# io.github.codespar/mcp-dlocal (npm · @codespar/mcp-dlocal)

MCP server for dLocal — LatAm cross-border payments, payouts, refunds across 15+ countries

- Trust score: 70/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-dlocal`: 70/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-dlocal/codespar-mcp-dlocal.md), [page](https://verifymcp.io/servers/codespar-mcp-dlocal/codespar-mcp-dlocal)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-dlocal`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1909 tokens (~106/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-dlocal -- npx -y @codespar/mcp-dlocal
```

### Codex

```bash
codex mcp add codespar-mcp-dlocal -- npx -y @codespar/mcp-dlocal
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-dlocal": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-dlocal"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-dlocal --command npx --arg -y --arg @codespar/mcp-dlocal
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-dlocal:
    command: "npx"
    args: ["-y", "@codespar/mcp-dlocal"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-dlocal": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-dlocal"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-03 (score 69, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 65, +29)

- [security regression] Provenance: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 36, +31)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −41)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (18)

### `create_payment` (~318 tokens)

Create a payment (pay-in) in a LatAm country using a local payment method. Returns the payment object with a status and, for voucher/QR methods, the redirect/display data.

Input parameters:

- `amount` (number, required): Amount in the country's currency, major units (e.g. 100 = 100 BRL, not cents)
- `callback_url` (string): Browser redirect target after REDIRECT flow completes
- `card` (object): For DIRECT card flow only — tokenized card object. Omit for REDIRECT.
- `country` (string, required): ISO-3166 alpha-2 country code (BR, MX, AR, CO, CL, PE, UY, EC, BO, CR, GT)
- `currency` (string, required): ISO-4217 currency code (BRL, MXN, ARS, COP, CLP, PEN, USD, etc)
- `description` (string): Human-readable description for the payer
- `notification_url` (string): Webhook URL dLocal calls on status changes
- `order_id` (string, required): Merchant-side order reference (appears in reports)
- `payer` (object, required): Payer identification
- `payment_method_flow` (string, required): DIRECT for tokenized card; REDIRECT for hosted flow (OXXO voucher, Pix QR, PSE bank select)
- `payment_method_id` (string, required): Method id from /payments-methods (e.g. CARD, PIX, OX, PSE, SPEI). Use list_payment_methods to enumerate for a country.

### `get_payment` (~41 tokens)

Get payment status and full detail by dLocal payment id.

Input parameters:

- `id` (string, required): dLocal payment id (e.g. D-30000-xxxx)

### `get_payment_by_order_id` (~61 tokens)

Get a payment by the merchant-side order_id supplied at creation time. Useful when the agent only kept its own reference and not dLocal's id.

Input parameters:

- `order_id` (string, required): Merchant-side order reference passed as order_id when creating the payment

### `list_payments` (~162 tokens)

List payments with optional date / country / status filters. Useful for reconciliation and reporting agents.

Input parameters:

- `country` (string): ISO-3166 alpha-2 country filter
- `created_date_from` (string): Lower bound (ISO-8601 date or datetime)
- `created_date_to` (string): Upper bound (ISO-8601 date or datetime)
- `page` (number): Page number (1-indexed)
- `page_size` (number): Results per page (max 100)
- `payment_method_id` (string): Filter by payment method (CARD, PIX, OX, etc)
- `status` (string): Filter by status (PAID, PENDING, REJECTED, CANCELLED, EXPIRED, AUTHORIZED, VERIFIED)

### `capture_payment` (~103 tokens)

Capture an AUTHORIZED card payment. Omit amount for full capture; pass amount for partial capture (must be ≤ authorized amount). Card-only.

Input parameters:

- `amount` (number): Partial capture amount in major units. Omit for full capture.
- `currency` (string): ISO-4217 currency code (must match original payment)
- `order_id` (string): Optional merchant reference for the capture
- `payment_id` (string, required): Original AUTHORIZED dLocal payment id

### `cancel_payment` (~44 tokens)

Cancel an authorized-but-not-captured payment, or void a PENDING payment. Card payments must be in AUTHORIZED state.

Input parameters:

- `id` (string, required): dLocal payment id

### `create_refund` (~86 tokens)

Refund a captured payment. Supports full refund (amount omitted) or partial refund (amount set).

Input parameters:

- `amount` (number): Partial refund amount in major units. Omit for a full refund.
- `description` (string): Reason or reference
- `notification_url` (string): Webhook URL for refund status updates
- `payment_id` (string, required): Original dLocal payment id

### `get_refund` (~31 tokens)

Get refund status by refund id.

Input parameters:

- `id` (string, required): dLocal refund id (R-xxxx)

### `list_refunds` (~108 tokens)

List refunds, optionally scoped to a payment_id. Useful for reconciling partial refunds against the original charge.

