# io.github.codespar/mcp-bradesco (npm · @codespar/mcp-bradesco)

MCP server for Bradesco — Pix, Cobrança (boleto), Arrecadação, Extrato (OAuth2 + mTLS)

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-bradesco`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-bradesco/codespar-mcp-bradesco.md), [page](https://verifymcp.io/servers/codespar-mcp-bradesco/codespar-mcp-bradesco)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-bradesco`
- Version: `0.2.0-alpha.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2551 tokens (~115/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-bradesco -- npx -y @codespar/mcp-bradesco
```

### Codex

```bash
codex mcp add codespar-mcp-bradesco -- npx -y @codespar/mcp-bradesco
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-bradesco": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-bradesco"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-bradesco --command npx --arg -y --arg @codespar/mcp-bradesco
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-bradesco:
    command: "npx"
    args: ["-y", "@codespar/mcp-bradesco"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-bradesco": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-bradesco"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 65, +30)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: unverified
- [functional] Licence: MIT

### 2026-08-01 (score 35, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 20, −26)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (22)

### `get_oauth_token` (~45 tokens)

Mint or return a cached OAuth2 client_credentials bearer token for the Bradesco Developer Portal. Exposed so agents can inspect token freshness; normal tool calls obtain tokens implicitly.

### `send_pix` (~138 tokens)

Initiate an outbound Pix payment from the merchant's Bradesco account. Amount in BRL major units (e.g. '10.50').

Input parameters:

- `amount` (string, required): Amount in BRL major units with two decimals, e.g. '10.50'
- `description` (string): Free-text description shown on the statement (max 140 chars)
- `idempotency_key` (string, required): Merchant-side idempotency key (UUID recommended)
- `payee` (object, required): Payee identification — either a DICT key or explicit bank account
- `payer_account` (string, required): Merchant account to debit (agência-conta)

### `create_pix_qr` (~127 tokens)

Create a dynamic Pix charge with QR code (cob). Returns the txid, copy-paste EMV payload, and location URL.

Input parameters:

- `additional_info` (array): Optional free-text key/value info shown to the payer
- `amount` (string, required): Amount in BRL major units, e.g. '99.90'
- `description` (string): Payer-visible description
- `expires_in` (number): QR lifetime in seconds (default 3600)
- `payer` (object): Payer identification (required by BCB for cobv / common for cob)

### `get_pix` (~51 tokens)

Retrieve a Pix transaction by its BCB endToEndId (E<ispb><yyyymmddhhmm><sequence>).

Input parameters:

- `end_to_end_id` (string, required): BCB endToEndId

### `resolve_dict_key` (~92 tokens)

Resolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix. Subject to BCB rate limits per consenting payer.

Input parameters:

- `key` (string, required): DICT key — CPF, CNPJ, email, phone (+55...), or EVP UUID
- `payer_document` (string): Merchant / end-payer CPF/CNPJ for BCB audit logging

### `refund_pix` (~109 tokens)

Refund (devolução) a previously received Pix. Must reference the original endToEndId and a merchant-side refund id.

Input parameters:

- `amount` (string): Refund amount in BRL major units. Omit for full refund.
- `end_to_end_id` (string, required): Original Pix endToEndId to refund
- `reason` (string): Free-text reason (stored by BCB for audit)
- `refund_id` (string, required): Merchant-side refund identifier (alphanumeric up to 35 chars)

### `create_boleto` (~168 tokens)

Issue a boleto via Bradesco Cobrança. Returns nosso_numero, linha_digitável, barcode, and PDF URL.

Input parameters:

- `amount` (string, required): Amount in BRL major units, e.g. '150.00'
- `due_date` (string, required): Due date ISO-8601 (YYYY-MM-DD)
- `fine` (object): Multa (fine after due date): { percentage?, amount?, days_after_due? }
- `instructions` (array): Free-text instructions printed on the boleto
- `interest` (object): Juros (daily interest after due date): { percentage?, amount? }
- `our_number` (string): Nosso_numero. Omit to have Bradesco assign one.
- `payer` (object, required): Payer (sacado) data

### `get_boleto` (~39 tokens)

Retrieve a boleto by its Bradesco identifier (id or nosso_numero).

