io.github.codespar/mcp-braspag

NPM · @CODESPAR/MCP-BRASPAG · SCANNED AUG 4

MCP server for Braspag — Cielo orchestration, token vault (Cartão Protegido), recurrence, split

Available components

+24 this week 69 69 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security86

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 42 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability74

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2590 tokens (~117/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management30

Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @codespar/mcp-braspag

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add codespar-mcp-braspag -- npx -y @codespar/mcp-braspag

# add to Codex CLI

codex mcp add codespar-mcp-braspag -- npx -y @codespar/mcp-braspag

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-braspag": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-braspag"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add codespar-mcp-braspag --command npx --arg -y --arg @codespar/mcp-braspag

# ~/.hermes/config.yaml

mcp_servers:
  codespar-mcp-braspag:
    command: "npx"
    args: ["-y", "@codespar/mcp-braspag"]

// mcp.json

{
  "mcpServers": {
    "codespar-mcp-braspag": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-braspag"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +4
- Stability: unverified → 0.27 ▲ functional
2 Aug 26 +7
- Schema quality: unverified → excellent ▲ functional
1 Aug 26 +53
- Provenance: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Licence: MIT functional
31 Jul 26 −40
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 45

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@codespar/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 22 exposed · ~2,523 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

capture_sale ~91

Capture a pre-authorized sale (PUT /sales/{paymentId}/capture). Supports partial capture via amount, and optional serviceTaxAmount (airline / travel merchants).

Input Output Examples

Name	Type	Req	Description
amount	number	—	Amount to capture in cents. Omit for full capture.
payment_id	string	yes	Braspag PaymentId (GUID)
service_tax_amount	number	—	Service tax amount in cents. Optional.

No output schema declared.

No examples provided.

create_antifraud_analysis ~312

Submit a standalone Antifraud analysis (POST /fraudanalysis) through Braspag's antifraud orchestration (Cybersource Decision Manager or Konduto, depending on merchant wiring). Use when the merchant wants to run a sub-analysis without attaching it to a capture — for example to pre-score a cart. For inline-in-sale antifraud, include the FraudAnalysis block inside create_sale's Payment.

Input Output Examples

Name	Type	Req	Description
Browser	object	—	Browser metadata (CookiesAccepted, Email, HostName, etc.). Optional.
Cart	object	—	Cart with Items array (GiftCategory, HostHedge, Name, Quantity, Sku, UnitPrice, ...). Optional but improves scoring.
FingerPrintId	string	—	Device fingerprint id collected on the merchant page. Optional but strongly recommended.
MerchantDefinedFields	array	—	Array of { Id, Value } for merchant-defined signals. Optional.
MerchantOrderId	string	yes	Merchant-side order id
Provider	string	yes	Antifraud provider: 'Cybersource' or 'Konduto'
Sequence	string	—	'AnalyseFirst' (default) or 'AuthorizeFirst'. Optional.
SequenceCriteria	string	—	'OnSuccess' or 'Always'. Optional.
Shipping	object	—	Shipping address + method + price. Optional.
TotalOrderAmount	number	yes	Total order amount in cents
Travel	object	—	Travel-specific antifraud block (airline, hotel). Optional.

No output schema declared.

No examples provided.

create_boleto_sale ~161

Convenience wrapper to create a Boleto sale (POST /sales with Payment.Type=Boleto). Returns BarCodeNumber, DigitableLine, ExpirationDate, and Url for the rendered boleto. Provider is typically 'Bradesco2', 'Santander2', 'BancoDoBrasil2', or 'Simulado' (sandbox).

Input Output Examples

Name	Type	Req	Description
Customer	object	yes	Customer object. For boleto, Identity (CPF/CNPJ) and Address are required by most providers.
MerchantOrderId	string	yes	Merchant-side order id
Payment	object	yes	Boleto payment object: { Type: 'Boleto', Amount, Provider, BoletoNumber?, Assignor?, Demonstrative?, ExpirationDate (YYYY-MM-DD), Identification?, Instructions? }.

No output schema declared.

No examples provided.

create_pix_sale ~138

Convenience wrapper to create a Pix sale (POST /sales with Payment.Type=Pix). Returns a QrCodeBase64Image and QrCodeString (Pix copia e cola) that the merchant can display. Braspag confirms payment asynchronously via webhook (Notification URL must be configured at merchant level).

Input Output Examples

Name	Type	Req	Description
Customer	object	yes	Customer object. Identity (CPF/CNPJ) is required by many PSPs on Pix.
MerchantOrderId	string	yes	Merchant-side order id
Payment	object	yes	Pix payment object: { Type: 'Pix', Amount, QrCodeExpiration? (seconds), AdditionalDataPix? }.

