io.github.codespar/mcp-caixa

NPM · @CODESPAR/MCP-CAIXA · SCANNED AUG 4

MCP server for Caixa Econômica Federal — Pix, Cobrança (SICOB boleto), Extrato (OAuth2 + mTLS)

Available components

+24 this week 70 70 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security86

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 42 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability77

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2429 tokens (~105/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management30

Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @codespar/mcp-caixa

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add codespar-mcp-caixa -- npx -y @codespar/mcp-caixa

# add to Codex CLI

codex mcp add codespar-mcp-caixa -- npx -y @codespar/mcp-caixa

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-caixa": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-caixa"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add codespar-mcp-caixa --command npx --arg -y --arg @codespar/mcp-caixa

# ~/.hermes/config.yaml

mcp_servers:
  codespar-mcp-caixa:
    command: "npx"
    args: ["-y", "@codespar/mcp-caixa"]

// mcp.json

{
  "mcpServers": {
    "codespar-mcp-caixa": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-caixa"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +33
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- License: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@codespar/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 23 exposed · ~2,362 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

cancel_boleto ~47

Cancel (baixa) an outstanding boleto before payment.

Input Output Examples

Name	Type	Req	Description
id	string	yes	Boleto id or nosso_numero
reason	string	—	Cancellation reason code or free text

No output schema declared.

No examples provided.

consult_fgts ~140

Query FGTS balance / extrato. Caixa is the sole operator of FGTS (Fundo de Garantia do Tempo de Serviço) and exposes worker-side and employer-side queries through dedicated product contracts.

Input Output Examples

Name	Type	Req	Description
employer_cnpj	string	—	Employer CNPJ — required for employer-side consults
from	string	—	Start competency YYYY-MM for extrato (optional)
pis_pasep	string	—	NIS / PIS / PASEP number (optional, improves lookup)
to	string	—	End competency YYYY-MM for extrato (optional)
worker_document	string	yes	CPF of the worker (digits only)

No output schema declared.

No examples provided.

create_boleto ~171

Issue a boleto via Caixa Cobrança (SICOB). Returns nosso_numero, linha_digitável, barcode, and PDF URL.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in BRL major units, e.g. '150.00'
due_date	string	yes	Due date ISO-8601 (YYYY-MM-DD)
fine	object	—	Multa (fine after due date): { percentage?, amount?, days_after_due? }
instructions	array	—	Free-text instructions printed on the boleto
interest	object	—	Juros (daily interest after due date): { percentage?, amount? }
our_number	string	—	Nosso_numero. Omit to have Caixa/SICOB assign one.
payer	object	yes	Payer (sacado) data

No output schema declared.

No examples provided.

create_pix_due_charge ~206

Create a Pix due-date charge (cobv) with mandatory payer data and due date. Supports fine, interest, discount, and abatement fields.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Original amount in BRL major units
description	string	—	Payer-visible description
discount	object	—	Desconto: { modalidade, descontoDataFixa: [...] }
due_date	string	yes	Due date ISO-8601 (YYYY-MM-DD)
fine	object	—	Multa: { modalidade: 1\|2, valorPerc: string }
interest	object	—	Juros: { modalidade: 1..7, valorPerc: string }
payer	object	yes	Payer (devedor) — required by BACEN for cobv
txid	string	yes	Merchant-provided BCB txid (26-35 alphanumeric)
validity_after_due	number	—	Days the charge remains payable after due date

No output schema declared.

No examples provided.

create_pix_qr ~127

Create a dynamic Pix charge with QR code (cob). Returns the txid, copy-paste EMV payload, and location URL.

Input Output Examples

Name	Type	Req	Description
additional_info	array	—	Optional free-text key/value info shown to the payer
amount	string	yes	Amount in BRL major units, e.g. '99.90'
description	string	—	Payer-visible description
expires_in	number	—	QR lifetime in seconds (default 3600)
payer	object	—	Payer identification (required by BCB for cobv / common for cob)

No output schema declared.

