# io.github.codespar/mcp-airwallex (npm · @codespar/mcp-airwallex)

MCP server for Airwallex — cross-border collection + payouts, global accounts, FX, transfers

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-airwallex`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-airwallex/codespar-mcp-airwallex.md), [page](https://verifymcp.io/servers/codespar-mcp-airwallex/codespar-mcp-airwallex)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-airwallex`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2130 tokens (~106/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 98/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 93% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-airwallex -- npx -y @codespar/mcp-airwallex
```

### Codex

```bash
codex mcp add codespar-mcp-airwallex -- npx -y @codespar/mcp-airwallex
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-airwallex": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-airwallex"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-airwallex --command npx --arg -y --arg @codespar/mcp-airwallex
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-airwallex:
    command: "npx"
    args: ["-y", "@codespar/mcp-airwallex"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-airwallex": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-airwallex"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, 0)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 68, +32)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 36, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 21, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (20)

### `create_payment_intent` (~229 tokens)

Create an Airwallex payment intent (pay-in). Used when a LatAm seller needs to collect USD/EUR/GBP from buyers abroad. Returns the intent with client_secret for client-side confirmation.

Input parameters:

- `amount` (number, required): Amount in major units (e.g. 10.50 = 10.50 USD)
- `currency` (string, required): ISO-4217 currency code (USD, EUR, GBP, etc)
- `customer_id` (string): Optional Airwallex customer id (from create_customer) to attach the intent to a saved customer
- `descriptor` (string): Statement descriptor shown on buyer's statement
- `merchant_order_id` (string, required): Merchant-side order reference
- `metadata` (object): Free-form metadata key/value pairs
- `order` (object): Order detail (products, shipping, type). Structure per Airwallex /pa/payment_intents/create.
- `request_id` (string, required): Idempotency key (UUID recommended). Agents control idempotency — do not reuse.
- `return_url` (string): Browser return URL after hosted flow

### `confirm_payment_intent` (~130 tokens)

Confirm a previously-created payment intent with a payment method. For card intents this triggers authorization; for APM intents this returns a next_action (redirect, QR, etc).

Input parameters:

- `id` (string, required): Payment intent id
- `payment_consent_reference` (object): Optional consent reference for MIT/recurring flows
- `payment_method` (object, required): Payment method object (type + per-type fields). See Airwallex API payment_method schema.
- `request_id` (string, required): Idempotency key
- `return_url` (string): Browser return URL for 3DS / APM redirects

### `retrieve_payment_intent` (~40 tokens)

Retrieve a payment intent by id. Returns current status, payment_attempts, and latest payment_method.

Input parameters:

- `id` (string, required): Payment intent id

### `cancel_payment_intent` (~80 tokens)

Cancel a payment intent that has not yet been captured. Fails on already-captured intents; use create_refund instead.

Input parameters:

- `cancellation_reason` (string): Reason code (e.g. duplicate, fraudulent, requested_by_customer, abandoned)
- `id` (string, required): Payment intent id
- `request_id` (string, required): Idempotency key

### `capture_payment_intent` (~93 tokens)

Capture a previously-authorized payment intent (two-step auth + capture flow). Use this after confirm_payment_intent on intents created with capture_method=manual. Amount may be less than authorized for partial capture.

Input parameters:

- `amount` (number): Amount to capture in major units. Omit for full authorized amount.
- `id` (string, required): Payment intent id
- `request_id` (string, required): Idempotency key

### `list_payment_intents` (~143 tokens)

List payment intents with optional filters (status, merchant_order_id, date range). Supports pagination via page_num / page_size.

Input parameters:

- `from_created_at` (string): Lower bound on creation time (ISO 8601)
- `merchant_order_id` (string): Filter by merchant-side order reference
- `page_num` (number): Page index (0-based)
- `page_size` (number): Page size (default 20, max 200)
- `status` (string): Filter by status (REQUIRES_PAYMENT_METHOD, SUCCEEDED, CANCELLED, etc)
- `to_created_at` (string): Upper bound on creation time (ISO 8601)

### `create_refund` (~93 tokens)

Refund a captured payment intent (full or partial). Returns the refund object with status.

Input parameters:

- `amount` (number): Refund amount in major units. Omit for full refund.
- `metadata` (object): Free-form metadata
- `payment_intent_id` (string, required): Original payment intent id to refund
- `reason` (string): Human-readable refund reason
- `request_id` (string, required): Idempotency key

### `retrieve_refund` (~43 tokens)

Retrieve a refund by id. Returns current status (RECEIVED, ACCEPTED, PROCESSING, SUCCEEDED, FAILED).

Input parameters:

- `id` (string, required): Refund id

### `create_customer` (~128 tokens)

Create an Airwallex customer for saved payment methods and recurring charges. Returns a customer object whose id can be passed into create_payment_intent.customer_id.

Input parameters:

- `address` (object): Customer address (country_code, city, street, postcode, state)
- `email` (string): Customer email
- `first_name` (string)
- `last_name` (string)
- `merchant_customer_id` (string, required): Merchant-side stable customer id
- `metadata` (object): Free-form metadata
- `phone_number` (string)
- `request_id` (string, required): Idempotency key

### `retrieve_customer` (~33 tokens)

Retrieve a customer by id. Returns the customer profile plus metadata.

