io.github.codespar/mcp-openpay

NPM · @CODESPAR/MCP-OPENPAY · SCANNED AUG 3

MCP server for Openpay — BBVA-owned Mexican gateway (cards, SPEI, OXXO, subscriptions, payouts)

Available components

+20 this week 65 65 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security86

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 41 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability75

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2593 tokens (~112/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage98

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
94% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @codespar/mcp-openpay

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add codespar-mcp-openpay -- npx -y @codespar/mcp-openpay

# add to Codex CLI

codex mcp add codespar-mcp-openpay -- npx -y @codespar/mcp-openpay

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-openpay": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-openpay"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add codespar-mcp-openpay --command npx --arg -y --arg @codespar/mcp-openpay

# ~/.hermes/config.yaml

mcp_servers:
  codespar-mcp-openpay:
    command: "npx"
    args: ["-y", "@codespar/mcp-openpay"]

// mcp.json

{
  "mcpServers": {
    "codespar-mcp-openpay": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-openpay"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +30
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 −4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −21
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
27 Jul 26 45

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@codespar/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 23 exposed · ~2,526 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

cancel_subscription ~59

Cancel a customer's subscription (DELETE /customers/{customer_id}/subscriptions/{id}). Cancellation takes effect at the end of the current paid period.

Input Output Examples

Name	Type	Req	Description
customer_id	string	yes	Openpay customer id.
id	string	yes	Openpay subscription id.

No output schema declared.

No examples provided.

capture_charge ~91

Capture a previously authorized charge (when the original charge used capture=false). Pass amount to capture less than the authorized total; omit to capture the full authorized amount.

Input Output Examples

Name	Type	Req	Description
amount	number	—	Amount to capture in major units. Omit for full capture.
customer_id	string	—	Optional. Customer scope if the charge was customer-scoped.
id	string	yes	Openpay charge id to capture.

No output schema declared.

No examples provided.

create_bank_account ~90

Store a customer bank account (POST /customers/{customer_id}/bankaccounts). Required before you can run destination_id-based payouts to that customer's account.

Input Output Examples

Name	Type	Req	Description
alias	string	—	Friendly alias for the account.
clabe	string	yes	CLABE (18-digit Mexican bank account).
customer_id	string	yes	Openpay customer id.
holder_name	string	yes	Account holder name.

No output schema declared.

No examples provided.

create_card ~225

Tokenize a card. Pass customer_id to attach to a stored customer (POST /customers/{customer_id}/cards); omit for a merchant-level token (POST /cards). Prefer tokenizing client-side with Openpay.js to avoid PCI scope.

Input Output Examples

Name	Type	Req	Description
address	object	—	Billing address for the card.
card_number	string	—	PAN. Only use server-side if you are PCI-compliant; prefer token_id.
customer_id	string	—	Optional. Attach the card to this customer.
cvv2	string	—	CVV. Only server-side if PCI-compliant.
device_session_id	string	—	Device session id from Openpay antifraud JS.
expiration_month	string	—	2-digit month (e.g. '04').
expiration_year	string	—	2-digit year (e.g. '27').
holder_name	string	—	Cardholder name as printed on the card.
token_id	string	—	Token id from client-side Openpay.js tokenization (preferred, keeps you out of PCI scope).

No output schema declared.

No examples provided.

create_charge ~427

Create a charge. Pass customer_id to charge at a customer scope (POST /customers/{customer_id}/charges); omit to charge at merchant scope (POST /charges). Methods: 'card' (requires source_id token), 'bank_account' (SPEI — returns CLABE reference), 'store' (OXXO — returns barcode/reference). Amounts are in major units (e.g. 100 = 100 MXN).

