io.github.codespar/mcp-nupay

NPM · @CODESPAR/MCP-NUPAY · SCANNED AUG 6

MCP server for NuPay — Nubank merchant checkout: Pix + wallet one-click for 100M+ BR users

Available components

+22 this week 68 68 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security86

No malware found by supply-chain analysis.Pass
Known CVEs were checked across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Dependency health was assessed across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 44 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability66

AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 1882 tokens (~85/item across 22 items; 22 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management37

Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage95

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
85% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @codespar/mcp-nupay

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add codespar-mcp-nupay -- npx -y @codespar/mcp-nupay

# add to Codex CLI

codex mcp add codespar-mcp-nupay -- npx -y @codespar/mcp-nupay

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-nupay": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-nupay"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add codespar-mcp-nupay --command npx --arg -y --arg @codespar/mcp-nupay

# ~/.hermes/config.yaml

mcp_servers:
  codespar-mcp-nupay:
    command: "npx"
    args: ["-y", "@codespar/mcp-nupay"]

// mcp.json

{
  "mcpServers": {
    "codespar-mcp-nupay": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-nupay"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

6 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
5 Aug 26 +1
- CVE-2026-69207 no longer affects this package ▲ security
- Known CVEs: fail → partial ▲ security
4 Aug 26 −1
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +18
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 +27
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → good ▲ functional
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 6 Aug 2026 · Analysed npm/@codespar/[email protected]

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	npm

Dependencies 94 packages

Packages resolved	94
Deprecated	94
Stale	29
Tree resolution	Partial

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 22 exposed · ~1,815 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

backchannel_complete ~79

Complete a CIBA/OTP flow by submitting the OTP the shopper received. Returns the access_token once validated.

Input Output Examples

Name	Type	Req	Description
otp	string	yes	One-time password provided by the shopper
parameters	string	yes	Query-string with login_hint, client_assertion_type, client_assertion
ticket	string	yes	Authorization ticket from backchannel_start

No output schema declared.

No examples provided.

backchannel_resend_otp ~60

Resend the OTP to the shopper for an in-flight authorization ticket.

Input Output Examples

Name	Type	Req	Description
parameters	string	yes	Query-string with login_hint, client_assertion_type, client_assertion
ticket	string	yes	Authorization ticket from backchannel_start

No output schema declared.

No examples provided.

backchannel_start ~103

Start a CIBA / OTP pre-authorization for a shopper. Sends a push to Nubank app (CIBA) or triggers an OTP SMS. Returns an auth_req_id/ticket to complete later.

Input Output Examples

Name	Type	Req	Description
parameters	string	yes	Query-string-encoded params: login_hint (CPF), client_assertion_type, client_assertion (signed JWT), client_notification_token, scope (e.g. 'openid charge'), auth_method ('otp' or omit for CIBA)

No output schema declared.

No examples provided.

cancel_payment ~37

Cancel a payment that has not yet been captured/settled.

Input Output Examples

Name	Type	Req	Description
pspReferenceId	string	yes	NuPay-assigned payment id

No output schema declared.

No examples provided.

create_payment ~249

Create a NuPay checkout payment. Returns pspReferenceId + the redirect/QR payload the shopper needs to complete the charge (NuPay wallet push or Pix). Use merchant-key auth.

Input Output Examples

Name	Type	Req	Description
amount	object	yes	Payment amount object
billingAddress	object	—	Billing address
callbackUrl	string	—	HTTPS webhook URL for status notifications
delayToAutoCancel	number	—	Minutes before auto-cancel. Default 30.
installments	number	—	Installment count (pre-authorized only)
items	array	yes	Line items purchased
merchantName	string	—	—
merchantOrderReference	string	yes	Merchant-side order id (unique per merchant)
paymentFlow	object	—	Return / cancel URLs for redirect flows
paymentMethod	object	yes	Method selection
recipients	array	—	Up to 10 final beneficiaries (regulatory split)
referenceDate	string	—	ISO-8601 timestamp
referenceId	string	yes	E-commerce payment reference id (unique per merchant)
shipping	object	—	Shipping address + method
shopper	object	yes	Customer identity
storeName	string	—	—

No output schema declared.

No examples provided.

create_preauth_payment ~80

Create a NuPay payment using a pre-authorized Bearer access_token (pre-auth / recurrence flow). Same body as create_payment, but auth is Bearer instead of merchant-key. Use after exchange_token.

Input Output Examples

Name	Type	Req	Description
access_token	string	yes	Bearer access_token from exchange_token
payment	object	yes	Same body as create_payment

No output schema declared.

No examples provided.

create_recipient ~136

Register a final beneficiary (required for regulatory split payments). Up to 10 recipients can later be attached to a payment.

Input Output Examples

Name	Type	Req	Description
country	string	yes	ISO 3166-1 alpha-2 (BR, MX, CO, US, HK, KY, PA, CH, Other)
document	string	yes	11-digit CPF, 14-digit CNPJ, or max 50 chars for Other
documentType	string	yes	—
name	string	yes	Business or full name
referenceId	string	yes	Merchant-side stable beneficiary id (1-50 chars, alphanumeric plus . - _)

No output schema declared.

No examples provided.

create_refund ~77

Refund a settled payment (full or partial). Idempotent via transactionRefundId.

