io.github.codespar/mcp-khipu
NPM · @CODESPAR/MCP-KHIPU · SCANNED SEP 30
MCP server for Khipu — Chilean instant bank-transfer payments (complements Transbank cards)
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 99 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability80
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2034 tokens (~96/item across 21 items; 21 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_payment" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 22 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.codespar/mcp-khipu server?
io.github.codespar/mcp-khipu runs locally as an npm package, launched with npx -y @codespar/mcp-khipu. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @codespar/mcp-khipu
claude mcp add codespar-mcp-khipu -- npx -y @codespar/mcp-khipu
{
"mcpServers": {
"codespar-mcp-khipu": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-khipu"
]
}
}
} {
"servers": {
"codespar-mcp-khipu": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-khipu"
]
}
}
} codex mcp add codespar-mcp-khipu -- npx -y @codespar/mcp-khipu
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"codespar-mcp-khipu": {
"type": "local",
"command": [
"npx",
"-y",
"@codespar/mcp-khipu"
],
"enabled": true
}
}
} openclaw mcp add codespar-mcp-khipu --command npx --arg -y --arg @codespar/mcp-khipu
mcp_servers:
codespar-mcp-khipu:
command: "npx"
args: ["-y", "@codespar/mcp-khipu"] {
"McpServers": {
"codespar-mcp-khipu": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@codespar/mcp-khipu"
]
}
}
} assistant mcp add codespar-mcp-khipu -t stdio -c npx -a -y @codespar/mcp-khipu
{
"mcpServers": {
"codespar-mcp-khipu": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-khipu"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Sept 26 −3
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 +1
- Stability: 0.97 → pass security
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −3
- Stability: pass → 0.77 functional
- 16 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 30 Sept 2026 · Analysed npm/@codespar/mcp-khipu@0.2.0-alpha.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 92 packages
| Packages resolved | 92 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
confirm_payment ~50
Manually confirm a Khipu payment. Use when the merchant has opted into manual confirmation and the backend has validated the underlying transfer.
| Name | Type | Req | Description |
|---|---|---|---|
| payment_id | string | yes | Khipu payment id to confirm |
No output schema declared.
No examples provided.
create_automatic_payment ~146
Create a Khipu automatic payment (recurring / subscription charge against a previously enrolled subscription_id). The payer must have completed the subscription enrollment at their bank first.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Charge amount in major units |
| currency | string | yes | ISO-4217 currency (typically CLP) |
| custom | string | – | Arbitrary merchant string echoed in webhooks |
| notify_url | string | – | Webhook URL Khipu POSTs to on status changes |
| subject | string | yes | Short human-readable purpose of this charge |
| subscription_id | string | yes | Subscription id produced during payer enrollment |
| transaction_id | string | – | Merchant-side order reference |
No output schema declared.
No examples provided.
create_payment ~465
Create a Khipu payment (bank-transfer charge). Returns a payment_id and URLs the payer visits to authorize the transfer from their Chilean bank account. Use simplified_transfer_url for in-app redirects and transfer_url for desktop bank-login flows.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Amount in major units (CLP has no decimals — 1000 = 1000 pesos) |
| body | string | – | Longer description of the payment (shown alongside subject) |
| cancel_url | string | – | Browser redirect target if the payer cancels |
| collect_account_uuid | string | – | Override the default collection account |
| confirm_timeout_date | string | – | ISO-8601 deadline after which an unconfirmed payment auto-reverses |
| currency | string | yes | ISO-4217 currency code. Typically CLP for Chile; CLF supported for UF-denominated charges. |
| custom | string | – | Arbitrary merchant string (JSON-encoded if you need structure) echoed back in webhooks |
| expires_date | string | – | ISO-8601 expiration timestamp for this payment request |
| fixed_payer_personal_identifier | string | – | Lock this payment to a specific payer RUT |
| integrator_fee | number | – | Integrator fee (for partners) |
| notify_api_version | string | – | Webhook API version. Use '3.0' for v3 notifications. |
| notify_url | string | – | Webhook URL Khipu POSTs to on status changes (receives a notification_token) |
| payer_email | string | – | Payer email — Khipu emails the payment instructions to this address |
| payer_name | string | – | Payer display name |
| responsible_user_email | string | – | Internal merchant user email shown in Khipu's dashboard as responsible for this charge |
| return_url | string | – | Browser redirect target after a successful payment |
| send_email | boolean | – | If true, Khipu emails the payer with the payment link |
| send_reminders | boolean | – | If true, Khipu sends the payer reminder emails before expiration |
| subject | string | yes | Short human-readable purpose of the payment (shown to the payer at their bank) |
| transaction_id | string | – | Merchant-side order reference echoed back in webhooks |
No output schema declared.