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Amount in major units (MXN).
capture	boolean	—	If false, only authorizes — use capture_charge later. Defaults to true.
card	object	—	Inline card object for method='card' when not using source_id. Alternatively pass source_id from a tokenized card.
currency	string	—	ISO-4217 currency code. Defaults to MXN.
customer	object	—	Customer identity for one-off (merchant-scope) charges. Not required when customer_id is set.
customer_id	string	—	Optional. Openpay customer id to scope the charge to a stored customer.
description	string	—	Charge description shown on receipts.
device_session_id	string	—	Device session id from Openpay antifraud JS (required for card charges in production).
due_date	string	—	For store (OXXO) / bank_account (SPEI) charges, ISO-8601 expiration.
method	string	yes	Payment method: card, bank_account (SPEI), or store (OXXO).
order_id	string	—	Merchant-side unique order reference.
redirect_url	string	—	For 3DS / redirect flows, where to return the buyer after auth.
send_email	boolean	—	For store (OXXO) charges, email the voucher to the customer.
source_id	string	—	Card or token id when method='card'. Required for card charges unless 'card' inline object is provided.
use_3d_secure	boolean	—	Force 3DS for card charges.

No output schema declared.

No examples provided.

create_customer ~120

Create a customer record. Set requires_account=true to create an associated Openpay wallet for the customer; false for a payment-only record.

Input Output Examples

Name	Type	Req	Description
address	object	—	Customer billing address.
email	string	yes	Customer email (required).
external_id	string	—	Merchant-side stable customer id.
last_name	string	—	Customer last name.
name	string	yes	Customer first name.
phone_number	string	—	Customer phone number.
requires_account	boolean	—	true = create wallet account; false = payment-only record.

No output schema declared.

No examples provided.

create_payout ~178

Pay out MXN to a bank account. Used for marketplace seller payouts and cross-border settlement. Scope to a customer with customer_id (POST /customers/{customer_id}/payouts) or run at merchant scope (POST /payouts).

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Payout amount in major units (MXN).
bank_account	object	—	Inline destination bank account. Use this or destination_id.
customer_id	string	—	Optional. Payout from a customer wallet (requires customer to have requires_account=true).
description	string	—	Payout description.
destination_id	string	—	Stored bank account id (alternative to passing bank_account inline).
method	string	yes	Payout method. Currently bank_account (SPEI) only.
order_id	string	—	Merchant-side payout reference.

No output schema declared.

No examples provided.

create_plan ~148

Create a subscription plan. Plans are templates — use create_subscription to subscribe a customer.

Input Output Examples

Name	Type	Req	Description
amount	number	yes	Recurring charge amount in major units (MXN).
currency	string	—	ISO-4217 currency code. Defaults to MXN.
name	string	yes	Plan name shown to customers.
repeat_every	number	yes	Interval count (e.g. 1 = every 1 unit).
repeat_unit	string	yes	Interval unit.
retry_times	number	yes	How many times to retry a failed recurring charge.
status_after_retry	string	yes	Subscription status after retries are exhausted.
trial_days	number	—	Free trial length in days.

No output schema declared.

No examples provided.

create_subscription ~115

Subscribe a customer to a plan. Requires a stored card (source_id) to charge on each cycle.

Input Output Examples

Name	Type	Req	Description
customer_id	string	yes	Openpay customer id.
device_session_id	string	—	Device session id from Openpay antifraud JS.
plan_id	string	yes	Openpay plan id from create_plan.
source_id	string	yes	Openpay card id to charge on each recurring cycle.
trial_end_date	string	—	ISO-8601 date. Overrides plan.trial_days for this subscription.

No output schema declared.

No examples provided.

create_webhook ~119

Register a webhook endpoint (POST /webhooks). Openpay posts event notifications to url and can optionally send HTTP Basic credentials.

Input Output Examples

Name	Type	Req	Description
event_types	array	yes	Event subscriptions, e.g. ['charge.succeeded','charge.failed','subscription.charge.failed','payout.created','chargeback.created'].
password	string	—	Optional HTTP Basic password Openpay should send with each notification.
url	string	yes	HTTPS endpoint that receives event POSTs.
user	string	—	Optional HTTP Basic username Openpay should send with each notification.

No output schema declared.

No examples provided.

delete_bank_account ~53

Delete a stored customer bank account (DELETE /customers/{customer_id}/bankaccounts/{id}).

Input Output Examples

Name	Type	Req	Description
customer_id	string	yes	Openpay customer id.
id	string	yes	Openpay bank account id.

No output schema declared.

No examples provided.

delete_card ~76

Delete a tokenized card. Pass customer_id to delete at customer scope (DELETE /customers/{customer_id}/cards/{id}); omit for merchant scope (DELETE /cards/{id}).

