io.github.codespar/mcp-matera

NPM · @CODESPAR/MCP-MATERA · SCANNED AUG 4

MCP server for Matera — Brazilian core-banking BaaS over Pix, DICT, and Pix Automático

Available components

+24 this week 69 69 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security83

No malware found by supply-chain analysis.Pass
CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 42 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability78

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2591 tokens (~117/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management30

Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
98% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @codespar/mcp-matera

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add codespar-mcp-matera -- npx -y @codespar/mcp-matera

# add to Codex CLI

codex mcp add codespar-mcp-matera -- npx -y @codespar/mcp-matera

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-matera": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-matera"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add codespar-mcp-matera --command npx --arg -y --arg @codespar/mcp-matera

# ~/.hermes/config.yaml

mcp_servers:
  codespar-mcp-matera:
    command: "npx"
    args: ["-y", "@codespar/mcp-matera"]

// mcp.json

{
  "mcpServers": {
    "codespar-mcp-matera": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-matera"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 +4
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
- Stability: unverified → 0.30 ▲ functional
2 Aug 26 +25
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 +35
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
31 Jul 26 −19
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −21
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
27 Jul 26 45

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@codespar/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding

ID	CVE	Severity	Vector	Fix available
GHSA-8j4g-w8fx-2239	CVE-2026-69207	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes

Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 22 exposed · ~2,524 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

cancel_pix_automatico ~64

Cancel an active Pix Automático recurrence. Future charges stop after BCB confirms the cancellation. Past charges are unaffected.

Input Output Examples

Name	Type	Req	Description
id_rec	string	yes	Recurrence id (idRec) to cancel
reason	string	—	Optional reason recorded on the cancellation

No output schema declared.

No examples provided.

create_pix_automatico ~162

Register a Pix Automático recurrence (BCB 2025 recurring Pix product, /rec). The payer authorizes the merchant to pull recurring amounts on a schedule. Matera is one of the few providers live with this.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Amount per charge in BRL (fixed schedule)
description	string	yes	Description shown to the payer on the authorization screen
end_date	string	—	Optional ISO-8601 date to stop the recurrence
first_charge_date	string	yes	ISO-8601 date of the first charge
frequency	string	yes	Recurrence frequency
merchant_pix_key	string	yes	Merchant Pix key receiving the recurring payments
payer	object	yes	Payer identity + bank

No output schema declared.

No examples provided.

create_pix_charge_due ~337

Create a due-dated Pix charge (BCB /cobv — Pix com Vencimento). Boleto-style charge with due date, late fee (multa), interest (juros), and discount fields. Returns txid + QR payload.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Original amount in BRL (valor.original)
debtor	object	yes	Payer (devedor). BCB requires CPF or CNPJ + name for cobv.
description	string	yes	Description shown to payer (solicitacaoPagador)
discount	number	—	Discount value if paid before due date
discount_mode	number	—	BCB desconto.modalidade (1..6)
due_date	string	yes	ISO-8601 date when the charge becomes due (data.dataDeVencimento)
fine	number	—	Late fee, BRL or % depending on `fine_mode` (multa.valor or multa.modalidade)
fine_mode	number	—	1=fixed amount, 2=percent (BCB modalidade)
interest	number	—	Interest after due date
interest_mode	number	—	BCB juros.modalidade (1..7). 2=percent per day, 5=percent per month, etc.
pix_key	string	yes	Merchant Pix key the charge settles to
txid	string	—	Optional merchant-side txid (26-35 alphanumerics)
validity_days_after_due	number	—	How many calendar days after due date the QR remains payable (validadeAposVencimento). Default 30.

No output schema declared.

No examples provided.

create_pix_charge_dynamic ~143

Create a dynamic Pix charge (single-use QR with expiration). Returns txid, EMV copy-paste, and QR image. Preferred for e-commerce checkouts and invoices.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Amount in BRL (decimal)
debtor	object	—	Optional payer identification (BCB requires CPF/CNPJ to be pre-known for some flows)
description	string	yes	Description shown to payer
expiration	number	yes	QR lifetime in seconds (e.g. 3600 = 1 hour)
pix_key	string	yes	Merchant Pix key the charge settles to
txid	string	—	Optional merchant-side transaction identifier

No output schema declared.