No examples provided.
create_receiver ~147
Create (onboard) a new receiver under an integrator account. The receiver can then collect Khipu payments. Only available to integrator-level API keys.
| Name | Type | Req | Description |
|---|---|---|---|
| admin_email | string | yes | Admin user email |
| admin_first_name | string | – | Admin user first name |
| admin_last_name | string | – | Admin user last name |
| business_identifier | string | yes | RUT / tax identifier of the receiving business |
| business_name | string | yes | Legal business name |
| contact_email | string | – | Public contact email |
| contact_phone | string | – | Public contact phone |
| country | string | – | ISO-3166 country code (e.g. 'CL') |
No output schema declared.
No examples provided.
create_terminal_session ~125
Create a Khipu terminal session for in-person / POS bank-transfer checkout. Returns a QR/URL the payer scans at the point of sale to pay from their bank app.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Amount in major units (CLP) |
| currency | string | yes | ISO-4217 currency, typically CLP |
| expires_date | string | – | ISO-8601 expiration timestamp |
| subject | string | yes | Short description of the sale |
| terminal_id | string | – | Optional POS terminal identifier |
| transaction_id | string | – | Merchant-side order reference |
No output schema declared.
No examples provided.
delete_payment ~47
Delete (cancel) a pending Khipu payment. Only works while the payment has not been paid by the payer.
| Name | Type | Req | Description |
|---|---|---|---|
| payment_id | string | yes | Khipu payment id to delete |
No output schema declared.
No examples provided.
delete_webhook ~41
Delete (unregister) a webhook endpoint by id. Khipu stops sending notifications immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| webhook_id | string | yes | Webhook id to delete |
No output schema declared.
No examples provided.
get_banks ~44
List Chilean banks supported by Khipu for bank-transfer payments. Agents can use this to render a bank-selection UI or to validate a bank_id before creating a payment.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_merchant ~42
Fetch a single merchant by id. Returns commercial info, configured collect accounts, and current integration status.
| Name | Type | Req | Description |
|---|---|---|---|
| merchant_id | string | yes | Khipu merchant id |
No output schema declared.
No examples provided.
get_merchants ~31
List the merchant receiver accounts accessible with the current API key. Useful to confirm auth + discover receiver_id values.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_payment ~70
Retrieve a Khipu payment. Pass either payment_id (lookup by id) or notification_token (lookup from a webhook — preferred, since webhooks only contain the token).
| Name | Type | Req | Description |
|---|---|---|---|
| notification_token | string | – | Token received in the webhook payload |
| payment_id | string | – | Khipu payment id |
No output schema declared.
No examples provided.
get_terminal_session ~51
Retrieve the current status of a terminal (POS) session — whether the payer has scanned, paid, or the session has expired.
| Name | Type | Req | Description |
|---|---|---|---|
| session_id | string | yes | Terminal session id returned by create_terminal_session |
No output schema declared.
No examples provided.
list_conciliations ~89
List settlement / conciliation records for a date range. Each record groups settled payments into a single bank deposit. Use to match Khipu payouts to your accounting.
| Name | Type | Req | Description |
|---|---|---|---|
| end | string | yes | ISO-8601 end date (inclusive) |
| merchant_id | string | – | Optional merchant filter (integrator use) |
| start | string | yes | ISO-8601 start date (inclusive) |
No output schema declared.
