io.github.codespar/mcp-airwallex
NPM · @CODESPAR/MCP-AIRWALLEX · SCANNED AUG 4
MCP server for Airwallex — cross-border collection + payouts, global accounts, FX, transfers
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security83
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 42 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2130 tokens (~106/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 93% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @codespar/mcp-airwallex
claude mcp add codespar-mcp-airwallex -- npx -y @codespar/mcp-airwallex
codex mcp add codespar-mcp-airwallex -- npx -y @codespar/mcp-airwallex
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"codespar-mcp-airwallex": {
"type": "local",
"command": [
"npx",
"-y",
"@codespar/mcp-airwallex"
],
"enabled": true
}
}
} openclaw mcp add codespar-mcp-airwallex --command npx --arg -y --arg @codespar/mcp-airwallex
mcp_servers:
codespar-mcp-airwallex:
command: "npx"
args: ["-y", "@codespar/mcp-airwallex"] {
"mcpServers": {
"codespar-mcp-airwallex": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-airwallex"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Aug 26 0
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +32
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Jul 26 −7
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −18
- Malware scan: pass → unverified ▼ security
- 27 Jul 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Aug 2026 · Analysed npm/@codespar/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-8j4g-w8fx-2239 | CVE-2026-69207 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | yes |
Dependencies 94 packages
94 packages in the resolved dependency tree · 94 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
cancel_payment_intent ~80
Cancel a payment intent that has not yet been captured. Fails on already-captured intents; use create_refund instead.
| Name | Type | Req | Description |
|---|---|---|---|
| cancellation_reason | string | — | Reason code (e.g. duplicate, fraudulent, requested_by_customer, abandoned) |
| id | string | yes | Payment intent id |
| request_id | string | yes | Idempotency key |
No output schema declared.
No examples provided.
cancel_transfer ~69
Cancel a transfer that has not yet settled. Only works while the transfer is in an early status (e.g. APPROVED, IN_PROGRESS before funds leave). Fails on DELIVERED transfers.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Transfer id |
| request_id | string | yes | Idempotency key |
No output schema declared.
No examples provided.
capture_payment_intent ~93
Capture a previously-authorized payment intent (two-step auth + capture flow). Use this after confirm_payment_intent on intents created with capture_method=manual. Amount may be less than authorized for partial capture.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | — | Amount to capture in major units. Omit for full authorized amount. |
| id | string | yes | Payment intent id |
| request_id | string | yes | Idempotency key |
No output schema declared.
No examples provided.
confirm_payment_intent ~130
Confirm a previously-created payment intent with a payment method. For card intents this triggers authorization; for APM intents this returns a next_action (redirect, QR, etc).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Payment intent id |
| payment_consent_reference | object | — | Optional consent reference for MIT/recurring flows |
| payment_method | object | yes | Payment method object (type + per-type fields). See Airwallex API payment_method schema. |
| request_id | string | yes | Idempotency key |
| return_url | string | — | Browser return URL for 3DS / APM redirects |
No output schema declared.
No examples provided.
create_beneficiary ~191
Create a transfer beneficiary (recipient) with bank details. Required before sending cross-border payouts via create_transfer. Entity type, bank details fields, and required IDs vary by destination country.
| Name | Type | Req | Description |
|---|---|---|---|
| bank_details | object | yes | Destination bank details (account_number, account_currency, bank_country_code, swift_code, iban, local_clearing_system, etc). Required fields depend on destination country. |
| beneficiary | object | yes | Beneficiary identity (company_name or first_name+last_name, address, date_of_birth, etc, per entity_type) |
| entity_type | string | yes | Individual or corporate beneficiary |
| nickname | string | yes | Friendly label for this beneficiary |
| payment_methods | array | — | Allowed payment methods (e.g. ['LOCAL', 'SWIFT']) |
| request_id | string | yes | Idempotency key |
| type | string | — | Beneficiary type (e.g. BANK_ACCOUNT) |
No output schema declared.
No examples provided.
create_conversion ~147
Execute an FX conversion between wallet currencies (e.g. swap USD received into BRL before settling locally). Pass quote_id for a locked quoted rate, or omit for a market rate.
| Name | Type | Req | Description |
|---|---|---|---|
| buy_amount | number | — | Amount to buy in buy_currency |
| buy_currency | string | yes | Currency to buy |
| conversion_date | string | — | Settlement date (YYYY-MM-DD) |
| quote_id | string | — | Optional FX quote id to lock the rate |
| request_id | string | yes | Idempotency key |
| sell_amount | number | — | Optional — amount to sell. Provide either buy_amount or sell_amount, not both. |
| sell_currency | string | yes | Currency to sell |
No output schema declared.
No examples provided.
create_customer ~128
Create an Airwallex customer for saved payment methods and recurring charges. Returns a customer object whose id can be passed into create_payment_intent.customer_id.
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | — | Customer address (country_code, city, street, postcode, state) |
| string | — | Customer email | |
| first_name | string | — | — |
| last_name | string | — | — |
| merchant_customer_id | string | yes | Merchant-side stable customer id |
| metadata | object | — | Free-form metadata |
| phone_number | string | — | — |
| request_id | string | yes | Idempotency key |
No output schema declared.