Input Output Examples

Name	Type	Req	Description
customer_id	string	—	Optional. Customer scope if the card was customer-scoped.
id	string	yes	Openpay card id.

No output schema declared.

No examples provided.

delete_customer ~43

Delete a customer (DELETE /customers/{id}). Irreversible — removes the customer and associated stored tokens.

Input Output Examples

Name	Type	Req	Description
id	string	yes	Openpay customer id to delete.

No output schema declared.

No examples provided.

delete_webhook ~33

Delete a webhook subscription (DELETE /webhooks/{id}).

Input Output Examples

Name	Type	Req	Description
id	string	yes	Openpay webhook id.

No output schema declared.

No examples provided.

get_card ~76

Retrieve a tokenized card. Pass customer_id to fetch at customer scope (GET /customers/{customer_id}/cards/{id}); omit for merchant scope (GET /cards/{id}).

Input Output Examples

Name	Type	Req	Description
customer_id	string	—	Optional. Customer scope if the card was customer-scoped.
id	string	yes	Openpay card id.

No output schema declared.

No examples provided.

get_charge ~74

Retrieve a charge. Pass customer_id to fetch at customer scope (GET /customers/{customer_id}/charges/{id}); omit for merchant scope (GET /charges/{id}).

Input Output Examples

Name	Type	Req	Description
customer_id	string	—	Optional. Scope the fetch to this customer.
id	string	yes	Openpay charge id (transaction id).

No output schema declared.

No examples provided.

get_customer ~28

Retrieve a customer by Openpay customer id.

Input Output Examples

Name	Type	Req	Description
id	string	yes	Openpay customer id.

No output schema declared.

No examples provided.

list_cards ~128

List tokenized cards. Pass customer_id to list per-customer (GET /customers/{customer_id}/cards); omit for merchant-level cards (GET /cards).

Input Output Examples

Name	Type	Req	Description
creation	string	—	Filter by creation date (YYYY-MM-DD).
creation[gte]	string	—	Created on or after (YYYY-MM-DD).
creation[lte]	string	—	Created on or before (YYYY-MM-DD).
customer_id	string	—	Optional. Scope to this customer.
limit	number	—	Page size (max 100).
offset	number	—	Pagination offset.

No output schema declared.

No examples provided.

list_customers ~110

List customers with optional filters. All parameters are passed as query params.

Input Output Examples

Name	Type	Req	Description
creation	string	—	Filter by creation date (YYYY-MM-DD).
creation[gte]	string	—	Created on or after (YYYY-MM-DD).
creation[lte]	string	—	Created on or before (YYYY-MM-DD).
external_id	string	—	Filter by merchant-side external_id.
limit	number	—	Page size (max 100).
offset	number	—	Pagination offset.

No output schema declared.

No examples provided.

list_payouts ~133

List payouts. Pass customer_id to scope to a customer (GET /customers/{customer_id}/payouts); omit for merchant-scope payouts (GET /payouts).

Input Output Examples

Name	Type	Req	Description
creation	string	—	Filter by creation date (YYYY-MM-DD).
creation[gte]	string	—	Created on or after (YYYY-MM-DD).
creation[lte]	string	—	Created on or before (YYYY-MM-DD).
customer_id	string	—	Optional. Scope to this customer.
limit	number	—	Page size (max 100).
offset	number	—	Pagination offset.

No output schema declared.

No examples provided.

list_webhooks ~19

List configured webhook subscriptions (GET /webhooks).

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

refund_charge ~91

Refund a captured charge. Supports partial refunds via amount; omit amount for a full refund.

Input Output Examples

Name	Type	Req	Description
amount	number	—	Partial refund amount in major units. Omit for a full refund.
customer_id	string	—	Optional. Customer scope if the charge was customer-scoped.
description	string	—	Reason or reference for the refund.
id	string	yes	Openpay charge id to refund.

No output schema declared.

No examples provided.

update_customer ~90

Update a stored customer (PUT /customers/{id}). Only the fields provided are updated; omit fields you don't want to change.

Input Output Examples

Name	Type	Req	Description
address	object	—	—
email	string	—	—
external_id	string	—	—
id	string	yes	Openpay customer id.
last_name	string	—	—
name	string	—	—
phone_number	string	—	—

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug