# io.github.codespar/mcp-khipu (npm · @codespar/mcp-khipu)

MCP server for Khipu — Chilean instant bank-transfer payments (complements Transbank cards)

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@codespar/mcp-khipu`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-khipu/codespar-mcp-khipu.md), [page](https://verifymcp.io/servers/codespar-mcp-khipu/codespar-mcp-khipu)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-khipu`
- Version: `0.2.0-alpha.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 41 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2034 tokens (~96/item across 21 items; 21 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-khipu -- npx -y @codespar/mcp-khipu
```

### Codex

```bash
codex mcp add codespar-mcp-khipu -- npx -y @codespar/mcp-khipu
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-khipu": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-khipu"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-khipu --command npx --arg -y --arg @codespar/mcp-khipu
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-khipu:
    command: "npx"
    args: ["-y", "@codespar/mcp-khipu"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-khipu": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-khipu"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 69, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 65, +60)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 5, −23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (21)

### `create_payment` (~465 tokens)

Create a Khipu payment (bank-transfer charge). Returns a payment_id and URLs the payer visits to authorize the transfer from their Chilean bank account. Use simplified_transfer_url for in-app redirects and transfer_url for desktop bank-login flows.

Input parameters:

- `amount` (number, required): Amount in major units (CLP has no decimals — 1000 = 1000 pesos)
- `body` (string): Longer description of the payment (shown alongside subject)
- `cancel_url` (string): Browser redirect target if the payer cancels
- `collect_account_uuid` (string): Override the default collection account
- `confirm_timeout_date` (string): ISO-8601 deadline after which an unconfirmed payment auto-reverses
- `currency` (string, required): ISO-4217 currency code. Typically CLP for Chile; CLF supported for UF-denominated charges.
- `custom` (string): Arbitrary merchant string (JSON-encoded if you need structure) echoed back in webhooks
- `expires_date` (string): ISO-8601 expiration timestamp for this payment request
- `fixed_payer_personal_identifier` (string): Lock this payment to a specific payer RUT
- `integrator_fee` (number): Integrator fee (for partners)
- `notify_api_version` (string): Webhook API version. Use '3.0' for v3 notifications.
- `notify_url` (string): Webhook URL Khipu POSTs to on status changes (receives a notification_token)
- `payer_email` (string): Payer email — Khipu emails the payment instructions to this address
- `payer_name` (string): Payer display name
- `responsible_user_email` (string): Internal merchant user email shown in Khipu's dashboard as responsible for this charge
- `return_url` (string): Browser redirect target after a successful payment
- `send_email` (boolean): If true, Khipu emails the payer with the payment link
- `send_reminders` (boolean): If true, Khipu sends the payer reminder emails before expiration
- `subject` (string, required): Short human-readable purpose of the payment (shown to the payer at their bank)
- `transaction_id` (string): Merchant-side order reference echoed back in webhooks

### `get_payment` (~70 tokens)

Retrieve a Khipu payment. Pass either payment_id (lookup by id) or notification_token (lookup from a webhook — preferred, since webhooks only contain the token).

Input parameters:

- `notification_token` (string): Token received in the webhook payload
- `payment_id` (string): Khipu payment id

### `delete_payment` (~47 tokens)

Delete (cancel) a pending Khipu payment. Only works while the payment has not been paid by the payer.

Input parameters:

- `payment_id` (string, required): Khipu payment id to delete

### `confirm_payment` (~50 tokens)

Manually confirm a Khipu payment. Use when the merchant has opted into manual confirmation and the backend has validated the underlying transfer.

Input parameters:

- `payment_id` (string, required): Khipu payment id to confirm

### `refund_payment` (~88 tokens)

Refund a paid Khipu payment (full or partial). Refunds are only possible for merchants collecting into a Khipu account and before settlement of the corresponding funds (until 01:00 am the next business day).

Input parameters:

- `amount` (number): Partial refund amount in major units. Omit for a full refund.
- `payment_id` (string, required): Khipu payment id to refund

### `list_payments` (~115 tokens)

List Khipu payments for the current merchant, optionally filtered by date range and status. Useful for reconciliation jobs and agent-driven reporting.

Input parameters:

- `end` (string): ISO-8601 end timestamp (inclusive)
- `page` (number): Page number (1-based)
- `page_size` (number): Results per page
- `start` (string): ISO-8601 start timestamp (inclusive)
- `status` (string): Filter by status (e.g. 'done', 'pending', 'expired', 'reversed')

### `predict_payment` (~114 tokens)

Predict whether a payment is likely to succeed for a given payer+amount+bank, and recommend the best bank/rail. Call before create_payment to improve conversion for large or edge-case transfers.

Input parameters:

- `amount` (number, required): Intended charge amount in major units
- `bank_id` (string): Candidate bank id (from get_banks)
- `currency` (string, required): ISO-4217 currency code, typically CLP
- `payer_email` (string): Payer email (optional — Khipu uses history if known)

### `get_merchants` (~31 tokens)

List the merchant receiver accounts accessible with the current API key. Useful to confirm auth + discover receiver_id values.

