io.github.codespar/mcp-openpay
NPM · @CODESPAR/MCP-OPENPAY
MCP server for Openpay — BBVA-owned Mexican gateway (cards, SPEI, OXXO, subscriptions, payouts)
Available components
Last scanned (8 hours ago)
Scores higher than 65% of npm servers
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 135 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability76
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2593 tokens (~112/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
- Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 94% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "create_charge" implies "charge" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −3
- Stability: pass → 0.80 functional
- 30 Oct 26 0
- Stability: 0.97 → pass security
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 −1
- Stability: pass → 0.93 functional
- 22 Oct 26 0
- Stability: 0.97 → pass security
- 21 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 +3
- Stability: 0.80 → pass security
- 16 Oct 26 −3
- Stability: pass → 0.80 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@codespar/mcp-openpay@0.2.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 92 packages
| Packages resolved | 92 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_subscription ~59
Cancel a customer's subscription (DELETE /customers/{customer_id}/subscriptions/{id}). Cancellation takes effect at the end of the current paid period.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Openpay customer id. |
| id | string | yes | Openpay subscription id. |
No output schema declared.
No examples provided.
capture_charge ~91
Capture a previously authorized charge (when the original charge used capture=false). Pass amount to capture less than the authorized total; omit to capture the full authorized amount.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | Amount to capture in major units. Omit for full capture. |
| customer_id | string | – | Optional. Customer scope if the charge was customer-scoped. |
| id | string | yes | Openpay charge id to capture. |
No output schema declared.
No examples provided.
create_bank_account ~90
Store a customer bank account (POST /customers/{customer_id}/bankaccounts). Required before you can run destination_id-based payouts to that customer's account.
| Name | Type | Req | Description |
|---|---|---|---|
| alias | string | – | Friendly alias for the account. |
| clabe | string | yes | CLABE (18-digit Mexican bank account). |
| customer_id | string | yes | Openpay customer id. |
| holder_name | string | yes | Account holder name. |
No output schema declared.
No examples provided.
create_card ~225
Tokenize a card. Pass customer_id to attach to a stored customer (POST /customers/{customer_id}/cards); omit for a merchant-level token (POST /cards). Prefer tokenizing client-side with Openpay.js to avoid PCI scope.
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | – | Billing address for the card. |
| card_number | string | – | PAN. Only use server-side if you are PCI-compliant; prefer token_id. |
| customer_id | string | – | Optional. Attach the card to this customer. |
| cvv2 | string | – | CVV. Only server-side if PCI-compliant. |
| device_session_id | string | – | Device session id from Openpay antifraud JS. |
| expiration_month | string | – | 2-digit month (e.g. '04'). |
| expiration_year | string | – | 2-digit year (e.g. '27'). |
| holder_name | string | – | Cardholder name as printed on the card. |
| token_id | string | – | Token id from client-side Openpay.js tokenization (preferred, keeps you out of PCI scope). |
No output schema declared.
No examples provided.
create_charge ~427
Create a charge. Pass customer_id to charge at a customer scope (POST /customers/{customer_id}/charges); omit to charge at merchant scope (POST /charges). Methods: 'card' (requires source_id token), 'bank_account' (SPEI — returns CLABE reference), 'store' (OXXO — returns barcode/reference). Amounts are in major units (e.g. 100 = 100 MXN).
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Amount in major units (MXN). |
| capture | boolean | – | If false, only authorizes — use capture_charge later. Defaults to true. |
| card | object | – | Inline card object for method='card' when not using source_id. Alternatively pass source_id from a tokenized card. |
| currency | string | – | ISO-4217 currency code. Defaults to MXN. |
| customer | object | – | Customer identity for one-off (merchant-scope) charges. Not required when customer_id is set. |
| customer_id | string | – | Optional. Openpay customer id to scope the charge to a stored customer. |
| description | string | – | Charge description shown on receipts. |
| device_session_id | string | – | Device session id from Openpay antifraud JS (required for card charges in production). |
| due_date | string | – | For store (OXXO) / bank_account (SPEI) charges, ISO-8601 expiration. |
| method | string | yes | Payment method: card, bank_account (SPEI), or store (OXXO). |
| order_id | string | – | Merchant-side unique order reference. |
| redirect_url | string | – | For 3DS / redirect flows, where to return the buyer after auth. |
| send_email | boolean | – | For store (OXXO) charges, email the voucher to the customer. |
| source_id | string | – | Card or token id when method='card'. Required for card charges unless 'card' inline object is provided. |
| use_3d_secure | boolean | – | Force 3DS for card charges. |
No output schema declared.
No examples provided.
create_customer ~120
Create a customer record. Set requires_account=true to create an associated Openpay wallet for the customer; false for a payment-only record.