No examples provided.

delete_dict_key ~49

Delete (unregister) a DICT key owned by the merchant. The key must belong to a Caixa account under the merchant's contract.

Input Output Examples

Name	Type	Req	Description
key	string	yes	DICT key to delete

No output schema declared.

No examples provided.

download_boleto_pdf ~55

Fetch the rendered boleto PDF for an issued boleto. Returns the PDF URL (or base64 bytes) so it can be attached to an invoice or email.

Input Output Examples

Name	Type	Req	Description
id	string	yes	Boleto id or nosso_numero

No output schema declared.

No examples provided.

get_account_balance ~46

Return the current balance for a Caixa merchant account, including available, blocked, and overdraft limit if present.

Input Output Examples

Name	Type	Req	Description
account	string	yes	Agência-conta identifier of the merchant account

No output schema declared.

No examples provided.

get_boleto ~37

Retrieve a boleto by its Caixa identifier (id or nosso_numero).

Input Output Examples

Name	Type	Req	Description
id	string	yes	Boleto id or nosso_numero

No output schema declared.

No examples provided.

get_oauth_token ~43

Mint or return a cached OAuth2 client_credentials bearer token for the Caixa Developer Portal. Exposed so agents can inspect token freshness; normal tool calls obtain tokens implicitly.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_pix ~51

Retrieve a Pix transaction by its BCB endToEndId (E<ispb><yyyymmddhhmm><sequence>).

Input Output Examples

Name	Type	Req	Description
end_to_end_id	string	yes	BCB endToEndId

No output schema declared.

No examples provided.

get_pix_charge ~58

Retrieve a Pix immediate charge (cob) by its BCB txid. Returns status, QR payload, and associated received Pix (if paid).

Input Output Examples

Name	Type	Req	Description
txid	string	yes	BCB txid (26-35 alphanumeric chars)

No output schema declared.

No examples provided.

get_pix_due_charge ~40

Retrieve a Pix due-date charge (cobv) by its BCB txid.

Input Output Examples

Name	Type	Req	Description
txid	string	yes	BCB txid

No output schema declared.

No examples provided.

get_statement ~97

Retrieve account statement transactions for a given period. Paginated.

Input Output Examples

Name	Type	Req	Description
account	string	yes	Agência-conta identifier of the merchant account
from	string	yes	Start date ISO-8601 (YYYY-MM-DD)
page	number	—	Page number (1-indexed)
page_size	number	—	Items per page (default 50)
to	string	yes	End date ISO-8601 (YYYY-MM-DD)

No output schema declared.

No examples provided.

list_pix_charges ~180

List Pix immediate charges (cob) filtered by date range and optional status / CPF / CNPJ. Paginated per BACEN Pix v2.

Input Output Examples

Name	Type	Req	Description
cnpj	string	—	Filter by payer CNPJ (digits only)
cpf	string	—	Filter by payer CPF (digits only)
from	string	yes	Start date-time ISO-8601 (e.g. 2025-01-01T00:00:00Z)
page	number	—	Page number (0-indexed per BACEN)
page_size	number	—	Items per page
status	string	—	Filter by status: ATIVA \| CONCLUIDA \| REMOVIDA_PELO_USUARIO_RECEBEDOR \| REMOVIDA_PELO_PSP
to	string	yes	End date-time ISO-8601

No output schema declared.

No examples provided.

list_pix_received ~123

List received Pix transactions (pix recebidos) by date range. Useful for reconciliation against cob/cobv charges.

Input Output Examples

Name	Type	Req	Description
cnpj	string	—	Optional payer CNPJ filter
cpf	string	—	Optional payer CPF filter
from	string	yes	Start date-time ISO-8601
page	number	—	Page number (0-indexed per BACEN)
page_size	number	—	Items per page
to	string	yes	End date-time ISO-8601
txid	string	—	Optional txid filter

No output schema declared.

