggy Money adds a further layer on top, removing the payment gesture itself. With UPI, the agent can start the transaction but the user still opens a UPI app to approve it. With a prepaid balance, that approval happens once, at top-up.
What the hands-on test still ran into
MediaNama tested again through ChatGPT. The prompt: pick a chocolate dessert under Rs 300 using the account's order history, and pay with Swiggy Money. The result was a partial success. Order history could not be retrieved. Only after the tester asked for cookies did the search succeed; the agent then selected a product and placed and paid for the order with Swiggy Money. Compared with January, when only cash on delivery was available, the experience is clearly smoother.
Three points of friction remained. The agent asked the user to choose a delivery address, could not use saved order history to personalise the recommendation, and returned an error saying the order had not been paid after payment had in fact completed. The third is the awkward one: the order was placed and confirmed, yet the conversation's view of the state disagreed with reality.
The interesting part is that the order-history failure is not a missing API. Swiggy's public documentation defines get_food_orders for Food and get_orders for Instamart, and the tool descriptions explicitly cover reading preferences and repeat items from past orders. The capability is exposed. It simply was not called inside the ChatGPT conversation, or the result was not usable.
That gap matters for how agentic commerce should be assessed. A protocol's feature list and what a client can actually do mid-conversation are two different things. A merchant can stand up an MCP server and still leave users with a half-manual experience if the connected assistant cannot carry context. MediaNama reaches the same conclusion, noting that true autonomy needs more than a stored balance, and that the remaining challenge is carrying context from discovery through fulfilment.
Limits and liability arrive with the balance
Letting an agent pay is a convenience story and a liability story at the same time. MediaNama makes the point directly: friction is not inherently bad and can work as a safety mechanism, so the goal is to strip out unnecessary friction without removing the boundaries that protect users.
Swiggy's boundaries today come in two kinds. One is a spending cap: the public documentation states a Rs 1,000 cart cap on Food orders originating from Builders Club. The other is mandated confirmation. The place_food_order tool description carries lengthy instructions not to call the tool before showing the cart and address and getting explicit consent, and never to say an order is placed while payment is still pending.
The second, though, is not a constraint the protocol enforces. It is a constraint written as instructions to a model. How closely a client model follows a tool description is up to that model, and ignoring it does not block the call. This month's post-payment error message exposes exactly the fragility of that layer.
Regulation is moving too. On September 1, Reuters reported that NPCI is preparing a Unified Agent Protocol to let AI agents pay over UPI, likely to be unveiled at the Global Fintech Fest in Mumbai. It is expected to build on two existing mechanisms, UPI Circle, which delegates payment authority to another party, and Reserve Pay, which blocks funds for later debits, wrapped in spending limits, audit trails, identity checks and a liability framework. Banks currently cap such blocks at Rs 10,000 for up to 90 days, and the report says that ceiling may be revisited for agentic use.
This is reporting based on people familiar with the matter, not a finalised specification. Meanwhile in the same market, the RBI's e-mandate framework requires additional factor authentication per transaction and CERT-In has proposed mandatory human intervention above defined financial thresholds. Additional authentication is a per-transaction control, delegation exists to reduce per-transaction friction, and human-in-the-loop is a threshold control whose threshold has not been set. The three run in parallel without meeting.
The choice of a prepaid wallet reads well in that context. MediaNama founder Nikhil Pahwa argued in July that wallets are the natural way to give agents money because they contain the blast radius, and that agent-specific handles and PINs, default caps by amount and frequency, and a recourse mechanism should come first. A balance that can only lose what was loaded is tidier than a rail wired straight to a bank account. Drawing on his own attempt to shop through an agent, he also observed that "an autonomous purchase for which I'd have to block out time isn't an autonomous purchase."
What merchants should settle first
Swiggy's implementation leans heavily on Indian payment conditions. UPI processed 24.51 billion transactions worth Rs 29.82 trillion in August alone, and most markets have no equivalent rail. The design questions still travel.
Start with which payment method to open to agent-led transactions first. Swiggy began with cash on delivery, added UPI, and only then placed a prepaid balance in reach. That order is the low-risk-first principle in practice. On your own store, loyalty points, gift balances or prepaid deposits are the natural entry point, because the downside is bounded.
Next, decide who holds the truth about transaction state. As this month's mis-display shows, the conversational UI cannot be trusted with it. Hold the order pending until payment clears, make confirmation idempotent, and close a timed-out order as failed. That set belongs on your own servers.
Finally, decide which layer enforces confirmation and limits. Notes in a tool description are a request to a model, not a rule, so amount thresholds and daily transaction counts have to be refusable server-side to mean anything. Data handling works the same way. Swiggy's data and compliance policy states that a connecting developer may use the data only for the immediate task, with separate consent required for analytics, advertising or model training. Documents like that deserve reading before the feature list.
What has not been disclosed
For anyone weighing this up, the following remain undisclosed.
- Fees: no fee or merchant-side cost has been stated for agent payments made through Swiggy Money
- Supported agents: there is no list of officially supported AI assistants; the only confirmed case is a single ChatGPT test
- Per-agent spending limits: whether per-transaction or daily caps apply to the balance is not stated, and the Rs 1,000 cart cap is documented for Builders Club orders, with no word on other routes
- Documentation: at the time of writing, the Builders Club changelog and developer documentation contain no mention of Swiggy Money. The X post is effectively the primary source
Conclusion
The excuse that autonomy stalls for lack of a payment method no longer holds. Put a prepaid balance in place and an agent can finish paying without leaving the conversation. In the hands-on test, the payment itself went through.
What remained were address selection, history use and post-payment state sync, all of them problems of carrying context. That is not Swiggy's problem alone. It is the gap that sits between any merchant who has built an MCP server and the assistant connecting to it.
If NPCI's framework is published, India becomes one of the first countries with national infrastructure for agentic payments. How it words caps, audit, identity checks and the division of liability will become a reference point for the debate elsewhere. Swiggy's implementation is worth watching as a case that started running in the field before those rules settled.