No examples provided.
list_merchant_accounts ~51
List the bank accounts registered for a merchant to collect into. Use with refund_payment / conciliation flows to know which account funds settle to.
| Name | Type | Req | Description |
|---|---|---|---|
| merchant_id | string | yes | Khipu merchant id |
No output schema declared.
No examples provided.
list_payments ~115
List Khipu payments for the current merchant, optionally filtered by date range and status. Useful for reconciliation jobs and agent-driven reporting.
| Name | Type | Req | Description |
|---|---|---|---|
| end | string | – | ISO-8601 end timestamp (inclusive) |
| page | number | – | Page number (1-based) |
| page_size | number | – | Results per page |
| start | string | – | ISO-8601 start timestamp (inclusive) |
| status | string | – | Filter by status (e.g. 'done', 'pending', 'expired', 'reversed') |
No output schema declared.
No examples provided.
list_receivers ~43
List receivers onboarded under the current integrator account.
| Name | Type | Req | Description |
|---|---|---|---|
| page | number | – | Page number (1-based) |
| page_size | number | – | Results per page |
No output schema declared.
No examples provided.
list_reviews ~88
List payer reviews / opinions left after a Khipu payment. Useful for NPS dashboards and detecting UX problems in the payment flow.
| Name | Type | Req | Description |
|---|---|---|---|
| end | string | – | ISO-8601 end date (inclusive) |
| page | number | – | Page number (1-based) |
| page_size | number | – | Results per page |
| start | string | – | ISO-8601 start date (inclusive) |
No output schema declared.
No examples provided.
list_webhooks ~18
List registered webhook endpoints for the current merchant.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
predict_payment ~114
Predict whether a payment is likely to succeed for a given payer+amount+bank, and recommend the best bank/rail. Call before create_payment to improve conversion for large or edge-case transfers.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Intended charge amount in major units |
| bank_id | string | – | Candidate bank id (from get_banks) |
| currency | string | yes | ISO-4217 currency code, typically CLP |
| payer_email | string | – | Payer email (optional — Khipu uses history if known) |
No output schema declared.
No examples provided.
refund_payment ~88
Refund a paid Khipu payment (full or partial). Refunds are only possible for merchants collecting into a Khipu account and before settlement of the corresponding funds (until 01:00 am the next business day).
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | Partial refund amount in major units. Omit for a full refund. |
| payment_id | string | yes | Khipu payment id to refund |
No output schema declared.
No examples provided.
register_webhook ~102
Register a webhook endpoint to receive Khipu notifications (payment.paid, payment.refunded, etc). Returns a webhook id and the shared secret used to verify incoming signatures.
| Name | Type | Req | Description |
|---|---|---|---|
| events | array | – | Event names to subscribe to (e.g. ['payment.paid','payment.refunded']) |
| secret | string | – | Optional shared secret; Khipu generates one if omitted |
| url | string | yes | HTTPS endpoint Khipu will POST notifications to |
No output schema declared.
No examples provided.
What is the io.github.codespar/mcp-khipu server?
io.github.codespar/mcp-khipu is listed in the public MCP registry as io.github.codespar/mcp-khipu. MCP server for Khipu, Chilean instant bank-transfer payments (complements Transbank cards). This page covers its npm package (@codespar/mcp-khipu).
Is the io.github.codespar/mcp-khipu server safe to use?
io.github.codespar/mcp-khipu scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 30 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.codespar/mcp-khipu server expose?
io.github.codespar/mcp-khipu exposes 21 tools: create_payment, get_payment, delete_payment, confirm_payment, refund_payment, and 16 more. Their descriptions and schemas cost roughly 1,967 tokens of context every time the server is loaded.
Is the io.github.codespar/mcp-khipu server still maintained?
io.github.codespar/mcp-khipu is still listed as active in the MCP registry. We last reached this channel on 30 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.codespar/mcp-khipu server under?
io.github.codespar/mcp-khipu declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.