Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.codespar/mcp-epayco

NPM · @CODESPAR/MCP-EPAYCO · SCANNED AUG 6

MCP server for ePayco — Colombian gateway: cards, PSE, Daviplata and cash networks

Available components

npm · @codespar/mcp-epayco 68
+23 this week 68 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security86
  • No malware found by supply-chain analysis.Pass
  • Known CVEs were checked across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Dependency health was assessed across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability63
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 1167 tokens (~145/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management37
  • Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @codespar/mcp-epayco

# add to Claude Code
claude mcp add codespar-mcp-epayco -- npx -y @codespar/mcp-epayco
# add to Codex CLI
codex mcp add codespar-mcp-epayco -- npx -y @codespar/mcp-epayco
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-epayco": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-epayco"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add codespar-mcp-epayco --command npx --arg -y --arg @codespar/mcp-epayco
# ~/.hermes/config.yaml
mcp_servers:
  codespar-mcp-epayco:
    command: "npx"
    args: ["-y", "@codespar/mcp-epayco"]
// mcp.json
{
  "mcpServers": {
    "codespar-mcp-epayco": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-epayco"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 6 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 5 Aug 26 +1
    • CVE-2026-69207 no longer affects this package ▲ security
    • Known CVEs: fail → partial ▲ security
  • 4 Aug 26 +4
    • CVE-2026-69207 affects this package: medium ▼ security
    • Known CVEs: partial → fail ▼ security
    • Stability: unverified → 0.30 ▲ functional
  • 2 Aug 26 +27
    • Provenance: unverified → fail ▼ security
    • Known CVEs: unverified → partial ▲ security
    • Install scripts: unverified → pass ▲ security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • License: unverified → pass ▲ functional
    • Dependency health: unverified → partial ▲ functional
    • Maintenance: unverified → pass ▲ functional
    • Schema quality: unverified → good ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Licence: MIT functional
  • 1 Aug 26 −1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 −9
    • Provenance: unverified → fail ▼ security
    • Malware scan: pass → unverified ▼ security
    • Install scripts: unverified → pass ▲ security
    • Maintenance: unverified → pass ▲ functional
    • License: unverified → pass ▲ functional
    • Licence: MIT functional
  • 27 Jul 26 45

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 6 Aug 2026 · Analysed npm/@codespar/[email protected]

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm
Dependencies 94 packages
Packages resolved 94
Deprecated 94
Stale 29
Tree resolution Partial

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 8 exposed · ~1,100 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
charge_card ~219

Charge a tokenized card (POST /payment/v1/charge/create). Amounts in COP unless currency says otherwise. Test mode is controlled by EPAYCO_TEST.

NameTypeReqDescription
billstringyesMerchant invoice/order reference
currencystring—Currency code (default COP)
customer_idstringyesCustomer id from create_customer
descriptionstring—Charge description
doc_numberstringyesPayer document number
doc_typestringyesPayer document type: CC, CE, NIT, ...
duesstring—Installments (default "1")
emailstringyesPayer email
last_namestring—Payer last name
namestringyesPayer first name
taxstring—Tax portion (default "0")
tax_basestring—Taxable base (default value)
token_cardstringyesCard token
valuestringyesAmount (string, e.g. "116000")

No output schema declared.

No examples provided.

create_cash_payment ~249

Create a cash payment voucher on a Colombian cash network (POST /restpagos/v2/efectivo/{network} on secure.payco.co). The payer takes the voucher code to a physical point to pay.

NameTypeReqDescription
cell_phonestringyesPayer mobile phone
currencystring—Currency (default COP)
descriptionstringyesPayment description
doc_numberstringyesPayer document number
doc_typestringyesPayer document type
emailstringyesPayer email
end_datestringyesVoucher expiry date, YYYY-MM-DD
invoicestringyesMerchant invoice/order reference
ipstringyesPayer IP address
last_namestring—Payer last name
namestringyesPayer first name
networkstringyesCash network
taxstring—Tax portion (default "0")
tax_basestring—Taxable base
url_confirmationstring—Server-to-server confirmation webhook URL
url_responsestring—URL the payer returns to
valuestringyesAmount (string)

No output schema declared.

No examples provided.

create_customer ~105

Create an ePayco customer bound to a card token (POST /payment/v1/customer/create). Returns customer_id used by charge_card.

NameTypeReqDescription
defaultboolean—Set this card as the customer default (default true)
emailstringyesCustomer email
last_namestring—Customer last name
namestringyesCustomer first name
phonestring—Customer phone
token_cardstringyesCard token from tokenize_card

No output schema declared.

No examples provided.

create_pse_payment ~272

Create a PSE bank-debit payment (POST /restpagos/pagos/debitos.json on secure.payco.co). Returns a bank redirect URL the payer must open to authorize the debit.

NameTypeReqDescription
bankstringyesPSE bank code from list_pse_banks
cell_phonestringyesPayer mobile phone
currencystring—Currency (default COP)
descriptionstringyesPayment description
doc_numberstringyesPayer document number
doc_typestringyesPayer document type: CC, CE, NIT, ...
emailstringyesPayer email
invoicestringyesMerchant invoice/order reference
ipstringyesPayer IP address (PSE requirement)
last_namestring—Payer last name
namestringyesPayer first name
taxstring—Tax portion (default "0")
tax_basestring—Taxable base
type_personstring—0 = natural person, 1 = company
url_confirmationstring—Server-to-server confirmation webhook URL
url_responsestring—URL the payer returns to after the bank flow
valuestringyesAmount (string)

No output schema declared.

No examples provided.

get_pse_transaction ~56

Get a PSE transaction's status by transaction id (GET /restpagos/pse/transactioninfo.json on secure.payco.co).

NameTypeReqDescription
transaction_idstringyesPSE transactionID returned by create_pse_payment

No output schema declared.

No examples provided.

get_transaction ~61

Get transaction detail by referencePayco (GET https://secure.epayco.co/validation/v1/reference/{ref}). Works for card, PSE and cash payments.

NameTypeReqDescription
reference_paycostringyesThe referencePayco returned when the payment was created

No output schema declared.

No examples provided.

list_pse_banks ~36

List PSE banks available for bank debit (GET /restpagos/pse/bancos.json on secure.payco.co).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

tokenize_card ~102

Create a one-time card token (POST /v1/tokens on api.secure.payco.co). The token is then bound to a customer via create_customer and charged via charge_card.

NameTypeReqDescription
card_numberstringyesCard PAN
cvcstringyesCard CVC
exp_monthstringyesExpiry month, e.g. 09
exp_yearstringyesExpiry year, e.g. 2027

No output schema declared.

No examples provided.