No examples provided.
create_payment_intent ~229
Create an Airwallex payment intent (pay-in). Used when a LatAm seller needs to collect USD/EUR/GBP from buyers abroad. Returns the intent with client_secret for client-side confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Amount in major units (e.g. 10.50 = 10.50 USD) |
| currency | string | yes | ISO-4217 currency code (USD, EUR, GBP, etc) |
| customer_id | string | — | Optional Airwallex customer id (from create_customer) to attach the intent to a saved customer |
| descriptor | string | — | Statement descriptor shown on buyer's statement |
| merchant_order_id | string | yes | Merchant-side order reference |
| metadata | object | — | Free-form metadata key/value pairs |
| order | object | — | Order detail (products, shipping, type). Structure per Airwallex /pa/payment_intents/create. |
| request_id | string | yes | Idempotency key (UUID recommended). Agents control idempotency — do not reuse. |
| return_url | string | — | Browser return URL after hosted flow |
No output schema declared.
No examples provided.
create_refund ~93
Refund a captured payment intent (full or partial). Returns the refund object with status.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | — | Refund amount in major units. Omit for full refund. |
| metadata | object | — | Free-form metadata |
| payment_intent_id | string | yes | Original payment intent id to refund |
| reason | string | — | Human-readable refund reason |
| request_id | string | yes | Idempotency key |
No output schema declared.
No examples provided.
create_transfer ~218
Send a cross-border transfer to a pre-created beneficiary. Supports same-currency payouts (source_currency === transfer_currency) or FX-inclusive payouts. Use quote_id from a prior quote for locked rates.
| Name | Type | Req | Description |
|---|---|---|---|
| beneficiary_id | string | yes | Airwallex beneficiary id (from create_beneficiary) |
| metadata | object | — | Free-form metadata |
| quote_id | string | — | Optional FX quote id to lock the rate |
| reason | string | yes | Payout reason (e.g. GOODS_PURCHASE, SERVICES_FEE, PAYROLL, INVESTMENT) — required by regulators |
| reference | string | — | Reference shown on beneficiary's statement |
| request_id | string | yes | Idempotency key |
| source_amount | number | — | Amount debited from wallet in source_currency |
| source_currency | string | — | Wallet currency to debit |
| transfer_amount | number | — | Amount credited to beneficiary in transfer_currency |
| transfer_currency | string | yes | Currency credited to beneficiary |
| transfer_date | string | — | Value date (YYYY-MM-DD) |
No output schema declared.
No examples provided.
list_beneficiaries ~96
List beneficiaries. Supports pagination and filters by entity_type, nickname and bank_country_code.
| Name | Type | Req | Description |
|---|---|---|---|
| bank_country_code | string | — | Filter by destination bank country (ISO-2) |
| entity_type | string | — | Filter by entity type |
| nickname | string | — | Filter by friendly label |
| page_num | number | — | Page index (0-based) |
| page_size | number | — | Page size (default 20) |
No output schema declared.
No examples provided.
list_payment_intents ~143
List payment intents with optional filters (status, merchant_order_id, date range). Supports pagination via page_num / page_size.
| Name | Type | Req | Description |
|---|---|---|---|
| from_created_at | string | — | Lower bound on creation time (ISO 8601) |
| merchant_order_id | string | — | Filter by merchant-side order reference |
| page_num | number | — | Page index (0-based) |
| page_size | number | — | Page size (default 20, max 200) |
| status | string | — | Filter by status (REQUIRES_PAYMENT_METHOD, SUCCEEDED, CANCELLED, etc) |
| to_created_at | string | — | Upper bound on creation time (ISO 8601) |
No output schema declared.
No examples provided.
list_transfers ~114
List transfers with optional filters (status, date range). Supports pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| from_created_at | string | — | Lower bound on creation time (ISO 8601) |
| page_num | number | — | Page index (0-based) |
| page_size | number | — | Page size (default 20) |
| status | string | — | Filter by status (APPROVED, IN_PROGRESS, DELIVERED, CANCELLED, FAILED) |
| to_created_at | string | — | Upper bound on creation time (ISO 8601) |
No output schema declared.
No examples provided.
retrieve_balance ~20
Retrieve the current wallet balance for every currency the account holds.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieve_beneficiary ~38
Retrieve a beneficiary by id. Returns bank details, entity_type, and allowed payment_methods.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Beneficiary id |
No output schema declared.
No examples provided.
retrieve_customer ~33
Retrieve a customer by id. Returns the customer profile plus metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Airwallex customer id |
No output schema declared.
No examples provided.
retrieve_payment_intent ~40
Retrieve a payment intent by id. Returns current status, payment_attempts, and latest payment_method.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Payment intent id |
No output schema declared.
No examples provided.
retrieve_refund ~43
Retrieve a refund by id. Returns current status (RECEIVED, ACCEPTED, PROCESSING, SUCCEEDED, FAILED).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Refund id |
No output schema declared.
No examples provided.
retrieve_transfer ~43
Retrieve a transfer by id. Returns current status (APPROVED, IN_PROGRESS, DELIVERED, CANCELLED, etc).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Transfer id |
No output schema declared.
No examples provided.
update_customer ~115
Update fields on an existing customer (email, phone, address, metadata). Immutable fields like merchant_customer_id cannot be changed.
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | — | Updated address object |
| string | — | Updated email | |
| first_name | string | — | — |
| id | string | yes | Airwallex customer id |
| last_name | string | — | — |
| metadata | object | — | Free-form metadata (replaces previous metadata) |
| phone_number | string | — | — |
| request_id | string | yes | Idempotency key |
No output schema declared.
No examples provided.