No examples provided.

create_pix_charge_static ~172

Create a static Pix charge (reusable QR code tied to a merchant Pix key). Returns EMV copy-paste payload and QR code image. Use for points-of-sale or donations where the same QR is shown to many payers.

Input Output Examples

Name	Type	Req	Description
amount	number	—	Amount in BRL (decimal, e.g. 10.50). Omit for open-amount QR.
description	string	yes	Free-text description shown to payer
merchant_city	string	—	Merchant city
merchant_name	string	—	Merchant name as it will appear on the QR payload
pix_key	string	yes	Merchant Pix key (CPF, CNPJ, email, phone, or random UUID)
txid	string	—	Optional merchant-side transaction identifier (26-35 alphanumerics)

No output schema declared.

No examples provided.

create_pix_payment ~141

Initiate an outbound Pix transfer (ordem de pagamento). Moves money from a debtor account held on Matera to any Pix key in BR. Returns endToEndId once the BCB SPI confirms.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Amount in BRL (decimal)
creditor_pix_key	string	yes	Destination Pix key (CPF/CNPJ/email/phone/random)
debtor_account	object	yes	Source account held on Matera (ispb, branch, account, account type)
description	string	—	Message shown to the recipient (optional)
idempotency_key	string	—	Merchant-side unique id to prevent double-send on retry

No output schema declared.

No examples provided.

delete_dict_key ~74

Delete a DICT key the merchant owns. After delete, the key is held in BCB's quarentena window before another holder can claim it.

Input Output Examples

Name	Type	Req	Description
key	string	yes	Pix key value to delete
reason	string	—	Optional reason (BCB MotivoExclusao). Default: USER_REQUESTED.

No output schema declared.

No examples provided.

get_account_balance ~71

Get the current balance of a Matera-managed account. Returns available, blocked, and total balance in BRL.

Input Output Examples

Name	Type	Req	Description
account	string	yes	Account number
account_type	string	—	ISO 20022 account type. Defaults to CACC.
branch	string	yes	Branch (agência)

No output schema declared.

No examples provided.

get_account_statement ~137

Get the statement (extrato) of a Matera-managed account in a date range. Returns one entry per credit/debit with counterparty, endToEndId (when applicable), and running balance.

Input Output Examples

Name	Type	Req	Description
account	string	yes	Account number
account_type	string	—	ISO 20022 account type. Defaults to CACC.
branch	string	yes	Branch (agência)
end	string	yes	ISO-8601 end date (exclusive)
limit	number	—	Page size
page	number	—	Page number
start	string	yes	ISO-8601 start date (inclusive)

No output schema declared.

No examples provided.

get_pix_automatico ~70

Retrieve a Pix Automático recurrence by idRec. Returns current status (CRIADA, APROVADA, REJEITADA, CANCELADA), schedule, and last charge attempt.

Input Output Examples

Name	Type	Req	Description
id_rec	string	yes	Recurrence id (idRec) returned by create_pix_automatico

No output schema declared.

No examples provided.

get_pix_charge ~40

Retrieve a Pix charge (static or dynamic) by txid.

Input Output Examples

Name	Type	Req	Description
txid	string	yes	Matera txid returned by create_pix_charge_*

No output schema declared.

No examples provided.

get_pix_charge_due ~45

Retrieve a due-dated Pix charge (BCB GET /cobv/{txid}).

Input Output Examples

Name	Type	Req	Description
txid	string	yes	txid of the cobv charge

No output schema declared.

No examples provided.

get_pix_payment ~51

Retrieve an outbound Pix payment by endToEndId.

Input Output Examples

Name	Type	Req	Description
end_to_end_id	string	yes	32-char BCB endToEndId (E<ispb><yyyyMMddHHmm><random>)

No output schema declared.

No examples provided.

internal_transfer ~125

Book a transfer between two accounts both held on Matera (TED-interno / transferência interna). Settles instantly without touching SPI/Pix rails — no endToEndId, no DICT lookup. Use for moving funds across a fintech's own customer accounts.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Amount in BRL (decimal)
creditor_account	object	yes	—
debtor_account	object	yes	—
description	string	—	Free-text description recorded on both ledger entries
idempotency_key	string	—	Merchant-side unique id to prevent double-debit on retry

No output schema declared.