Input parameters:

- `created_date_from` (string): Lower bound (ISO-8601)
- `created_date_to` (string): Upper bound (ISO-8601)
- `page` (number): Page number (1-indexed)
- `page_size` (number): Results per page (max 100)
- `payment_id` (string): Optional — only return refunds for this payment id

### `create_payout` (~149 tokens)

Send money out to a beneficiary in a LatAm country. Used for marketplace seller payouts, creator payouts, and cross-border settlement.

Input parameters:

- `amount` (number, required): Payout amount in major units
- `beneficiary` (object, required): Beneficiary object with identity + destination account
- `country` (string, required): Destination country ISO-3166 alpha-2
- `currency` (string, required): ISO-4217 currency code
- `description` (string): Payout description
- `notification_url` (string): Webhook URL for payout status updates
- `order_id` (string, required): Merchant-side payout reference
- `payment_method_id` (string, required): Destination method (BA for bank account, varies by country)

### `get_payout` (~33 tokens)

Get payout status by dLocal payout id.

Input parameters:

- `id` (string, required): dLocal payout id (P-xxxx)

### `get_payout_by_external_id` (~61 tokens)

Get a payout by the merchant external_id / order_id supplied at creation time. Mirror of get_payment_by_order_id for the payouts side.

Input parameters:

- `external_id` (string, required): Merchant-side payout reference (order_id used at create_payout time)

### `list_payouts` (~127 tokens)

List payouts with optional date / country / status filters. Useful for settlement reconciliation across countries.

Input parameters:

- `country` (string): ISO-3166 alpha-2 country filter
- `created_date_from` (string): Lower bound (ISO-8601)
- `created_date_to` (string): Upper bound (ISO-8601)
- `page` (number): Page number (1-indexed)
- `page_size` (number): Results per page (max 100)
- `status` (string): Filter by status (PAID, PENDING, REJECTED, CANCELLED)

### `list_payment_methods` (~92 tokens)

List all payment methods available for a given country. Agents use this to dynamically discover local methods (Pix in BR, OXXO in MX, PSE in CO, etc) without hard-coding per-country logic.

Input parameters:

- `country` (string, required): ISO-3166 alpha-2 country code (BR, MX, AR, CO, CL, PE, UY, EC, BO, CR, GT)

### `get_balance` (~18 tokens)

Get the merchant's current available balance per currency.

### `get_exchange_rate` (~117 tokens)

Query the dLocal FX rate for a destination country/currency pair. Used to preview converted amounts before a payout or USD-funded charge.

Input parameters:

- `amount` (number): Optional source amount to convert; the response will include the destination value
- `country` (string, required): Destination country ISO-3166 alpha-2
- `from_currency` (string, required): Source currency ISO-4217 (typically USD or EUR)
- `to_currency` (string, required): Destination local currency ISO-4217 (BRL, MXN, ARS, etc)

### `create_card_token` (~134 tokens)

Tokenize a card for use in DIRECT-flow create_payment. Use the returned token in the card.token field instead of raw PAN. Required for PCI scope reduction.

Input parameters:

- `card_number` (string, required): Card PAN (digits only, no spaces)
- `country` (string): Issuing country ISO-3166 alpha-2 (optional; helps method routing)
- `cvv` (string, required): Card verification value
- `expiration_month` (number, required): 1-12
- `expiration_year` (number, required): 4-digit year (e.g. 2028)
- `holder_name` (string, required): Cardholder full name

### `validate_document` (~157 tokens)

Validate a LatAm tax/identity document (CPF or CNPJ in BR, CUIT/CUIL/DNI in AR, RUT in CL/UY, RFC/CURP in MX, etc). Returns whether the document is well-formed and, when supported, registry-validated.

Input parameters:

- `country` (string, required): ISO-3166 alpha-2 (BR, AR, CL, UY, MX, CO, PE, EC, BO, CR, GT)
- `document` (string, required): Document number (digits only when applicable)
- `document_type` (string, required): Document type code (CPF, CNPJ, CUIT, CUIL, DNI, RUT, RFC, CURP, NIT, RUC, CI)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-dlocal/codespar-mcp-dlocal#diagnostics

## Score history

- 2026-08-04: 70
- 2026-08-03: 69
- 2026-08-02: 65
- 2026-08-01: 36
- 2026-07-31: 5
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-dlocal
- Socket report: https://socket.dev/npm/package/@codespar/mcp-dlocal
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-dlocal/codespar-mcp-dlocal/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-dlocal/codespar-mcp-dlocal/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-dlocal/codespar-mcp-dlocal