No examples provided.

pay_tribute ~194

Pay a federal tribute (DARF, GPS, GRU) or other guia de arrecadação via Caixa. Input is the full 44/47-digit barcode or linha digitável plus debit account. Requires arrecadação contract.

Input Output Examples

Name	Type	Req	Description
amount	string	—	Amount to pay in BRL major units (required when barcode has 0000000 amount)
barcode	string	yes	44-digit barcode OR 47/48-digit linha digitável (digits only)
due_date	string	—	Original due date ISO-8601 (YYYY-MM-DD) — used when barcode does not carry it
idempotency_key	string	yes	Merchant-side idempotency key (UUID recommended)
kind	string	—	Tribute kind hint: DARF \| GPS \| GRU \| FGTS_GRRF \| OUTROS
payer_account	string	yes	Caixa account to debit (agência-conta)

No output schema declared.

No examples provided.

refund_pix ~109

Refund (devolução) a previously received Pix. Must reference the original endToEndId and a merchant-side refund id.

Input Output Examples

Name	Type	Req	Description
amount	string	—	Refund amount in BRL major units. Omit for full refund.
end_to_end_id	string	yes	Original Pix endToEndId to refund
reason	string	—	Free-text reason (stored by BCB for audit)
refund_id	string	yes	Merchant-side refund identifier (alphanumeric up to 35 chars)

No output schema declared.

No examples provided.

register_dict_key ~103

Register a DICT key (CPF, CNPJ, email, phone, or EVP) to an account owned by the merchant. Subject to BACEN portability flow for keys claimed elsewhere.

Input Output Examples

Name	Type	Req	Description
account	object	yes	Account the key should resolve to
key	string	—	DICT key value. Omit / use EVP to request a random UUID key.
key_type	string	yes	Key type: CPF \| CNPJ \| EMAIL \| PHONE \| EVP

No output schema declared.

No examples provided.

resolve_dict_key ~92

Resolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix. Subject to BCB rate limits per consenting payer.

Input Output Examples

Name	Type	Req	Description
key	string	yes	DICT key — CPF, CNPJ, email, phone (+55...), or EVP UUID
payer_document	string	—	Merchant / end-payer CPF/CNPJ for BCB audit logging

No output schema declared.

No examples provided.

send_pix ~136

Initiate an outbound Pix payment from the merchant's Caixa account. Amount in BRL major units (e.g. '10.50').

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in BRL major units with two decimals, e.g. '10.50'
description	string	—	Free-text description shown on the statement (max 140 chars)
idempotency_key	string	yes	Merchant-side idempotency key (UUID recommended)
payee	object	yes	Payee identification — either a DICT key or explicit bank account
payer_account	string	yes	Merchant account to debit (agência-conta)

No output schema declared.

No examples provided.

transfer_ted ~131

Initiate an outbound TED transfer from a Caixa merchant account to an external bank account. Settles same-day within BACEN TED windows.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in BRL major units
beneficiary	object	yes	TED beneficiary data
description	string	—	Free-text description (max 140 chars)
idempotency_key	string	yes	Merchant-side idempotency key (UUID recommended)
payer_account	string	yes	Source Caixa account (agência-conta)
purpose	string	—	Finalidade TED code (e.g. 1=Crédito em Conta)

No output schema declared.

No examples provided.

update_pix_charge ~127

Update (PATCH) a Pix immediate charge (cob) — e.g. change amount before payment, adjust expiration, or mark as REMOVIDA_PELO_USUARIO_RECEBEDOR.

Input Output Examples

Name	Type	Req	Description
amount	string	—	New amount in BRL major units (optional)
description	string	—	Payer-visible description
expires_in	number	—	New QR lifetime in seconds
status	string	—	New status: ATIVA \| REMOVIDA_PELO_USUARIO_RECEBEDOR
txid	string	yes	BCB txid of the charge to update

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 4 Aug

Day	Score
27 Jul	46
28 Jul	46
30 Jul	46
31 Jul	21
1 Aug	36
2 Aug	69
3 Aug	69
4 Aug	70