No examples provided.

list_dict_keys ~40

List DICT keys registered to the merchant's accounts on Matera.

Input Output Examples

Name	Type	Req	Description
account	string	—	Optional filter: return only keys for this account number

No output schema declared.

No examples provided.

list_pix_charges ~189

List immediate Pix charges (BCB /cob) with date and status filters. Use for reconciling QR-driven receipts in a time window.

Input Output Examples

Name	Type	Req	Description
cnpj	string	—	Filter charges where the payer CNPJ equals this value
cpf	string	—	Filter charges where the payer CPF equals this value
end	string	yes	ISO-8601 end timestamp (exclusive). BCB calls this `fim`.
limit	number	—	Page size (BCB max 1000)
page	number	—	Page number (starts at 0 per BCB convention)
start	string	yes	ISO-8601 start timestamp (inclusive). BCB calls this `inicio`.
status	string	—	Filter by status (ATIVA, CONCLUIDA, REMOVIDA_PELO_USUARIO_RECEBEDOR, REMOVIDA_PELO_PSP)

No output schema declared.

No examples provided.

list_pix_payments ~101

List outbound Pix payments with optional filters. Useful for reconciliation and agent-driven audit.

Input Output Examples

Name	Type	Req	Description
end	string	—	ISO-8601 end timestamp (exclusive)
limit	number	—	Page size
page	number	—	Page number (starts at 1)
start	string	—	ISO-8601 start timestamp (inclusive)
status	string	—	Filter by status (e.g. ACSC, RJCT, PDNG)

No output schema declared.

No examples provided.

list_pix_received ~143

List inbound Pix (Pix recebidos) credited to merchant accounts in a date range. Mirrors BCB GET /pix. Filter by txid to find the receipt that closed a specific cob.

Input Output Examples

Name	Type	Req	Description
cnpj	string	—	Filter by payer CNPJ
cpf	string	—	Filter by payer CPF
end	string	yes	ISO-8601 end timestamp (exclusive)
limit	number	—	Page size
page	number	—	Page number (BCB starts at 0)
start	string	yes	ISO-8601 start timestamp (inclusive)
txid	string	—	Only return Pix receipts that closed this txid

No output schema declared.

No examples provided.

refund_pix_payment ~88

Refund (devolução) a Pix payment. Supports full or partial amount. Use reason codes per BCB MED catalog.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Refund amount in BRL. Must be <= original.
end_to_end_id	string	yes	endToEndId of the payment to refund
reason	string	yes	Reason for refund (BCB MED code or free text)

No output schema declared.

No examples provided.

register_dict_key ~121

Register (claim) a DICT key for a merchant account on Matera. For email/phone keys this triggers BCB's confirmation flow; for CPF/CNPJ/random it claims immediately. Subject to BCB DICT rate limits and ownership rules (max 5 keys per CPF, 20 per CNPJ).

Input Output Examples

Name	Type	Req	Description
account	object	yes	Matera-managed account that will own the key
key_type	string	yes	Type of key to register
key_value	string	—	Value (omit for RANDOM — Matera will generate the UUID)

No output schema declared.

No examples provided.

resolve_pix_key ~78

Resolve a Pix DICT key to the account holder's identity and ISPB/branch/account. Use before sending large transfers to verify the counterparty. Note: DICT queries are rate-limited and logged by BCB.

Input Output Examples

Name	Type	Req	Description
key	string	yes	Pix key to resolve (CPF, CNPJ, email, phone, or random UUID)

No output schema declared.

No examples provided.

update_pix_charge ~132

Update an immediate Pix charge (BCB PATCH /cob/{txid}). Use to revise amount/expiration before payment, or to mark a charge REMOVIDA_PELO_USUARIO_RECEBEDOR.

Input Output Examples

Name	Type	Req	Description
amount	number	—	New amount in BRL (only if charge still ATIVA)
description	string	—	New description shown to payer
expiration	number	—	New expiration in seconds from creation
status	string	—	Set to REMOVIDA_PELO_USUARIO_RECEBEDOR to cancel an unpaid charge
txid	string	yes	txid of the existing charge

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 4 Aug