# io.github.codespar/mcp-nupay (npm · @codespar/mcp-nupay)

MCP server for NuPay — Nubank merchant checkout: Pix + wallet one-click for 100M+ BR users

- Trust score: 68/100 (medium)
- Change this week: +22
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-06

## Components

- npm · `@codespar/mcp-nupay`: 68/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-nupay/codespar-mcp-nupay.md), [page](https://verifymcp.io/servers/codespar-mcp-nupay/codespar-mcp-nupay)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-nupay`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-06.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Known CVEs were checked across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 94 of 98 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 44 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1882 tokens (~85/item across 22 items; 22 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 37/100
  - Stability observed for 11 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 85% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-nupay -- npx -y @codespar/mcp-nupay
```

### Codex

```bash
codex mcp add codespar-mcp-nupay -- npx -y @codespar/mcp-nupay
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-nupay": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-nupay"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-nupay --command npx --arg -y --arg @codespar/mcp-nupay
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-nupay:
    command: "npx"
    args: ["-y", "@codespar/mcp-nupay"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-nupay": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-nupay"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-06 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-05 (score 67, +1)

- [security improvement] CVE-2026-69207 no longer affects this package
- [security improvement] Known CVEs: fail → partial

### 2026-08-04 (score 66, −1)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 66, +18)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 48, +27)

- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good

### 2026-07-31 (score 21, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (22)

### `create_payment` (~249 tokens)

Create a NuPay checkout payment. Returns pspReferenceId + the redirect/QR payload the shopper needs to complete the charge (NuPay wallet push or Pix). Use merchant-key auth.

Input parameters:

- `amount` (object, required): Payment amount object
- `billingAddress` (object): Billing address
- `callbackUrl` (string): HTTPS webhook URL for status notifications
- `delayToAutoCancel` (number): Minutes before auto-cancel. Default 30.
- `installments` (number): Installment count (pre-authorized only)
- `items` (array, required): Line items purchased
- `merchantName` (string)
- `merchantOrderReference` (string, required): Merchant-side order id (unique per merchant)
- `paymentFlow` (object): Return / cancel URLs for redirect flows
- `paymentMethod` (object, required): Method selection
- `recipients` (array): Up to 10 final beneficiaries (regulatory split)
- `referenceDate` (string): ISO-8601 timestamp
- `referenceId` (string, required): E-commerce payment reference id (unique per merchant)
- `shipping` (object): Shipping address + method
- `shopper` (object, required): Customer identity
- `storeName` (string)

### `get_payment` (~56 tokens)

Retrieve full payment details (amount, shopper, items, current status, timestamps) by pspReferenceId. Use this for richer detail than get_payment_status.

Input parameters:

- `pspReferenceId` (string, required): NuPay-assigned payment id

### `get_payment_status` (~36 tokens)

Retrieve a payment's status by pspReferenceId.

Input parameters:

- `pspReferenceId` (string, required): NuPay-assigned payment id

### `list_payments_by_date` (~112 tokens)

List payments created within a date range. Supports cursor pagination via limit + offset. Useful for reconciliation and reporting.

Input parameters:

- `endDate` (string, required): ISO-8601 end (inclusive)
- `limit` (number): Page size (default 50)
- `offset` (number): Page offset
- `startDate` (string, required): ISO-8601 start (inclusive)
- `status` (string): Optional filter (e.g. AUTHORIZED, SETTLED, CANCELED, REFUNDED)

### `cancel_payment` (~37 tokens)

Cancel a payment that has not yet been captured/settled.

Input parameters:

- `pspReferenceId` (string, required): NuPay-assigned payment id

### `create_refund` (~77 tokens)

Refund a settled payment (full or partial). Idempotent via transactionRefundId.

Input parameters:

- `amount` (object, required): Refund value + currency
- `notes` (string): Free-text reason
- `pspReferenceId` (string, required): NuPay-assigned payment id
- `transactionRefundId` (string, required): Merchant-side unique refund id

### `get_refund` (~45 tokens)

Retrieve refund status by pspReferenceId + refundId.

Input parameters:

- `pspReferenceId` (string, required)
- `refundId` (string, required): NuPay-assigned refund id

### `list_refunds` (~34 tokens)

List all refunds issued against a given payment.

Input parameters:

- `pspReferenceId` (string, required): NuPay-assigned payment id

### `create_recipient` (~136 tokens)

Register a final beneficiary (required for regulatory split payments). Up to 10 recipients can later be attached to a payment.

Input parameters:

- `country` (string, required): ISO 3166-1 alpha-2 (BR, MX, CO, US, HK, KY, PA, CH, Other)
- `document` (string, required): 11-digit CPF, 14-digit CNPJ, or max 50 chars for Other
- `documentType` (string, required)
- `name` (string, required): Business or full name
- `referenceId` (string, required): Merchant-side stable beneficiary id (1-50 chars, alphanumeric plus . - _)

### `get_recipient` (~25 tokens)

Retrieve a registered recipient by referenceId.

