# io.github.codespar/mcp-cielo (npm · @codespar/mcp-cielo)

MCP server for Cielo — credit card, debit, boleto, recurrent payments

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-cielo`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-cielo/codespar-mcp-cielo.md), [page](https://verifymcp.io/servers/codespar-mcp-cielo/codespar-mcp-cielo)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-cielo`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1869 tokens (~84/item across 22 items; 22 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-cielo -- npx -y @codespar/mcp-cielo
```

### Codex

```bash
codex mcp add codespar-mcp-cielo -- npx -y @codespar/mcp-cielo
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-cielo": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-cielo"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-cielo --command npx --arg -y --arg @codespar/mcp-cielo
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-cielo:
    command: "npx"
    args: ["-y", "@codespar/mcp-cielo"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-cielo": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-cielo"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, +4)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.30

### 2026-08-02 (score 65, +29)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 36, +8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (22)

### `create_sale` (~148 tokens)

Create a credit/debit card sale in Cielo

Input parameters:

- `amount` (number, required): Amount in cents (e.g., 15700 = R$157.00)
- `brand` (string, required): Card brand
- `capture` (boolean): Auto-capture (true for immediate capture)
- `cardNumber` (string, required): Credit card number
- `customerName` (string, required): Customer name
- `expirationDate` (string, required): Expiration date (MM/YYYY)
- `holder` (string, required): Cardholder name
- `installments` (number): Number of installments (1 for full payment)
- `merchantOrderId` (string, required): Merchant order reference
- `securityCode` (string, required): CVV

### `get_sale` (~27 tokens)

Get sale details by PaymentId

Input parameters:

- `paymentId` (string, required): Payment ID (GUID)

### `capture_sale` (~46 tokens)

Capture a pre-authorized sale

Input parameters:

- `amount` (number): Amount to capture in cents (optional, defaults to full amount)
- `paymentId` (string, required): Payment ID (GUID)

### `cancel_sale` (~49 tokens)

Cancel/void a sale (full or partial)

Input parameters:

- `amount` (number): Amount to cancel in cents (optional, defaults to full amount)
- `paymentId` (string, required): Payment ID (GUID)

### `create_recurrent` (~132 tokens)

Create a recurrent (recurring) credit card payment

Input parameters:

- `amount` (number, required): Amount in cents
- `brand` (string, required): Card brand
- `cardNumber` (string, required): Credit card number
- `customerName` (string, required): Customer name
- `endDate` (string): End date (YYYY-MM-DD, optional)
- `expirationDate` (string, required): Expiration date (MM/YYYY)
- `holder` (string, required): Cardholder name
- `interval` (string, required): Recurrence interval
- `merchantOrderId` (string, required): Merchant order reference
- `securityCode` (string, required): CVV

### `get_recurrent` (~29 tokens)

Get recurrent payment details

Input parameters:

- `recurrentPaymentId` (string, required): Recurrent Payment ID (GUID)

### `tokenize_card` (~71 tokens)

Tokenize a credit card for future use

Input parameters:

- `brand` (string, required): Card brand
- `cardNumber` (string, required): Credit card number
- `customerName` (string, required): Customer name
- `expirationDate` (string, required): Expiration date (MM/YYYY)
- `holder` (string, required): Cardholder name

### `create_boleto` (~100 tokens)

Create a boleto payment in Cielo

Input parameters:

- `amount` (number, required): Amount in cents
- `customerIdentity` (string): CPF or CNPJ
- `customerName` (string, required): Customer name
- `expirationDate` (string, required): Boleto expiration date (YYYY-MM-DD)
- `instructions` (string): Boleto instructions text
- `merchantOrderId` (string, required): Merchant order reference
- `provider` (string, required): Boleto provider/bank

### `create_pix` (~111 tokens)

Create a Pix payment in Cielo (generates QR code)

Input parameters:

- `amount` (number, required): Amount in cents (e.g., 15700 = R$157.00)
- `customerIdentity` (string): CPF or CNPJ
- `customerName` (string, required): Customer name
- `expirationDate` (string): QR code expiration (ISO 8601, e.g. 2025-12-31T23:59:59)
- `merchantOrderId` (string, required): Merchant order reference

### `get_pix` (~31 tokens)

Get Pix payment details and QR code by PaymentId

Input parameters:

- `paymentId` (string, required): Payment ID (GUID)

### `create_debit` (~126 tokens)

Create a debit card sale in Cielo (requires 3DS authentication)

Input parameters:

- `amount` (number, required): Amount in cents
- `brand` (string, required): Card brand
- `cardNumber` (string, required): Debit card number
- `customerName` (string, required): Customer name
- `expirationDate` (string, required): Expiration date (MM/YYYY)
- `holder` (string, required): Cardholder name
- `merchantOrderId` (string, required): Merchant order reference
- `returnUrl` (string, required): URL to redirect after 3DS authentication
- `securityCode` (string, required): CVV