Input Output Examples

Name	Type	Req	Description
amount	object	yes	Refund value + currency
notes	string	—	Free-text reason
pspReferenceId	string	yes	NuPay-assigned payment id
transactionRefundId	string	yes	Merchant-side unique refund id

No output schema declared.

No examples provided.

delete_recipient ~40

Remove a registered recipient. Will fail if the recipient is currently attached to in-flight payments.

Input Output Examples

Name	Type	Req	Description
referenceId	string	yes	Recipient referenceId to delete

No output schema declared.

No examples provided.

exchange_token ~202

Exchange an authorization_code or refresh_token at POST /v1/token. Expects an already-signed JWT client_assertion. Returns access_token (5 min) + refresh_token for recurrence. Access tokens are scoped (openid, charge, refund, payment_conditions).

Input Output Examples

Name	Type	Req	Description
client_assertion	string	yes	Signed JWT assertion
client_assertion_type	string	yes	Always 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
code	string	—	Authorization code (when grant_type=authorization_code)
code_verifier	string	—	PKCE verifier (when grant_type=authorization_code)
grant_type	string	yes	—
redirect_uri	string	—	Redirect URI used at /v1/authorize (when grant_type=authorization_code)
refresh_token	string	—	Refresh token (when grant_type=refresh_token)
scope	string	—	Space-separated scopes (openid charge refund payment_conditions)

No output schema declared.

No examples provided.

get_payment ~56

Retrieve full payment details (amount, shopper, items, current status, timestamps) by pspReferenceId. Use this for richer detail than get_payment_status.

Input Output Examples

Name	Type	Req	Description
pspReferenceId	string	yes	NuPay-assigned payment id

No output schema declared.

No examples provided.

get_payment_status ~36

Retrieve a payment's status by pspReferenceId.

Input Output Examples

Name	Type	Req	Description
pspReferenceId	string	yes	NuPay-assigned payment id

No output schema declared.

No examples provided.

get_recipient ~25

Retrieve a registered recipient by referenceId.

Input Output Examples

Name	Type	Req	Description
referenceId	string	yes	—

No output schema declared.

No examples provided.

get_refund ~45

Retrieve refund status by pspReferenceId + refundId.

Input Output Examples

Name	Type	Req	Description
pspReferenceId	string	yes	—
refundId	string	yes	NuPay-assigned refund id

No output schema declared.

No examples provided.

get_settlement ~39

Retrieve a single settlement (payout batch) including the list of underlying transactions.

Input Output Examples

Name	Type	Req	Description
settlementId	string	yes	NuPay-assigned settlement id

No output schema declared.

No examples provided.

list_payments_by_date ~112

List payments created within a date range. Supports cursor pagination via limit + offset. Useful for reconciliation and reporting.

Input Output Examples

Name	Type	Req	Description
endDate	string	yes	ISO-8601 end (inclusive)
limit	number	—	Page size (default 50)
offset	number	—	Page offset
startDate	string	yes	ISO-8601 start (inclusive)
status	string	—	Optional filter (e.g. AUTHORIZED, SETTLED, CANCELED, REFUNDED)

No output schema declared.

No examples provided.

list_recipients ~46

List registered recipients (final beneficiaries) for the merchant. Supports pagination.

Input Output Examples

Name	Type	Req	Description
limit	number	—	Page size (default 50)
offset	number	—	Page offset

No output schema declared.

No examples provided.

list_refunds ~34

List all refunds issued against a given payment.

Input Output Examples

Name	Type	Req	Description
pspReferenceId	string	yes	NuPay-assigned payment id

No output schema declared.

No examples provided.

list_settlements ~76

List settlement reports (payouts to the merchant bank account) within a date range. Use for reconciliation.

Input Output Examples

Name	Type	Req	Description
endDate	string	yes	ISO-8601 end (inclusive)
limit	number	—	—
offset	number	—	—
startDate	string	yes	ISO-8601 start (inclusive)

No output schema declared.

No examples provided.

query_payment_conditions ~81

Query available installment/payment conditions for a given amount and (optionally) shopper CPF. Use before rendering checkout so the agent can pick the best offer.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Purchase value in cents
document	string	—	Shopper CPF (required outside pre-authorized flow)
paymentMethods	array	—	Optional — scope conditions to specific methods

No output schema declared.

No examples provided.

revoke_token ~118

Revoke an issued access_token or refresh_token at POST /v1/token/revoke. Use to terminate a recurrence mandate or after card-token deletion. Form-encoded; expects a signed JWT client_assertion.

Input Output Examples

Name	Type	Req	Description
client_assertion	string	yes	Signed JWT assertion
client_assertion_type	string	yes	Always 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
token	string	yes	The access_token or refresh_token to revoke
token_type_hint	string	—	Optional hint

No output schema declared.

No examples provided.

update_recipient ~84

Update a registered final beneficiary (name, document, country, type). referenceId is the path key and cannot be changed.

Input Output Examples

Name	Type	Req	Description
country	string	—	ISO 3166-1 alpha-2
document	string	—	—
documentType	string	—	—
name	string	—	—
referenceId	string	yes	Existing recipient referenceId

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 6 Aug

Day	Score
27 Jul	46
28 Jul	46
30 Jul	46
31 Jul	21
1 Aug	48
2 Aug	66
3 Aug	67
4 Aug	66
5 Aug	67
6 Aug	68