# io.github.codespar/mcp-moonpay (npm · @codespar/mcp-moonpay)

MCP server for MoonPay — fiat-to-crypto on/off-ramp, 100+ assets; Pix for Brazil onramp

- Trust score: 69/100 (medium)
- Change this week: +24
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-moonpay`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-moonpay/codespar-mcp-moonpay.md), [page](https://verifymcp.io/servers/codespar-mcp-moonpay/codespar-mcp-moonpay)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-moonpay`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2489 tokens (~124/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-moonpay -- npx -y @codespar/mcp-moonpay
```

### Codex

```bash
codex mcp add codespar-mcp-moonpay -- npx -y @codespar/mcp-moonpay
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-moonpay": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-moonpay"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-moonpay --command npx --arg -y --arg @codespar/mcp-moonpay
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-moonpay:
    command: "npx"
    args: ["-y", "@codespar/mcp-moonpay"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-moonpay": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-moonpay"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, 0)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-02 (score 69, +29)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 40, +4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 36, +10)

- [security regression] Provenance: unverified → fail
- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-07-29 (score 26, −19)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (20)

### `get_buy_quote` (~207 tokens)

Preview a fiat -> crypto buy quote in real time. Use this before create_buy_transaction to show the end user the exact crypto amount, fees, and effective rate.

Input parameters:

- `areFeesIncluded` (boolean): If true, baseCurrencyAmount includes MoonPay fees.
- `baseCurrencyAmount` (number): Amount in fiat to spend (major units). Either this or quoteCurrencyAmount must be supplied.
- `baseCurrencyCode` (string, required): Fiat currency you are paying with (e.g. usd, eur, brl, mxn)
- `currencyCode` (string, required): Crypto currency code you want to buy (e.g. btc, eth, usdc, sol). Must be a code returned by list_currencies.
- `paymentMethod` (string): Optional payment method hint (e.g. credit_debit_card, sepa_bank_transfer, pix)
- `quoteCurrencyAmount` (number): Amount of crypto to receive (major units). Either this or baseCurrencyAmount must be supplied.

### `create_buy_transaction` (~248 tokens)

Create a buy transaction (fiat -> crypto). The returned object contains status plus — depending on method — redirect URL for hosted checkout, Pix QR data, or card auth next steps.

Input parameters:

- `baseCurrencyAmount` (number, required): Fiat amount to charge (major units)
- `baseCurrencyCode` (string, required): Fiat currency code (e.g. brl, usd)
- `currencyCode` (string, required): Crypto currency code to receive (e.g. btc, usdc)
- `customerId` (string): Existing MoonPay customer id (use create_customer first)
- `externalCustomerId` (string): Your internal user id, propagated to MoonPay for reconciliation
- `externalTransactionId` (string): Your internal transaction reference
- `extraFields` (object): Additional provider-specific fields passed through as-is
- `paymentMethod` (string): Payment method (e.g. credit_debit_card, sepa_bank_transfer, pix)
- `returnUrl` (string): Browser redirect after hosted flow completes
- `walletAddress` (string, required): Destination crypto wallet address
- `walletAddressTag` (string): Destination tag / memo (for chains that require it, e.g. XRP, XLM)

### `get_buy_transaction` (~43 tokens)

Retrieve a buy transaction (fiat -> crypto) by its MoonPay id. Returns current status and settlement detail.

Input parameters:

- `id` (string, required): MoonPay transaction id

### `list_buy_transactions` (~86 tokens)

List buy transactions with optional filters. Used for reconciliation and agent-driven monitoring.

Input parameters:

- `customerId` (string): Filter to a single MoonPay customer id
- `externalCustomerId` (string): Filter to your internal user id
- `limit` (number): Max results to return
- `status` (string): Filter by transaction status (e.g. pending, completed, failed)

### `get_sell_quote` (~167 tokens)

Preview a crypto -> fiat sell quote in real time. Use this before create_sell_transaction to show the end user the exact fiat amount, fees, and effective rate.