Input parameters:

- `referenceId` (string, required)

### `update_recipient` (~84 tokens)

Update a registered final beneficiary (name, document, country, type). referenceId is the path key and cannot be changed.

Input parameters:

- `country` (string): ISO 3166-1 alpha-2
- `document` (string)
- `documentType` (string)
- `name` (string)
- `referenceId` (string, required): Existing recipient referenceId

### `delete_recipient` (~40 tokens)

Remove a registered recipient. Will fail if the recipient is currently attached to in-flight payments.

Input parameters:

- `referenceId` (string, required): Recipient referenceId to delete

### `list_recipients` (~46 tokens)

List registered recipients (final beneficiaries) for the merchant. Supports pagination.

Input parameters:

- `limit` (number): Page size (default 50)
- `offset` (number): Page offset

### `list_settlements` (~76 tokens)

List settlement reports (payouts to the merchant bank account) within a date range. Use for reconciliation.

Input parameters:

- `endDate` (string, required): ISO-8601 end (inclusive)
- `limit` (number)
- `offset` (number)
- `startDate` (string, required): ISO-8601 start (inclusive)

### `get_settlement` (~39 tokens)

Retrieve a single settlement (payout batch) including the list of underlying transactions.

Input parameters:

- `settlementId` (string, required): NuPay-assigned settlement id

### `query_payment_conditions` (~81 tokens)

Query available installment/payment conditions for a given amount and (optionally) shopper CPF. Use before rendering checkout so the agent can pick the best offer.

Input parameters:

- `amount` (number, required): Purchase value in cents
- `document` (string): Shopper CPF (required outside pre-authorized flow)
- `paymentMethods` (array): Optional — scope conditions to specific methods

### `create_preauth_payment` (~80 tokens)

Create a NuPay payment using a pre-authorized Bearer access_token (pre-auth / recurrence flow). Same body as create_payment, but auth is Bearer instead of merchant-key. Use after exchange_token.

Input parameters:

- `access_token` (string, required): Bearer access_token from exchange_token
- `payment` (object, required): Same body as create_payment

### `backchannel_start` (~103 tokens)

Start a CIBA / OTP pre-authorization for a shopper. Sends a push to Nubank app (CIBA) or triggers an OTP SMS. Returns an auth_req_id/ticket to complete later.

Input parameters:

- `parameters` (string, required): Query-string-encoded params: login_hint (CPF), client_assertion_type, client_assertion (signed JWT), client_notification_token, scope (e.g. 'openid charge'), auth_method ('otp' or omit for CIBA)

### `backchannel_complete` (~79 tokens)

Complete a CIBA/OTP flow by submitting the OTP the shopper received. Returns the access_token once validated.

Input parameters:

- `otp` (string, required): One-time password provided by the shopper
- `parameters` (string, required): Query-string with login_hint, client_assertion_type, client_assertion
- `ticket` (string, required): Authorization ticket from backchannel_start

### `backchannel_resend_otp` (~60 tokens)

Resend the OTP to the shopper for an in-flight authorization ticket.

Input parameters:

- `parameters` (string, required): Query-string with login_hint, client_assertion_type, client_assertion
- `ticket` (string, required): Authorization ticket from backchannel_start

### `exchange_token` (~202 tokens)

Exchange an authorization_code or refresh_token at POST /v1/token. Expects an already-signed JWT client_assertion. Returns access_token (5 min) + refresh_token for recurrence. Access tokens are scoped (openid, charge, refund, payment_conditions).

Input parameters:

- `client_assertion` (string, required): Signed JWT assertion
- `client_assertion_type` (string, required): Always 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
- `code` (string): Authorization code (when grant_type=authorization_code)
- `code_verifier` (string): PKCE verifier (when grant_type=authorization_code)
- `grant_type` (string, required)
- `redirect_uri` (string): Redirect URI used at /v1/authorize (when grant_type=authorization_code)
- `refresh_token` (string): Refresh token (when grant_type=refresh_token)
- `scope` (string): Space-separated scopes (openid charge refund payment_conditions)

### `revoke_token` (~118 tokens)

Revoke an issued access_token or refresh_token at POST /v1/token/revoke. Use to terminate a recurrence mandate or after card-token deletion. Form-encoded; expects a signed JWT client_assertion.

Input parameters:

- `client_assertion` (string, required): Signed JWT assertion
- `client_assertion_type` (string, required): Always 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
- `token` (string, required): The access_token or refresh_token to revoke
- `token_type_hint` (string): Optional hint

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-nupay/codespar-mcp-nupay#diagnostics

## Score history

- 2026-08-06: 68
- 2026-08-05: 67
- 2026-08-04: 66
- 2026-08-03: 67
- 2026-08-02: 66
- 2026-08-01: 48
- 2026-07-31: 21
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-nupay
- Socket report: https://socket.dev/npm/package/@codespar/mcp-nupay
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-nupay/codespar-mcp-nupay.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-nupay/codespar-mcp-nupay.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-nupay/codespar-mcp-nupay