# io.github.codespar/mcp-mercado-pago (npm · @codespar/mcp-mercado-pago)

Mercado Pago — payments, checkout, PIX, refunds for LATAM

- Trust score: 68/100 (medium)
- Change this week: −9
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-05

## Components

- npm · `@codespar/mcp-mercado-pago`: 68/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-mercado-pago/codespar-mcp-mercado-pago.md), [page](https://verifymcp.io/servers/codespar-mcp-mercado-pago/codespar-mcp-mercado-pago)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-mercado-pago`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-05.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 43 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1924 tokens (~64/item across 30 items; 30 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 98/100
  - 97% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-mercado-pago -- npx -y @codespar/mcp-mercado-pago
```

### Codex

```bash
codex mcp add codespar-mcp-mercado-pago -- npx -y @codespar/mcp-mercado-pago
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-mercado-pago": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-mercado-pago"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-mercado-pago --command npx --arg -y --arg @codespar/mcp-mercado-pago
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-mercado-pago:
    command: "npx"
    args: ["-y", "@codespar/mcp-mercado-pago"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-mercado-pago": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-mercado-pago"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-05 (score 68, +1)

- [security improvement] CVE-2026-69207 no longer affects this package
- [security improvement] Known CVEs: fail → partial

### 2026-08-04 (score 67, +4)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.30

### 2026-08-03 (score 63, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 97
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-02 (score 20, −36)

- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] License: pass → unverified
- [functional regression] Maintenance: pass → unverified
- [functional regression] Tool coverage: 97 → unverified
- [functional] Licence: MIT

### 2026-08-01 (score 56, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 41, −6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 47, −30)

- [security regression] Known CVEs: partial → unverified
- [security regression] Malware scan: pass → unverified
- [functional regression] Dependency health: partial → unverified

### 2026-07-29 (score 77, +51)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 97
- [functional] Licence: MIT

## MCP tools (30)

### `create_payment` (~96 tokens)

Create a new payment

Input parameters:

- `amount` (number, required): Payment amount
- `description` (string, required): Payment description
- `installments` (number): Number of installments (default 1)
- `payer_email` (string, required): Payer email address
- `payment_method_id` (string, required): Payment method ID (e.g. pix, credit_card, bolbradesco)
- `token` (string): Card token (for credit card payments)

### `get_payment` (~24 tokens)

Get payment details by ID

Input parameters:

- `paymentId` (string, required): Payment ID

### `search_payments` (~89 tokens)

Search payments with filters

Input parameters:

- `criteria` (string): Sort direction
- `date_from` (string): Start date (ISO 8601)
- `date_to` (string): End date (ISO 8601)
- `limit` (number): Results limit
- `offset` (number): Results offset
- `sort` (string): Sort field
- `status` (string): Payment status

### `create_refund` (~43 tokens)

Refund a payment (full or partial)

Input parameters:

- `amount` (number): Refund amount (omit for full refund)
- `paymentId` (string, required): Payment ID to refund

### `create_preference` (~50 tokens)

Create a checkout preference for Checkout Pro

Input parameters:

- `auto_return` (string): Auto-return mode
- `back_urls` (object): Redirect URLs after payment
- `items` (array, required): Items to sell

### `get_preference` (~25 tokens)

Get checkout preference by ID

Input parameters:

- `preferenceId` (string, required): Preference ID

### `create_customer` (~41 tokens)

Create a customer

Input parameters:

- `email` (string, required): Customer email
- `first_name` (string): First name
- `last_name` (string): Last name

### `list_customers` (~40 tokens)

List customers

Input parameters:

- `email` (string): Filter by email
- `limit` (number): Results limit
- `offset` (number): Results offset

### `get_payment_methods` (~14 tokens)

List available payment methods

### `create_pix_payment` (~85 tokens)

Create a PIX payment

Input parameters:

- `amount` (number, required): Payment amount
- `description` (string, required): Payment description
- `payer_cpf` (string): Payer CPF (identification number)
- `payer_email` (string, required): Payer email
- `payer_first_name` (string): Payer first name
- `payer_last_name` (string): Payer last name

### `get_merchant_order` (~27 tokens)

Get merchant order by ID

Input parameters:

- `orderId` (string, required): Merchant order ID

### `get_balance` (~12 tokens)

Get account balance

### `create_subscription` (~72 tokens)

Create a recurring subscription (preapproval)

Input parameters:

- `auto_recurring` (object, required): Recurring configuration
- `back_url` (string): Return URL after authorization
- `external_reference` (string): External reference ID
- `payer_email` (string, required): Payer email
- `reason` (string, required): Subscription reason/title

### `get_subscription` (~32 tokens)

Get subscription (preapproval) details by ID

Input parameters:

- `preapproval_id` (string, required): Preapproval/subscription ID

### `cancel_subscription` (~29 tokens)

Cancel a subscription (preapproval)

Input parameters:

- `preapproval_id` (string, required): Preapproval/subscription ID

### `create_card_token` (~76 tokens)

Tokenize a card for secure payments

Input parameters:

- `card_number` (string, required): Card number
- `cardholder` (object, required): Cardholder info
- `expiration_month` (string, required): Expiration month (MM)
- `expiration_year` (string, required): Expiration year (YYYY)
- `security_code` (string, required): CVV security code