### `get_merchant` (~42 tokens)

Fetch a single merchant by id. Returns commercial info, configured collect accounts, and current integration status.

Input parameters:

- `merchant_id` (string, required): Khipu merchant id

### `list_merchant_accounts` (~51 tokens)

List the bank accounts registered for a merchant to collect into. Use with refund_payment / conciliation flows to know which account funds settle to.

Input parameters:

- `merchant_id` (string, required): Khipu merchant id

### `create_receiver` (~147 tokens)

Create (onboard) a new receiver under an integrator account. The receiver can then collect Khipu payments. Only available to integrator-level API keys.

Input parameters:

- `admin_email` (string, required): Admin user email
- `admin_first_name` (string): Admin user first name
- `admin_last_name` (string): Admin user last name
- `business_identifier` (string, required): RUT / tax identifier of the receiving business
- `business_name` (string, required): Legal business name
- `contact_email` (string): Public contact email
- `contact_phone` (string): Public contact phone
- `country` (string): ISO-3166 country code (e.g. 'CL')

### `list_receivers` (~43 tokens)

List receivers onboarded under the current integrator account.

Input parameters:

- `page` (number): Page number (1-based)
- `page_size` (number): Results per page

### `list_conciliations` (~89 tokens)

List settlement / conciliation records for a date range. Each record groups settled payments into a single bank deposit. Use to match Khipu payouts to your accounting.

Input parameters:

- `end` (string, required): ISO-8601 end date (inclusive)
- `merchant_id` (string): Optional merchant filter (integrator use)
- `start` (string, required): ISO-8601 start date (inclusive)

### `list_reviews` (~88 tokens)

List payer reviews / opinions left after a Khipu payment. Useful for NPS dashboards and detecting UX problems in the payment flow.

Input parameters:

- `end` (string): ISO-8601 end date (inclusive)
- `page` (number): Page number (1-based)
- `page_size` (number): Results per page
- `start` (string): ISO-8601 start date (inclusive)

### `register_webhook` (~102 tokens)

Register a webhook endpoint to receive Khipu notifications (payment.paid, payment.refunded, etc). Returns a webhook id and the shared secret used to verify incoming signatures.

Input parameters:

- `events` (array): Event names to subscribe to (e.g. ['payment.paid','payment.refunded'])
- `secret` (string): Optional shared secret; Khipu generates one if omitted
- `url` (string, required): HTTPS endpoint Khipu will POST notifications to

### `list_webhooks` (~18 tokens)

List registered webhook endpoints for the current merchant.

### `delete_webhook` (~41 tokens)

Delete (unregister) a webhook endpoint by id. Khipu stops sending notifications immediately.

Input parameters:

- `webhook_id` (string, required): Webhook id to delete

### `create_terminal_session` (~125 tokens)

Create a Khipu terminal session for in-person / POS bank-transfer checkout. Returns a QR/URL the payer scans at the point of sale to pay from their bank app.

Input parameters:

- `amount` (number, required): Amount in major units (CLP)
- `currency` (string, required): ISO-4217 currency, typically CLP
- `expires_date` (string): ISO-8601 expiration timestamp
- `subject` (string, required): Short description of the sale
- `terminal_id` (string): Optional POS terminal identifier
- `transaction_id` (string): Merchant-side order reference

### `get_terminal_session` (~51 tokens)

Retrieve the current status of a terminal (POS) session — whether the payer has scanned, paid, or the session has expired.

Input parameters:

- `session_id` (string, required): Terminal session id returned by create_terminal_session

### `get_banks` (~44 tokens)

List Chilean banks supported by Khipu for bank-transfer payments. Agents can use this to render a bank-selection UI or to validate a bank_id before creating a payment.

### `create_automatic_payment` (~146 tokens)

Create a Khipu automatic payment (recurring / subscription charge against a previously enrolled subscription_id). The payer must have completed the subscription enrollment at their bank first.

Input parameters:

- `amount` (number, required): Charge amount in major units
- `currency` (string, required): ISO-4217 currency (typically CLP)
- `custom` (string): Arbitrary merchant string echoed in webhooks
- `notify_url` (string): Webhook URL Khipu POSTs to on status changes
- `subject` (string, required): Short human-readable purpose of this charge
- `subscription_id` (string, required): Subscription id produced during payer enrollment
- `transaction_id` (string): Merchant-side order reference

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-khipu/codespar-mcp-khipu#diagnostics

## Score history

- 2026-08-03: 69
- 2026-08-02: 65
- 2026-08-01: 5
- 2026-07-31: 5
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-khipu
- Socket report: https://socket.dev/npm/package/@codespar/mcp-khipu
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-khipu/codespar-mcp-khipu/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-khipu/codespar-mcp-khipu/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-khipu/codespar-mcp-khipu