### `create_ewallet` (~82 tokens)

Create a digital wallet payment (Google Pay, Samsung Pay, Apple Pay)

Input parameters:

- `amount` (number, required): Amount in cents
- `customerName` (string, required): Customer name
- `merchantOrderId` (string, required): Merchant order reference
- `walletKey` (string, required): Wallet token/key from wallet provider
- `walletType` (string, required): Digital wallet type

### `get_antifraud` (~32 tokens)

Get anti-fraud analysis details for a payment

Input parameters:

- `paymentId` (string, required): Payment ID (GUID)

### `create_sale_with_token` (~139 tokens)

Create a credit card sale using a previously stored CardToken (avoids re-entering card data)

Input parameters:

- `amount` (number, required): Amount in cents
- `brand` (string, required): Card brand (Visa, Master, Elo, Amex, Hipercard)
- `capture` (boolean): Auto-capture (default false)
- `cardToken` (string, required): CardToken returned by tokenize_card
- `customerName` (string, required): Customer name
- `installments` (number): Number of installments (default 1)
- `merchantOrderId` (string, required): Merchant order reference
- `securityCode` (string): CVV (optional, recommended)

### `update_recurrent_amount` (~45 tokens)

Update the amount of an existing recurrent payment

Input parameters:

- `amount` (number, required): New amount in cents
- `recurrentPaymentId` (string, required): Recurrent Payment ID (GUID)

### `update_recurrent_next_date` (~53 tokens)

Update the next charge date of an existing recurrent payment

Input parameters:

- `nextPaymentDate` (string, required): Next charge date (YYYY-MM-DD)
- `recurrentPaymentId` (string, required): Recurrent Payment ID (GUID)

### `deactivate_recurrent` (~37 tokens)

Deactivate (pause) a recurrent payment so it stops charging

Input parameters:

- `recurrentPaymentId` (string, required): Recurrent Payment ID (GUID)

### `reactivate_recurrent` (~34 tokens)

Reactivate a previously deactivated recurrent payment

Input parameters:

- `recurrentPaymentId` (string, required): Recurrent Payment ID (GUID)

### `create_payment_link` (~119 tokens)

Create a Cielo Link de Pagamento (shareable checkout URL)

Input parameters:

- `description` (string): Product/service description
- `maxNumberOfInstallments` (number): Max installments allowed (1-12)
- `name` (string, required): Product/service name
- `price` (number, required): Unit price in cents
- `quantity` (number): Quantity available (optional)
- `shipping` (object): Shipping options (for Physical type)
- `type` (string, required): Product type
- `weight` (number): Weight in grams (for Physical type)

### `get_payment_link` (~33 tokens)

Get a Cielo Link de Pagamento by its id

Input parameters:

- `paymentLinkId` (string, required): Payment link identifier

### `zero_auth` (~135 tokens)

Zero-dollar authorization to validate a card without charging (card or CardToken)

Input parameters:

- `brand` (string, required): Card brand
- `cardNumber` (string): Card number (omit if using cardToken)
- `cardToken` (string): CardToken (alternative to full card data)
- `cardType` (string): Card type
- `expirationDate` (string): Expiration date MM/YYYY (omit if using cardToken)
- `holder` (string): Cardholder name (omit if using cardToken)
- `saveCard` (boolean): Tokenize card on success (default false)
- `securityCode` (string, required): CVV

### `create_sale_with_3ds` (~223 tokens)

Create a credit card sale using 3DS 2.0 authentication data (from 3DS flow)

Input parameters:

- `amount` (number, required): Amount in cents
- `brand` (string, required): Card brand
- `capture` (boolean): Auto-capture (default false)
- `cardNumber` (string, required): Credit card number
- `cavv` (string, required): 3DS CAVV value
- `customerName` (string, required): Customer name
- `eci` (string, required): 3DS ECI value
- `expirationDate` (string, required): Expiration date (MM/YYYY)
- `holder` (string, required): Cardholder name
- `installments` (number): Number of installments (default 1)
- `merchantOrderId` (string, required): Merchant order reference
- `referenceId` (string): 3DS reference id (dsTransactionId)
- `securityCode` (string, required): CVV
- `version` (string): 3DS version (e.g., '2')
- `xid` (string): 3DS XID value

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-cielo/codespar-mcp-cielo#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 65
- 2026-08-02: 65
- 2026-08-01: 36
- 2026-07-31: 28
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-cielo
- Socket report: https://socket.dev/npm/package/@codespar/mcp-cielo
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-cielo/codespar-mcp-cielo/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-cielo/codespar-mcp-cielo/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-cielo/codespar-mcp-cielo