Input parameters:

- `baseCurrencyAmount` (number): Crypto amount to sell (major units). Either this or quoteCurrencyAmount must be supplied.
- `currencyCode` (string, required): Crypto currency code you want to sell (e.g. btc, usdc)
- `payoutMethod` (string): Optional payout method hint (e.g. sepa_bank_transfer, credit_debit_card, pix)
- `quoteCurrencyAmount` (number): Fiat amount to receive (major units). Either this or baseCurrencyAmount must be supplied.
- `quoteCurrencyCode` (string, required): Fiat currency to receive (e.g. usd, eur, brl)

### `create_sell_transaction` (~199 tokens)

Create a sell transaction (crypto -> fiat). Used for agents that need to pay out in local fiat after receiving crypto.

Input parameters:

- `bankAccount` (object): Destination bank account detail (country-specific fields)
- `baseCurrencyAmount` (number, required): Crypto amount to sell (major units)
- `baseCurrencyCode` (string, required): Crypto currency code (e.g. btc, usdc)
- `customerId` (string): MoonPay customer id receiving the fiat payout
- `externalCustomerId` (string): Your internal user id
- `externalTransactionId` (string): Your internal transaction reference
- `extraFields` (object): Additional provider-specific fields passed through as-is
- `payoutMethod` (string): Fiat payout method (e.g. sepa_bank_transfer, pix)
- `quoteCurrencyCode` (string, required): Fiat currency to receive (e.g. usd, brl)
- `returnUrl` (string): Browser redirect after hosted flow completes

### `get_sell_transaction` (~36 tokens)

Retrieve a sell transaction (crypto -> fiat) by its MoonPay id.

Input parameters:

- `id` (string, required): MoonPay sell transaction id

### `refund_sell_transaction` (~99 tokens)

Request a refund on an off-ramp (sell) transaction. Used when the destination bank rejects payout or the user disputes the trade. Reason codes are MoonPay-defined.

Input parameters:

- `amount` (number): Optional partial refund amount (in the transaction's base/crypto currency). Omit for full refund.
- `id` (string, required): MoonPay sell transaction id to refund
- `reason` (string): Reason code or free-text justification for the refund

### `create_customer` (~113 tokens)

Create a MoonPay customer (KYC'd end user). Required before creating transactions that must be tied to an identified individual.

Input parameters:

- `address` (object): Residential address object
- `dateOfBirth` (string): ISO date (YYYY-MM-DD)
- `email` (string, required): Customer email (used for MoonPay communications + KYC)
- `externalCustomerId` (string): Your internal user id for correlation
- `firstName` (string): Legal first name
- `lastName` (string): Legal last name

### `get_customer` (~27 tokens)

Retrieve a MoonPay customer by id.

Input parameters:

- `id` (string, required): MoonPay customer id

### `get_customer_kyc_status` (~54 tokens)

Fetch KYC verification status (and any pending document requirements) for a MoonPay customer. Use to gate flows that require an approved customer before transacting.

Input parameters:

- `id` (string, required): MoonPay customer id

### `list_customer_transactions` (~77 tokens)

List all transactions (buy + sell) tied to a single MoonPay customer. Convenience wrapper for unified history / reconciliation by user.

Input parameters:

- `customerId` (string, required): MoonPay customer id
- `limit` (number): Max results to return
- `status` (string): Optional status filter (e.g. pending, completed, failed)

### `get_transaction_receipt` (~70 tokens)

Fetch a tax-/audit-grade receipt for a completed buy or sell transaction. Useful for end-user reporting or accounting export.

Input parameters:

- `id` (string, required): MoonPay transaction id (buy or sell)
- `type` (string): Whether the id refers to a buy or sell transaction. Defaults to buy.

### `list_currencies` (~71 tokens)

List supported currencies (fiat + crypto). Essential for agents: use this to discover currency codes dynamically rather than hard-coding, and to check which assets/fiats are currently enabled.

Input parameters:

- `show` (string): Filter to enabled currencies only, or return everything. Defaults to enabled on the API side.

### `get_currency` (~61 tokens)

Retrieve metadata for a single currency (fiat or crypto) by its MoonPay code. Returns network, decimals, min/max amounts, fee structure.

Input parameters:

- `currencyCode` (string, required): Currency code (e.g. btc, usdc, brl, usd)

### `list_countries` (~41 tokens)

List countries supported by MoonPay along with which flows (buy / sell / NFT) are allowed per geography. Use this to gate UI before initiating a quote.

