io.github.codespar/mcp-konduto
NPM · @CODESPAR/MCP-KONDUTO · SCANNED AUG 4
MCP server for Konduto — Brazilian fraud prevention: order risk scoring, device intel, lists
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security83
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 42 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1981 tokens (~110/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @codespar/mcp-konduto
claude mcp add codespar-mcp-konduto -- npx -y @codespar/mcp-konduto
codex mcp add codespar-mcp-konduto -- npx -y @codespar/mcp-konduto
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"codespar-mcp-konduto": {
"type": "local",
"command": [
"npx",
"-y",
"@codespar/mcp-konduto"
],
"enabled": true
}
}
} openclaw mcp add codespar-mcp-konduto --command npx --arg -y --arg @codespar/mcp-konduto
mcp_servers:
codespar-mcp-konduto:
command: "npx"
args: ["-y", "@codespar/mcp-konduto"] {
"mcpServers": {
"codespar-mcp-konduto": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-konduto"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Aug 26 +4
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
- Stability: unverified → 0.30 ▲ functional
- 2 Aug 26 +29
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- License: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Schema quality: unverified → excellent ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +8
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 +2
- Malware scan: pass → unverified ▼ security
- Dependency health: partial → unverified ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- 29 Jul 26 −20
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Aug 2026 · Analysed npm/@codespar/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-8j4g-w8fx-2239 | CVE-2026-69207 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | yes |
Dependencies 94 packages
94 packages in the resolved dependency tree · 94 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
add_to_allowlist ~71
Add a value to the Konduto allowlist (trusted). Future orders matching the value are auto-approved without full ML scoring. Use sparingly — allowlist overrides fraud signals.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Allowlist dimension (same dimensions as blocklist) |
| value | string | yes | Value to trust |
No output schema declared.
No examples provided.
add_to_blocklist ~140
Add a value to the Konduto blocklist. Any future order matching the value is auto-declined. Useful for known-bad emails, IPs, tax IDs, or card BIN+last4 pairs observed in confirmed fraud.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Blocklist dimension: email, phone, ip, name, bin_last4 (format 'BIN-LAST4', e.g. '555555-1234'), zip, or tax_id (CPF/CNPJ). |
| value | string | yes | The value to block (e.g. '[email protected]' for email, '555555-1234' for bin_last4) |
No output schema declared.
No examples provided.
add_to_reviewlist ~71
Add a value to the Konduto reviewlist. Future orders matching the value are forced into manual review regardless of score. Useful for ambiguous signals that warrant human eyes.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Reviewlist dimension (same dimensions as blocklist) |
| value | string | yes | Value to force into review |
No output schema declared.
No examples provided.
get_order ~71
Retrieve the current analysis state of an order. Returns decision (approved / declined / review / not_analyzed), numeric score, and recommendation. Useful when the initial response was 'review' or when polling after async re-scoring.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Merchant-side order id used in send_order_for_analysis |
No output schema declared.
No examples provided.
query_allowlist ~76
Check whether a value is currently on the Konduto allowlist. Konduto's public docs explicitly support email; other dimensions are accepted by symmetry with the blocklist contract but only email is guaranteed.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Allowlist dimension (use 'email' for guaranteed behavior) |
| value | string | yes | Value to query |
No output schema declared.
No examples provided.
query_blocklist ~42
Check whether a value is currently on the Konduto blocklist.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Blocklist dimension |
| value | string | yes | Value to query |
No output schema declared.
No examples provided.
query_reviewlist ~76
Check whether a value is currently on the Konduto reviewlist. Konduto's public docs explicitly support email; other dimensions are accepted by symmetry with the blocklist contract but only email is guaranteed.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Reviewlist dimension (use 'email' for guaranteed behavior) |
| value | string | yes | Value to query |
No output schema declared.
No examples provided.
remove_from_allowlist ~53
Remove a value from the Konduto allowlist. Future orders matching the value will once again undergo full ML scoring.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Allowlist dimension |
| value | string | yes | Value to remove |
No output schema declared.
No examples provided.
remove_from_blocklist ~40
Remove a value from the Konduto blocklist.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Blocklist dimension |
| value | string | yes | Value to remove |
No output schema declared.
No examples provided.
remove_from_reviewlist ~56
Remove a value from the Konduto reviewlist. Future orders matching the value will be scored normally instead of being forced into review.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | Reviewlist dimension |
| value | string | yes | Value to remove |
No output schema declared.
No examples provided.
report_chargeback ~102
Report a confirmed chargeback for an order. Convenience wrapper around update_order_status with status='fraud' — the primary feedback signal Konduto's ML model uses to retrain on similar buyers. Call this as soon as the chargeback dispute is confirmed (not when first received).
| Name | Type | Req | Description |
|---|---|---|---|
| comments | string | — | Optional notes (e.g. chargeback reason code, acquirer reference) |
| id | string | yes | Merchant-side order id of the charged-back order |
No output schema declared.