Input parameters:

- `id` (string, required): Airwallex customer id

### `update_customer` (~115 tokens)

Update fields on an existing customer (email, phone, address, metadata). Immutable fields like merchant_customer_id cannot be changed.

Input parameters:

- `address` (object): Updated address object
- `email` (string): Updated email
- `first_name` (string)
- `id` (string, required): Airwallex customer id
- `last_name` (string)
- `metadata` (object): Free-form metadata (replaces previous metadata)
- `phone_number` (string)
- `request_id` (string, required): Idempotency key

### `create_beneficiary` (~191 tokens)

Create a transfer beneficiary (recipient) with bank details. Required before sending cross-border payouts via create_transfer. Entity type, bank details fields, and required IDs vary by destination country.

Input parameters:

- `bank_details` (object, required): Destination bank details (account_number, account_currency, bank_country_code, swift_code, iban, local_clearing_system, etc). Required fields depend on destination country.
- `beneficiary` (object, required): Beneficiary identity (company_name or first_name+last_name, address, date_of_birth, etc, per entity_type)
- `entity_type` (string, required): Individual or corporate beneficiary
- `nickname` (string, required): Friendly label for this beneficiary
- `payment_methods` (array): Allowed payment methods (e.g. ['LOCAL', 'SWIFT'])
- `request_id` (string, required): Idempotency key
- `type` (string): Beneficiary type (e.g. BANK_ACCOUNT)

### `retrieve_beneficiary` (~38 tokens)

Retrieve a beneficiary by id. Returns bank details, entity_type, and allowed payment_methods.

Input parameters:

- `id` (string, required): Beneficiary id

### `list_beneficiaries` (~96 tokens)

List beneficiaries. Supports pagination and filters by entity_type, nickname and bank_country_code.

Input parameters:

- `bank_country_code` (string): Filter by destination bank country (ISO-2)
- `entity_type` (string): Filter by entity type
- `nickname` (string): Filter by friendly label
- `page_num` (number): Page index (0-based)
- `page_size` (number): Page size (default 20)

### `create_transfer` (~218 tokens)

Send a cross-border transfer to a pre-created beneficiary. Supports same-currency payouts (source_currency === transfer_currency) or FX-inclusive payouts. Use quote_id from a prior quote for locked rates.

Input parameters:

- `beneficiary_id` (string, required): Airwallex beneficiary id (from create_beneficiary)
- `metadata` (object): Free-form metadata
- `quote_id` (string): Optional FX quote id to lock the rate
- `reason` (string, required): Payout reason (e.g. GOODS_PURCHASE, SERVICES_FEE, PAYROLL, INVESTMENT) — required by regulators
- `reference` (string): Reference shown on beneficiary's statement
- `request_id` (string, required): Idempotency key
- `source_amount` (number): Amount debited from wallet in source_currency
- `source_currency` (string): Wallet currency to debit
- `transfer_amount` (number): Amount credited to beneficiary in transfer_currency
- `transfer_currency` (string, required): Currency credited to beneficiary
- `transfer_date` (string): Value date (YYYY-MM-DD)

### `retrieve_transfer` (~43 tokens)

Retrieve a transfer by id. Returns current status (APPROVED, IN_PROGRESS, DELIVERED, CANCELLED, etc).

Input parameters:

- `id` (string, required): Transfer id

### `cancel_transfer` (~69 tokens)

Cancel a transfer that has not yet settled. Only works while the transfer is in an early status (e.g. APPROVED, IN_PROGRESS before funds leave). Fails on DELIVERED transfers.

Input parameters:

- `id` (string, required): Transfer id
- `request_id` (string, required): Idempotency key

### `list_transfers` (~114 tokens)

List transfers with optional filters (status, date range). Supports pagination.

Input parameters:

- `from_created_at` (string): Lower bound on creation time (ISO 8601)
- `page_num` (number): Page index (0-based)
- `page_size` (number): Page size (default 20)
- `status` (string): Filter by status (APPROVED, IN_PROGRESS, DELIVERED, CANCELLED, FAILED)
- `to_created_at` (string): Upper bound on creation time (ISO 8601)

### `create_conversion` (~147 tokens)

Execute an FX conversion between wallet currencies (e.g. swap USD received into BRL before settling locally). Pass quote_id for a locked quoted rate, or omit for a market rate.

Input parameters:

- `buy_amount` (number): Amount to buy in buy_currency
- `buy_currency` (string, required): Currency to buy
- `conversion_date` (string): Settlement date (YYYY-MM-DD)
- `quote_id` (string): Optional FX quote id to lock the rate
- `request_id` (string, required): Idempotency key
- `sell_amount` (number): Optional — amount to sell. Provide either buy_amount or sell_amount, not both.
- `sell_currency` (string, required): Currency to sell

### `retrieve_balance` (~20 tokens)

Retrieve the current wallet balance for every currency the account holds.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-airwallex/codespar-mcp-airwallex#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 69
- 2026-08-02: 68
- 2026-08-01: 36
- 2026-07-31: 21
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-airwallex
- Socket report: https://socket.dev/npm/package/@codespar/mcp-airwallex
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-airwallex/codespar-mcp-airwallex/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-airwallex/codespar-mcp-airwallex/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-airwallex/codespar-mcp-airwallex