No output schema declared.

No examples provided.

create_recurrent ~119

Create a recurrent payment schedule (POST /recurrentPayments). Used for subscriptions and any schedule where Braspag (not the merchant) drives the recurrence.

Input Output Examples

Name	Type	Req	Description
Customer	object	yes	Customer object
MerchantOrderId	string	yes	Merchant-side order id
RecurrentPayment	object	yes	Recurrent-specific fields: AuthorizeNow, StartDate, EndDate, Interval (Monthly \| Bimonthly \| Quarterly \| SemiAnnual \| Annual), Amount, CreditCard, etc. Pass the full Braspag RecurrentPayment shape.

No output schema declared.

No examples provided.

create_sale ~164

Create a sale on the Braspag Transaction API (POST /sales). Pass a full Braspag sale payload. Payment.Type may be CreditCard, DebitCard, Boleto, Pix, or EletronicTransfer. Braspag orchestrates routing across multiple acquirers based on merchant-level rules.

Input Output Examples

Name	Type	Req	Description
Customer	object	yes	Customer identification (Braspag shape)
MerchantOrderId	string	yes	Merchant-side order id (appears in reports)
Payment	object	yes	Braspag Payment object. Shape depends on Type. For CreditCard/DebitCard pass a CreditCard/DebitCard sub-object. For Boleto pass Provider/ExpirationDate. For Pix, Amount is enough. For EletronicTransf…

No output schema declared.

No examples provided.

create_sale_3ds ~184

Create a 3DS-authenticated credit sale (POST /sales). Same endpoint as create_sale but the CreditCard object carries ExternalAuthentication (Cavv, Xid/Eci, Version, ReferenceId) produced by a prior 3DS 2.0 flow. Use when the merchant already ran Braspag's 3DS 2.0 authentication (bp.mpi.braspag.com.br) and now wants to authorize the transaction with liability shift.

Input Output Examples

Name	Type	Req	Description
Customer	object	yes	Customer object (Braspag shape)
MerchantOrderId	string	yes	Merchant-side order id
Payment	object	yes	Braspag Payment object with Type=CreditCard, Authenticate=true, and CreditCard.ExternalAuthentication { Cavv, Xid, Eci, Version, ReferenceId } filled from the 3DS 2.0 authenticate step.

No output schema declared.

No examples provided.

create_split_capture ~142

Capture a previously authorized split sale with overridden per-sub-merchant amounts (PUT /sales/{paymentId}/capture with a SplitPayments body). Use when the original split mix needs adjusting at capture time (e.g. partial shipment from one seller).

Input Output Examples

Name	Type	Req	Description
SplitPayments	array	yes	Override split mix at capture time. Each element: { SubordinateMerchantId, Amount (cents), Fares: { Mdr, Fee } }.
amount	number	—	Total amount to capture in cents. Omit for full capture of all sub-merchants.
payment_id	string	yes	Braspag PaymentId (GUID) of the authorized split sale

No output schema declared.

No examples provided.

create_split_sale ~166

Create a sale with marketplace split rules (POST /sales with Payment.SplitPayments). Same endpoint as create_sale, but exposes the split array shape explicitly: each element has a SubordinateMerchantId, Amount (cents), Fares { Mdr, Fee }. Use for marketplace / multi-seller scenarios where Braspag splits the capture across sub-merchants.

Input Output Examples

Name	Type	Req	Description
Customer	object	yes	Customer object
MerchantOrderId	string	yes	Merchant-side order id
Payment	object	yes	Braspag Payment object with SplitPayments array. Type is typically CreditCard. Each SplitPayments entry: { SubordinateMerchantId: string, Amount: number (cents), Fares: { Mdr: number (percent), Fee:…

No output schema declared.

No examples provided.

create_zero_auth ~171

Zero-dollar authorization / card validation (POST /zeroauth). Braspag routes a $0 (or minimum-amount) authorization through the acquirer to confirm the card is live and not blocked, without committing funds. Returns Valid=true/false plus ReturnCode/ReturnMessage. Useful before saving a card-on-file for future recurrence.

Input Output Examples

Name	Type	Req	Description
Brand	string	yes	Card brand (Visa, Master, Elo, Amex, Hipercard, ...)
CardNumber	string	yes	Card PAN (or Cartão Protegido token)
CardType	string	—	CreditCard or DebitCard
ExpirationDate	string	yes	Expiration date (MM/YYYY)
Holder	string	yes	Cardholder name
SecurityCode	string	—	CVV. Optional depending on merchant config.