No examples provided.
report_order_approved ~93
Report that an order was ultimately approved by the merchant. Convenience wrapper around update_order_status with status='approved'. Use after Konduto returned 'review' and a human approved the order, or when the merchant overrode a 'declined' recommendation.
| Name | Type | Req | Description |
|---|---|---|---|
| comments | string | — | Optional notes on why the order was approved (e.g. manual review outcome) |
| id | string | yes | Merchant-side order id |
No output schema declared.
No examples provided.
report_order_declined ~77
Report that an order was ultimately declined by the merchant. Convenience wrapper around update_order_status with status='declined'. Use after manual review concluded the order should be rejected, or when the acquirer declined the payment.
| Name | Type | Req | Description |
|---|---|---|---|
| comments | string | — | Optional notes on the decline reason |
| id | string | yes | Merchant-side order id |
No output schema declared.
No examples provided.
send_order_for_analysis ~523
Submit an order to Konduto for fraud analysis. Returns a decision (approved / declined / review / not_analyzed), a numeric score, and a recommendation. Include as much signal as possible — billing + shipping, ip, items, payment, and (crucially) the visitor id captured by Konduto's browser JS SDK — to maximize decision quality.
| Name | Type | Req | Description |
|---|---|---|---|
| analyze | boolean | — | If false, Konduto stores the order without running the ML model. Default true. |
| billing | object | — | Billing address: name, address1, address2, city, state, zip, country. |
| currency | string | — | ISO-4217 currency code (typically BRL) |
| customer | object | yes | Customer object: id, name, email, tax_id (CPF/CNPJ), phone1, created_at, new_account, vip, etc. |
| event | object | — | Event ticketing fields. Omit for non-event orders. |
| hotel | object | — | Hotel-specific fields. Omit for non-hotel orders. |
| id | string | yes | Merchant-side order id (must be unique and stable — used to correlate future GETs and status updates) |
| installments | number | yes | Number of installments for card payments (1 for lump sum) |
| ip | string | — | Buyer's IP at order time (IPv4 or IPv6) |
| payment | array | — | Array of payment methods. Each item: { type: 'credit', bin, last4, expiration_date, status } or { type: 'boleto' | 'pix' | 'debit' }. |
| recurring | boolean | — | True for subscription / recurring orders |
| sales_channel | string | — | Sales channel identifier (e.g. ecommerce, mobile, marketplace) |
| shipping | object | — | Shipping address: name, address1, address2, city, state, zip, country. |
| shipping_amount | number | — | Shipping charge in major units |
| shopping_cart | array | — | Line items. Each: { sku, product_code, category, name, description, unit_cost, quantity, discount }. |
| tax_amount | number | — | Tax amount in major units |
| total_amount | number | yes | Total order amount in major units (e.g. 199.90 BRL) |
| travel | object | — | Travel-specific fields (passenger, flights). Omit for non-travel orders. |
| visitor | string | — | Visitor id captured by Konduto's browser JS SDK. Strongly recommended — drives the behavioral / device intelligence signal. |
No output schema declared.
No examples provided.
update_allowlist_entry ~102
Update an existing allowlist entry — typically to extend or shorten the expiration window. Konduto's docs recommend short windows (1-2 days) for allowlist entries since they bypass ML scoring entirely.
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | string | — | ISO-8601 timestamp for new expiration. Omit (or set null) to make the entry permanent. |
| type | string | yes | Allowlist dimension |
| value | string | yes | Existing allowlist value to update |
No output schema declared.
No examples provided.
update_blocklist_entry ~106
Update an existing blocklist entry — typically used to extend or shorten the expiration window (expires_at) without removing and re-adding the entry. The (type, value) pair must already exist on the blocklist.
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | string | — | ISO-8601 timestamp for new expiration. Omit (or set null) to make the entry permanent. |
| type | string | yes | Blocklist dimension |
| value | string | yes | Existing blocklist value to update |
No output schema declared.
No examples provided.
update_order_status ~129
Notify Konduto of the merchant's final status for an order. Feeds Konduto's ML model and is required for ongoing decision quality. Common transitions: new → approved, new → declined, approved → canceled, approved → fraud (when a chargeback is confirmed).
| Name | Type | Req | Description |
|---|---|---|---|
| comments | string | — | Optional free-text comments on the status change |
| id | string | yes | Merchant-side order id |
| status | string | yes | Merchant's final status. Use 'fraud' for confirmed chargebacks — this is the primary feedback signal Konduto's model uses to tune future decisions on similar buyers. |
No output schema declared.
No examples provided.
update_reviewlist_entry ~86
Update an existing reviewlist entry — typically to extend or shorten the expiration window without removing and re-adding the entry.
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | string | — | ISO-8601 timestamp for new expiration. Omit (or set null) to make the entry permanent. |
| type | string | yes | Reviewlist dimension |
| value | string | yes | Existing reviewlist value to update |
No output schema declared.
No examples provided.