### `list_payment_methods` (~90 tokens)

List payment methods supported for a given fiat currency / country combination (e.g. credit_debit_card, sepa_bank_transfer, pix). Use to populate checkout selectors dynamically.

Input parameters:

- `country` (string): ISO-3166 alpha-2 country code (e.g. BR, US, MX)
- `currencyCode` (string): Fiat currency code (e.g. brl, usd, eur)

### `get_user_country` (~84 tokens)

Resolve the caller's (or a given IP's) country via MoonPay's IP-address geolocation endpoint. Returns ISO alpha-2 + alpha-3 country, plus state for US. Compliance helper to gate flows by jurisdiction before quoting or creating a transaction.

Input parameters:

- `ipAddress` (string): Optional IP to check. If omitted, MoonPay resolves from the request origin.

### `sign_buy_url` (~353 tokens)

Build and HMAC-SHA256 sign a MoonPay buy widget URL (buy.moonpay.com). Returns a ready-to-redirect URL with the merchant's apiKey + signature appended. Requires MOONPAY_PUBLISHABLE_KEY and MOONPAY_SECRET_KEY in the environment. Use when embedding the hosted onramp in your own UI.

Input parameters:

- `baseCurrencyAmount` (number): Pre-fill fiat amount
- `baseCurrencyCode` (string): Fiat currency code (e.g. usd, brl)
- `colorCode` (string): Hex accent color for the widget
- `currencyCode` (string, required): Crypto currency code to buy (e.g. btc, usdc)
- `email` (string): Pre-fill end-user email
- `externalCustomerId` (string): Your internal user id, propagated to MoonPay
- `externalTransactionId` (string): Your internal transaction reference
- `extraParams` (object): Additional widget parameters passed through as-is (object values are JSON-stringified)
- `language` (string): BCP-47 language tag (e.g. en, pt-BR)
- `paymentMethod` (string): Pre-select payment method (e.g. credit_debit_card, pix)
- `quoteCurrencyAmount` (number): Pre-fill crypto amount
- `redirectURL` (string): Where to redirect after the hosted flow completes
- `showWalletAddressForm` (boolean): If true, force the widget to show the wallet form even when prefilled
- `theme` (string): Widget theme (light / dark)
- `walletAddress` (string): Pre-fill destination wallet address
- `walletAddressTag` (string): Destination tag / memo for chains that require it

### `sign_sell_url` (~296 tokens)

Build and HMAC-SHA256 sign a MoonPay sell widget URL (sell.moonpay.com). Returns a ready-to-redirect URL with apiKey + signature appended. Requires MOONPAY_PUBLISHABLE_KEY and MOONPAY_SECRET_KEY in the environment.

Input parameters:

- `baseCurrencyAmount` (number): Pre-fill crypto amount
- `baseCurrencyCode` (string, required): Crypto currency code being sold (e.g. btc, usdc)
- `colorCode` (string): Hex accent color for the widget
- `email` (string): Pre-fill end-user email
- `externalCustomerId` (string): Your internal user id
- `externalTransactionId` (string): Your internal transaction reference
- `extraParams` (object): Additional widget parameters passed through as-is (object values are JSON-stringified)
- `language` (string): BCP-47 language tag (e.g. en, pt-BR)
- `payoutMethod` (string): Pre-select payout method (e.g. sepa_bank_transfer, pix)
- `quoteCurrencyAmount` (number): Pre-fill fiat amount
- `quoteCurrencyCode` (string): Fiat currency to receive (e.g. usd, brl)
- `redirectURL` (string): Where to redirect after the hosted flow completes
- `refundWalletAddress` (string): Wallet to refund crypto to if the sell fails
- `theme` (string): Widget theme (light / dark)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-moonpay/codespar-mcp-moonpay#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 69
- 2026-08-02: 69
- 2026-08-01: 40
- 2026-07-31: 36
- 2026-07-29: 26
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-moonpay
- Socket report: https://socket.dev/npm/package/@codespar/mcp-moonpay
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-moonpay/codespar-mcp-moonpay/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-moonpay/codespar-mcp-moonpay/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-moonpay/codespar-mcp-moonpay