Input parameters:

- `id` (string, required): Boleto id or nosso_numero

### `cancel_boleto` (~47 tokens)

Cancel (baixa) an outstanding boleto before payment.

Input parameters:

- `id` (string, required): Boleto id or nosso_numero
- `reason` (string): Cancellation reason code or free text

### `get_statement` (~97 tokens)

Retrieve account statement transactions for a given period. Paginated.

Input parameters:

- `account` (string, required): Agência-conta identifier of the merchant account
- `from` (string, required): Start date ISO-8601 (YYYY-MM-DD)
- `page` (number): Page number (1-indexed)
- `page_size` (number): Items per page (default 50)
- `to` (string, required): End date ISO-8601 (YYYY-MM-DD)

### `arrecadacao_pay` (~141 tokens)

Pay a utility, tax, or concessionária bill via Bradesco Arrecadação. Works with barcode (código de barras) or linha digitável.

Input parameters:

- `amount` (string): Amount in BRL major units. Required when the barcode does not carry a fixed amount.
- `barcode` (string, required): 44-digit barcode or 47/48-digit linha digitável (digits only)
- `due_date` (string): Due date ISO-8601 (for validation against the barcode)
- `idempotency_key` (string, required): Merchant-side idempotency key (UUID recommended)
- `payer_account` (string, required): Merchant account to debit

### `list_pix_received` (~145 tokens)

List Pix transactions received by the merchant during a period. Uses BACEN Pix v2 /pix collection with ISO-8601 bounds.

Input parameters:

- `cnpj` (string): Filter by payer CNPJ (digits only)
- `cpf` (string): Filter by payer CPF (digits only)
- `from` (string, required): Start timestamp ISO-8601 (e.g. 2026-04-01T00:00:00Z)
- `page` (number): Page number (0-indexed per BACEN spec)
- `page_size` (number): Items per page (BACEN max 1000)
- `to` (string, required): End timestamp ISO-8601

### `create_pix_due_charge` (~229 tokens)

Create a Pix charge with a due date (cobv) — commonly used for installments and scheduled invoices. Returns txid, location URL, and EMV payload.

Input parameters:

- `amount` (string, required): Original amount in BRL major units, e.g. '250.00'
- `debtor` (object, required): Debtor (devedor) identification — required for cobv
- `description` (string): Payer-visible description (solicitacaoPagador)
- `discount` (object): Desconto config: { modalidade, descontoDataFixa: [...] }
- `due_date` (string, required): Due date ISO-8601 (YYYY-MM-DD)
- `fine` (object): Multa config: { modalidade: 1|2, valorPerc: string }
- `interest` (object): Juros config: { modalidade: 1..7, valorPerc: string }
- `txid` (string, required): Merchant-generated txid (26-35 alphanumeric chars per BACEN)
- `validity_after_due` (number): Days after due date the QR remains payable (default 30)

### `get_pix_due_charge` (~37 tokens)

Retrieve a Pix due charge (cobv) by txid.

Input parameters:

- `txid` (string, required): Pix cobv txid

### `update_pix_due_charge` (~129 tokens)

Patch a Pix due charge (cobv) — revise amount, due date, discount, or debtor before payment.

Input parameters:

- `amount` (string): New original amount in BRL major units
- `description` (string): New payer-visible description
- `due_date` (string): New due date (YYYY-MM-DD)
- `status` (string): Set 'REMOVIDA_PELO_USUARIO_RECEBEDOR' to cancel
- `txid` (string, required): Pix cobv txid to update
- `validity_after_due` (number): New validity window in days after due date

### `register_dict_key` (~159 tokens)

Register a DICT key (CPF, CNPJ, email, phone, or EVP) pointing to a merchant account at Bradesco. Only the account holder may register their own key.

