# io.github.codespar/mcp-braspag (npm · @codespar/mcp-braspag)

MCP server for Braspag — Cielo orchestration, token vault (Cartão Protegido), recurrence, split

- Trust score: 69/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-braspag`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-braspag/codespar-mcp-braspag.md), [page](https://verifymcp.io/servers/codespar-mcp-braspag/codespar-mcp-braspag)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-braspag`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 74/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2590 tokens (~117/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-braspag -- npx -y @codespar/mcp-braspag
```

### Codex

```bash
codex mcp add codespar-mcp-braspag -- npx -y @codespar/mcp-braspag
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-braspag": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-braspag"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-braspag --command npx --arg -y --arg @codespar/mcp-braspag
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-braspag:
    command: "npx"
    args: ["-y", "@codespar/mcp-braspag"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-braspag": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-braspag"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 65, +7)

- [functional improvement] Schema quality: unverified → excellent

### 2026-08-01 (score 58, +53)

- [security regression] Provenance: unverified → fail
- [security improvement] Malware scan: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-07-31 (score 5, −40)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (22)

### `create_sale` (~164 tokens)

Create a sale on the Braspag Transaction API (POST /sales). Pass a full Braspag sale payload. Payment.Type may be CreditCard, DebitCard, Boleto, Pix, or EletronicTransfer. Braspag orchestrates routing across multiple acquirers based on merchant-level rules.

Input parameters:

- `Customer` (object, required): Customer identification (Braspag shape)
- `MerchantOrderId` (string, required): Merchant-side order id (appears in reports)
- `Payment` (object, required): Braspag Payment object. Shape depends on Type. For CreditCard/DebitCard pass a CreditCard/DebitCard sub-object. For Boleto pass Provider/ExpirationDate. For Pix, Amount is enough. For EletronicTransf…

### `capture_sale` (~91 tokens)

Capture a pre-authorized sale (PUT /sales/{paymentId}/capture). Supports partial capture via amount, and optional serviceTaxAmount (airline / travel merchants).

Input parameters:

- `amount` (number): Amount to capture in cents. Omit for full capture.
- `payment_id` (string, required): Braspag PaymentId (GUID)
- `service_tax_amount` (number): Service tax amount in cents. Optional.

### `void_sale` (~67 tokens)

Void / cancel a sale (PUT /sales/{paymentId}/void). Supports full void (omit amount) or partial void.

Input parameters:

- `amount` (number): Amount to void in cents. Omit for full void.
- `payment_id` (string, required): Braspag PaymentId (GUID)

### `create_recurrent` (~119 tokens)

Create a recurrent payment schedule (POST /recurrentPayments). Used for subscriptions and any schedule where Braspag (not the merchant) drives the recurrence.

Input parameters:

- `Customer` (object, required): Customer object
- `MerchantOrderId` (string, required): Merchant-side order id
- `RecurrentPayment` (object, required): Recurrent-specific fields: AuthorizeNow, StartDate, EndDate, Interval (Monthly | Bimonthly | Quarterly | SemiAnnual | Annual), Amount, CreditCard, etc. Pass the full Braspag RecurrentPayment shape.

### `disable_recurrent` (~56 tokens)

Deactivate a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Deactivate). Stops future charges; does not refund historical ones.

Input parameters:

- `recurrent_payment_id` (string, required): Braspag RecurrentPaymentId (GUID)

### `update_recurrent_amount` (~69 tokens)

Update the charged amount on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Amount). Body carries the new amount in cents.

Input parameters:

- `amount` (number, required): New amount in cents
- `recurrent_payment_id` (string, required): Braspag RecurrentPaymentId (GUID)

### `get_sale` (~41 tokens)

Get sale detail by PaymentId (GET /sales/{paymentId} — Query API).

Input parameters:

- `payment_id` (string, required): Braspag PaymentId (GUID)

### `get_sale_by_order_id` (~63 tokens)

Look up sale(s) by MerchantOrderId (GET /sales?merchantOrderId=X — Query API). Returns an array of PaymentIds matching the merchant order.

Input parameters:

- `merchant_order_id` (string, required): Merchant-side order id used when the sale was created

### `get_recurrent` (~51 tokens)

Get a recurrent payment's configuration and history (GET /recurrentPayments/{recurrentPaymentId} — Query API).