### `get_payment_method_details` (~44 tokens)

Get details of a specific payment method by ID

Input parameters:

- `payment_method_id` (string, required): Payment method ID (e.g. visa, pix, bolbradesco)

### `create_store` (~58 tokens)

Create a store (physical location or POS group)

Input parameters:

- `business_hours` (object): Business hours configuration
- `external_id` (string): External reference ID
- `location` (object): Store location
- `name` (string, required): Store name

### `list_stores` (~42 tokens)

List stores

Input parameters:

- `external_id` (string): Filter by external ID
- `limit` (number): Results limit
- `offset` (number): Results offset

### `create_pos` (~93 tokens)

Create a point of sale (POS) linked to a store

Input parameters:

- `category` (number): MCC category code
- `external_id` (string, required): External reference ID
- `external_store_id` (string): External store reference
- `fixed_amount` (boolean): Whether the POS has a fixed amount
- `name` (string, required): POS name
- `store_id` (string): Store ID to link this POS to

### `update_subscription` (~99 tokens)

Update a subscription (preapproval) — amount, status, reason, card token, etc.

Input parameters:

- `auto_recurring` (object): Updated recurring configuration
- `card_token_id` (string): New card token to charge
- `external_reference` (string): New external reference
- `preapproval_id` (string, required): Preapproval/subscription ID
- `reason` (string): New subscription reason/title
- `status` (string): New subscription status

### `oauth_token_exchange` (~136 tokens)

Exchange an authorization code for a seller access token (marketplace onboarding). Also supports refresh_token grant.

Input parameters:

- `client_id` (string, required): Marketplace application client_id
- `client_secret` (string, required): Marketplace application client_secret
- `code` (string): Authorization code returned from /authorization (required for authorization_code)
- `code_verifier` (string): PKCE code verifier (optional)
- `grant_type` (string): OAuth grant type (default authorization_code)
- `redirect_uri` (string): Redirect URI registered with the app (required for authorization_code)
- `refresh_token` (string): Refresh token (required for refresh_token grant)

### `create_advanced_payment` (~143 tokens)

Create a marketplace split payment with per-recipient disbursements (application_fee, money_release_days, collector_id per seller)

Input parameters:

- `additional_info` (object): Additional info (items, shipments, payer details)
- `binary_mode` (boolean): If true, payment is approved or rejected (no pending)
- `capture` (boolean): Whether to capture the payment immediately
- `description` (string): Payment description
- `disbursements` (array, required): Split rules per seller
- `external_reference` (string): External reference ID
- `payer` (object, required): Buyer information
- `payments` (array, required): Buyer's payment methods covering the total amount

### `get_advanced_payment` (~32 tokens)

Get an advanced (split) payment by ID

Input parameters:

- `advanced_payment_id` (string, required): Advanced payment ID

### `get_chargeback` (~32 tokens)

Get chargeback details by ID

Input parameters:

- `chargeback_id` (string, required): Chargeback ID (or payment ID)

### `upload_chargeback_evidence` (~68 tokens)

Upload documentation/evidence for a chargeback dispute. Accepts one or more files as base64 content.

Input parameters:

- `chargeback_id` (string, required): Chargeback ID
- `files` (array, required): Files to upload (.jpg, .png, .pdf; 10MB total max)

### `get_identification_types` (~45 tokens)

Get document/identification types available per country (CPF, CNPJ, DNI, RUT, etc.). Use the seller's access token — response is country-scoped.

### `get_payment_methods_by_site` (~69 tokens)

List available payment methods for a specific Mercado Pago site (MLB=Brazil, MLA=Argentina, MLM=Mexico, MLC=Chile, MCO=Colombia, MPE=Peru, MLU=Uruguay)

Input parameters:

- `site_id` (string, required): Marketplace site ID

### `create_settlement_report` (~107 tokens)

Manually generate a settlement (account money) report for a date range. Returns 202; poll the report list endpoint to download when ready.

Input parameters:

- `begin_date` (string, required): Start date, ISO 8601 UTC (e.g. 2026-04-01T00:00:00Z)
- `end_date` (string, required): End date, ISO 8601 UTC (e.g. 2026-04-30T23:59:59Z)

### `search_merchant_orders` (~134 tokens)

Search merchant orders with filters (last 90 days). Useful for reconciliation of Checkout Pro / Bricks flows.

Input parameters:

- `application_id` (string): Filter by application ID
- `external_reference` (string): Filter by external reference
- `limit` (number): Results limit
- `offset` (number): Results offset
- `payer_id` (string): Filter by payer (buyer) user ID
- `preference_id` (string): Filter by preference ID
- `sponsor_id` (string): Filter by marketplace sponsor user ID
- `status` (string): Order status (e.g. opened, closed, expired)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-mercado-pago/codespar-mcp-mercado-pago#diagnostics

## Score history

- 2026-08-05: 68
- 2026-08-04: 67
- 2026-08-03: 63
- 2026-08-02: 20
- 2026-08-01: 56
- 2026-07-31: 41
- 2026-07-30: 47
- 2026-07-29: 77
- 2026-07-28: 26
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-mercado-pago
- Socket report: https://socket.dev/npm/package/@codespar/mcp-mercado-pago
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-mercado-pago/codespar-mcp-mercado-pago/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-mercado-pago/codespar-mcp-mercado-pago/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-mercado-pago/codespar-mcp-mercado-pago