Input parameters:

- `account` (string, required): Agência-conta to link the key to
- `account_type` (string): CACC (checking) | SVGS (savings) | SLRY | TRAN
- `key` (string): DICT key value. Omit for EVP (random UUID) — set key_type='EVP'.
- `key_type` (string, required): CPF | CNPJ | EMAIL | PHONE | EVP
- `owner_document` (string, required): Account holder CPF/CNPJ (digits only)
- `owner_name` (string, required): Account holder name

### `delete_dict_key` (~72 tokens)

Delete (unlink) a DICT key that points to a merchant account at Bradesco. BACEN enforces cooldown before re-registration.

Input parameters:

- `key` (string, required): DICT key value to delete
- `reason` (string): Reason code: USER_REQUESTED | ACCOUNT_CLOSED | FRAUD | OTHER

### `list_boletos` (~144 tokens)

List boletos issued by the merchant filtered by status and issue/due period. Paginated.

Input parameters:

- `filter_by` (string): 'issue' to filter by issue date or 'due' by due date (default 'issue')
- `from` (string, required): Start date ISO-8601 (YYYY-MM-DD)
- `page` (number): Page number (1-indexed)
- `page_size` (number): Items per page (default 50)
- `status` (string): REGISTERED | PAID | CANCELED | EXPIRED (or Bradesco-native code)
- `to` (string, required): End date ISO-8601 (YYYY-MM-DD)

### `get_boleto_pdf` (~41 tokens)

Download the boleto PDF as base64. Useful for attaching to emails or portal downloads.

Input parameters:

- `id` (string, required): Boleto id or nosso_numero

### `get_account_balance` (~38 tokens)

Retrieve the current available balance (saldo disponível) for a merchant account.

Input parameters:

- `account` (string, required): Agência-conta identifier of the merchant account

### `transfer_ted` (~158 tokens)

Execute a TED (or TEF when intra-Bradesco) transfer from the merchant's account to a beneficiary bank account. Settles same-day before BACEN cutoff.

Input parameters:

- `amount` (string, required): Amount in BRL major units, e.g. '1000.00'
- `beneficiary` (object, required): Beneficiary (favorecido) bank account
- `description` (string): Free-text description shown on the statement
- `idempotency_key` (string, required): Merchant-side idempotency key (UUID recommended)
- `payer_account` (string, required): Merchant account to debit (agência-conta)
- `purpose_code` (string): BACEN finalidade code (e.g. '10' credit to account, '1' payment)

### `pay_tax_darf` (~278 tokens)

Pay a federal tax (DARF) or union fee (GRU) via Bradesco Arrecadação. Distinct product surface from utility arrecadação because DARF/GRU require tax-code fields (código de receita, período apuração, referência).

Input parameters:

- `amount` (string): Principal amount in BRL major units
- `assessment_period` (string): Período de apuração (YYYY-MM or YYYY-MM-DD)
- `due_date` (string): Vencimento ISO-8601 (YYYY-MM-DD)
- `fine` (string): Multa amount (optional)
- `idempotency_key` (string, required): Merchant-side idempotency key (UUID recommended)
- `interest` (string): Juros amount (optional)
- `payer_account` (string, required): Merchant account to debit
- `reference` (string): Número de referência (required for GRU/GPS; optional for DARF)
- `revenue_code` (string, required): Código de receita (e.g. '0220' for IRPF mensal)
- `tax_type` (string, required): DARF | DARF_SIMPLES | GRU | GPS (social security)
- `taxpayer_document` (string, required): CPF or CNPJ of the taxpayer (digits only)
- `total` (string, required): Valor total a pagar (principal + multa + juros)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-bradesco/codespar-mcp-bradesco#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 69
- 2026-08-02: 65
- 2026-08-01: 35
- 2026-07-31: 20
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-bradesco
- Socket report: https://socket.dev/npm/package/@codespar/mcp-bradesco
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-bradesco/codespar-mcp-bradesco/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-bradesco/codespar-mcp-bradesco/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-bradesco/codespar-mcp-bradesco