Input parameters:

- `recurrent_payment_id` (string, required): Braspag RecurrentPaymentId (GUID)

### `tokenize_card` (~123 tokens)

Tokenize a card into the Braspag vault / Cartão Protegido (POST /card). Returns a reusable token that can substitute CardNumber on future sales — reduces PCI scope and enables cross-acquirer reuse.

Input parameters:

- `Brand` (string, required): Card brand (Visa, Master, Elo, Amex, Hipercard, ...)
- `CardNumber` (string, required): Card PAN
- `CustomerName` (string, required): Customer full name
- `ExpirationDate` (string, required): Expiration date (MM/YYYY)
- `Holder` (string, required): Cardholder name as printed

### `get_card_token` (~53 tokens)

Retrieve the stored card data associated with a Cartão Protegido token (GET /card/{token}). Returns masked card fields + brand + expiration.

Input parameters:

- `token` (string, required): Cartão Protegido vault token

### `create_split_sale` (~166 tokens)

Create a sale with marketplace split rules (POST /sales with Payment.SplitPayments). Same endpoint as create_sale, but exposes the split array shape explicitly: each element has a SubordinateMerchantId, Amount (cents), Fares { Mdr, Fee }. Use for marketplace / multi-seller scenarios where Braspag splits the capture across sub-merchants.

Input parameters:

- `Customer` (object, required): Customer object
- `MerchantOrderId` (string, required): Merchant-side order id
- `Payment` (object, required): Braspag Payment object with SplitPayments array. Type is typically CreditCard. Each SplitPayments entry: { SubordinateMerchantId: string, Amount: number (cents), Fares: { Mdr: number (percent), Fee:…

### `create_sale_3ds` (~184 tokens)

Create a 3DS-authenticated credit sale (POST /sales). Same endpoint as create_sale but the CreditCard object carries ExternalAuthentication (Cavv, Xid/Eci, Version, ReferenceId) produced by a prior 3DS 2.0 flow. Use when the merchant already ran Braspag's 3DS 2.0 authentication (bp.mpi.braspag.com.br) and now wants to authorize the transaction with liability shift.

Input parameters:

- `Customer` (object, required): Customer object (Braspag shape)
- `MerchantOrderId` (string, required): Merchant-side order id
- `Payment` (object, required): Braspag Payment object with Type=CreditCard, Authenticate=true, and CreditCard.ExternalAuthentication { Cavv, Xid, Eci, Version, ReferenceId } filled from the 3DS 2.0 authenticate step.

### `create_zero_auth` (~171 tokens)

Zero-dollar authorization / card validation (POST /zeroauth). Braspag routes a $0 (or minimum-amount) authorization through the acquirer to confirm the card is live and not blocked, without committing funds. Returns Valid=true/false plus ReturnCode/ReturnMessage. Useful before saving a card-on-file for future recurrence.

Input parameters:

- `Brand` (string, required): Card brand (Visa, Master, Elo, Amex, Hipercard, ...)
- `CardNumber` (string, required): Card PAN (or Cartão Protegido token)
- `CardType` (string): CreditCard or DebitCard
- `ExpirationDate` (string, required): Expiration date (MM/YYYY)
- `Holder` (string, required): Cardholder name
- `SecurityCode` (string): CVV. Optional depending on merchant config.

### `create_boleto_sale` (~161 tokens)

Convenience wrapper to create a Boleto sale (POST /sales with Payment.Type=Boleto). Returns BarCodeNumber, DigitableLine, ExpirationDate, and Url for the rendered boleto. Provider is typically 'Bradesco2', 'Santander2', 'BancoDoBrasil2', or 'Simulado' (sandbox).

Input parameters:

- `Customer` (object, required): Customer object. For boleto, Identity (CPF/CNPJ) and Address are required by most providers.
- `MerchantOrderId` (string, required): Merchant-side order id
- `Payment` (object, required): Boleto payment object: { Type: 'Boleto', Amount, Provider, BoletoNumber?, Assignor?, Demonstrative?, ExpirationDate (YYYY-MM-DD), Identification?, Instructions? }.

### `create_pix_sale` (~138 tokens)

Convenience wrapper to create a Pix sale (POST /sales with Payment.Type=Pix). Returns a QrCodeBase64Image and QrCodeString (Pix copia e cola) that the merchant can display. Braspag confirms payment asynchronously via webhook (Notification URL must be configured at merchant level).