No output schema declared.

No examples provided.

delete_card_token ~69

Delete a Cartão Protegido vault token (DELETE /card/{token}). After deletion the token can no longer be used to create sales. Use when the cardholder requests removal or the card has been reported stolen.

Input Output Examples

Name	Type	Req	Description
token	string	yes	Cartão Protegido vault token to delete

No output schema declared.

No examples provided.

disable_recurrent ~56

Deactivate a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Deactivate). Stops future charges; does not refund historical ones.

Input Output Examples

Name	Type	Req	Description
recurrent_payment_id	string	yes	Braspag RecurrentPaymentId (GUID)

No output schema declared.

No examples provided.

get_card_token ~53

Retrieve the stored card data associated with a Cartão Protegido token (GET /card/{token}). Returns masked card fields + brand + expiration.

Input Output Examples

Name	Type	Req	Description
token	string	yes	Cartão Protegido vault token

No output schema declared.

No examples provided.

get_recurrent ~51

Get a recurrent payment's configuration and history (GET /recurrentPayments/{recurrentPaymentId} — Query API).

Input Output Examples

Name	Type	Req	Description
recurrent_payment_id	string	yes	Braspag RecurrentPaymentId (GUID)

No output schema declared.

No examples provided.

get_sale ~41

Get sale detail by PaymentId (GET /sales/{paymentId} — Query API).

Input Output Examples

Name	Type	Req	Description
payment_id	string	yes	Braspag PaymentId (GUID)

No output schema declared.

No examples provided.

get_sale_by_order_id ~63

Look up sale(s) by MerchantOrderId (GET /sales?merchantOrderId=X — Query API). Returns an array of PaymentIds matching the merchant order.

Input Output Examples

Name	Type	Req	Description
merchant_order_id	string	yes	Merchant-side order id used when the sale was created

No output schema declared.

No examples provided.

reactivate_recurrent ~62

Reactivate a previously deactivated recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Reactivate). Resumes future scheduled charges from the next configured date.

Input Output Examples

Name	Type	Req	Description
recurrent_payment_id	string	yes	Braspag RecurrentPaymentId (GUID)

No output schema declared.

No examples provided.

tokenize_card ~123

Tokenize a card into the Braspag vault / Cartão Protegido (POST /card). Returns a reusable token that can substitute CardNumber on future sales — reduces PCI scope and enables cross-acquirer reuse.

Input Output Examples

Name	Type	Req	Description
Brand	string	yes	Card brand (Visa, Master, Elo, Amex, Hipercard, ...)
CardNumber	string	yes	Card PAN
CustomerName	string	yes	Customer full name
ExpirationDate	string	yes	Expiration date (MM/YYYY)
Holder	string	yes	Cardholder name as printed

No output schema declared.

No examples provided.

update_recurrent_amount ~69

Update the charged amount on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Amount). Body carries the new amount in cents.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	New amount in cents
recurrent_payment_id	string	yes	Braspag RecurrentPaymentId (GUID)

No output schema declared.

No examples provided.

update_recurrent_next_payment ~92

Update the NextPaymentDate on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/NextPaymentDate). Useful to skip a cycle or realign billing dates. Body carries the new date in YYYY-MM-DD.

Input Output Examples

Name	Type	Req	Description
next_payment_date	string	yes	New next payment date (YYYY-MM-DD)
recurrent_payment_id	string	yes	Braspag RecurrentPaymentId (GUID)

No output schema declared.

No examples provided.

update_recurrent_payment ~129

Update the Payment (CreditCard + Customer) on a recurrent schedule (PUT /recurrentPayments/{recurrentPaymentId}/Payment). Used when the card on file expires or the customer updates their payment method. Pass the full replacement Payment object.

Input Output Examples

Name	Type	Req	Description
Payment	object	yes	New Payment object for the recurrent schedule. Shape matches the Payment block of create_sale — typically { Type: 'CreditCard', CreditCard: { CardNumber, Holder, ExpirationDate, Brand, SecurityCode?…
recurrent_payment_id	string	yes	Braspag RecurrentPaymentId (GUID)

No output schema declared.

No examples provided.

void_sale ~67

Void / cancel a sale (PUT /sales/{paymentId}/void). Supports full void (omit amount) or partial void.

Input Output Examples

Name	Type	Req	Description
amount	number	—	Amount to void in cents. Omit for full void.
payment_id	string	yes	Braspag PaymentId (GUID)

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 4 Aug