Input parameters:

- `Customer` (object, required): Customer object. Identity (CPF/CNPJ) is required by many PSPs on Pix.
- `MerchantOrderId` (string, required): Merchant-side order id
- `Payment` (object, required): Pix payment object: { Type: 'Pix', Amount, QrCodeExpiration? (seconds), AdditionalDataPix? }.

### `reactivate_recurrent` (~62 tokens)

Reactivate a previously deactivated recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Reactivate). Resumes future scheduled charges from the next configured date.

Input parameters:

- `recurrent_payment_id` (string, required): Braspag RecurrentPaymentId (GUID)

### `update_recurrent_next_payment` (~92 tokens)

Update the NextPaymentDate on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/NextPaymentDate). Useful to skip a cycle or realign billing dates. Body carries the new date in YYYY-MM-DD.

Input parameters:

- `next_payment_date` (string, required): New next payment date (YYYY-MM-DD)
- `recurrent_payment_id` (string, required): Braspag RecurrentPaymentId (GUID)

### `update_recurrent_payment` (~129 tokens)

Update the Payment (CreditCard + Customer) on a recurrent schedule (PUT /recurrentPayments/{recurrentPaymentId}/Payment). Used when the card on file expires or the customer updates their payment method. Pass the full replacement Payment object.

Input parameters:

- `Payment` (object, required): New Payment object for the recurrent schedule. Shape matches the Payment block of create_sale — typically { Type: 'CreditCard', CreditCard: { CardNumber, Holder, ExpirationDate, Brand, SecurityCode?…
- `recurrent_payment_id` (string, required): Braspag RecurrentPaymentId (GUID)

### `create_antifraud_analysis` (~312 tokens)

Submit a standalone Antifraud analysis (POST /fraudanalysis) through Braspag's antifraud orchestration (Cybersource Decision Manager or Konduto, depending on merchant wiring). Use when the merchant wants to run a sub-analysis without attaching it to a capture — for example to pre-score a cart. For inline-in-sale antifraud, include the FraudAnalysis block inside create_sale's Payment.

Input parameters:

- `Browser` (object): Browser metadata (CookiesAccepted, Email, HostName, etc.). Optional.
- `Cart` (object): Cart with Items array (GiftCategory, HostHedge, Name, Quantity, Sku, UnitPrice, ...). Optional but improves scoring.
- `FingerPrintId` (string): Device fingerprint id collected on the merchant page. Optional but strongly recommended.
- `MerchantDefinedFields` (array): Array of { Id, Value } for merchant-defined signals. Optional.
- `MerchantOrderId` (string, required): Merchant-side order id
- `Provider` (string, required): Antifraud provider: 'Cybersource' or 'Konduto'
- `Sequence` (string): 'AnalyseFirst' (default) or 'AuthorizeFirst'. Optional.
- `SequenceCriteria` (string): 'OnSuccess' or 'Always'. Optional.
- `Shipping` (object): Shipping address + method + price. Optional.
- `TotalOrderAmount` (number, required): Total order amount in cents
- `Travel` (object): Travel-specific antifraud block (airline, hotel). Optional.

### `delete_card_token` (~69 tokens)

Delete a Cartão Protegido vault token (DELETE /card/{token}). After deletion the token can no longer be used to create sales. Use when the cardholder requests removal or the card has been reported stolen.

Input parameters:

- `token` (string, required): Cartão Protegido vault token to delete

### `create_split_capture` (~142 tokens)

Capture a previously authorized split sale with overridden per-sub-merchant amounts (PUT /sales/{paymentId}/capture with a SplitPayments body). Use when the original split mix needs adjusting at capture time (e.g. partial shipment from one seller).

Input parameters:

- `SplitPayments` (array, required): Override split mix at capture time. Each element: { SubordinateMerchantId, Amount (cents), Fares: { Mdr, Fee } }.
- `amount` (number): Total amount to capture in cents. Omit for full capture of all sub-merchants.
- `payment_id` (string, required): Braspag PaymentId (GUID) of the authorized split sale

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-braspag/codespar-mcp-braspag#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 69
- 2026-08-02: 65
- 2026-08-01: 58
- 2026-07-31: 5
- 2026-07-30: 45
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-braspag
- Socket report: https://socket.dev/npm/package/@codespar/mcp-braspag
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-braspag/codespar-mcp-braspag/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-braspag/codespar-mcp-braspag/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-braspag/codespar-mcp-braspag