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | – | Customer billing address. |
| string | yes | Customer email (required). | |
| external_id | string | – | Merchant-side stable customer id. |
| last_name | string | – | Customer last name. |
| name | string | yes | Customer first name. |
| phone_number | string | – | Customer phone number. |
| requires_account | boolean | – | true = create wallet account; false = payment-only record. |
No output schema declared.
No examples provided.
create_payout ~178
Pay out MXN to a bank account. Used for marketplace seller payouts and cross-border settlement. Scope to a customer with customer_id (POST /customers/{customer_id}/payouts) or run at merchant scope (POST /payouts).
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Payout amount in major units (MXN). |
| bank_account | object | – | Inline destination bank account. Use this or destination_id. |
| customer_id | string | – | Optional. Payout from a customer wallet (requires customer to have requires_account=true). |
| description | string | – | Payout description. |
| destination_id | string | – | Stored bank account id (alternative to passing bank_account inline). |
| method | string | yes | Payout method. Currently bank_account (SPEI) only. |
| order_id | string | – | Merchant-side payout reference. |
No output schema declared.
No examples provided.
create_plan ~148
Create a subscription plan. Plans are templates — use create_subscription to subscribe a customer.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | yes | Recurring charge amount in major units (MXN). |
| currency | string | – | ISO-4217 currency code. Defaults to MXN. |
| name | string | yes | Plan name shown to customers. |
| repeat_every | number | yes | Interval count (e.g. 1 = every 1 unit). |
| repeat_unit | string | yes | Interval unit. |
| retry_times | number | yes | How many times to retry a failed recurring charge. |
| status_after_retry | string | yes | Subscription status after retries are exhausted. |
| trial_days | number | – | Free trial length in days. |
No output schema declared.
No examples provided.
create_subscription ~115
Subscribe a customer to a plan. Requires a stored card (source_id) to charge on each cycle.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Openpay customer id. |
| device_session_id | string | – | Device session id from Openpay antifraud JS. |
| plan_id | string | yes | Openpay plan id from create_plan. |
| source_id | string | yes | Openpay card id to charge on each recurring cycle. |
| trial_end_date | string | – | ISO-8601 date. Overrides plan.trial_days for this subscription. |
No output schema declared.
No examples provided.
create_webhook ~119
Register a webhook endpoint (POST /webhooks). Openpay posts event notifications to url and can optionally send HTTP Basic credentials.
| Name | Type | Req | Description |
|---|---|---|---|
| event_types | array | yes | Event subscriptions, e.g. ['charge.succeeded','charge.failed','subscription.charge.failed','payout.created','chargeback.created']. |
| password | string | – | Optional HTTP Basic password Openpay should send with each notification. |
| url | string | yes | HTTPS endpoint that receives event POSTs. |
| user | string | – | Optional HTTP Basic username Openpay should send with each notification. |
No output schema declared.
No examples provided.
delete_bank_account ~53
Delete a stored customer bank account (DELETE /customers/{customer_id}/bankaccounts/{id}).
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Openpay customer id. |
| id | string | yes | Openpay bank account id. |
No output schema declared.
No examples provided.
delete_card ~76
Delete a tokenized card. Pass customer_id to delete at customer scope (DELETE /customers/{customer_id}/cards/{id}); omit for merchant scope (DELETE /cards/{id}).
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Optional. Customer scope if the card was customer-scoped. |
| id | string | yes | Openpay card id. |
No output schema declared.
No examples provided.
delete_customer ~43
Delete a customer (DELETE /customers/{id}). Irreversible — removes the customer and associated stored tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Openpay customer id to delete. |
No output schema declared.
No examples provided.
delete_webhook ~33
Delete a webhook subscription (DELETE /webhooks/{id}).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Openpay webhook id. |
No output schema declared.
No examples provided.
get_card ~76
Retrieve a tokenized card. Pass customer_id to fetch at customer scope (GET /customers/{customer_id}/cards/{id}); omit for merchant scope (GET /cards/{id}).
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Optional. Customer scope if the card was customer-scoped. |
| id | string | yes | Openpay card id. |
No output schema declared.
No examples provided.
get_charge ~74
Retrieve a charge. Pass customer_id to fetch at customer scope (GET /customers/{customer_id}/charges/{id}); omit for merchant scope (GET /charges/{id}).
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Optional. Scope the fetch to this customer. |
| id | string | yes | Openpay charge id (transaction id). |
No output schema declared.
No examples provided.
get_customer ~28
Retrieve a customer by Openpay customer id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Openpay customer id. |
No output schema declared.
No examples provided.
list_cards ~128
List tokenized cards. Pass customer_id to list per-customer (GET /customers/{customer_id}/cards); omit for merchant-level cards (GET /cards).
| Name | Type | Req | Description |
|---|---|---|---|
| creation | string | – | Filter by creation date (YYYY-MM-DD). |
| creation[gte] | string | – | Created on or after (YYYY-MM-DD). |
| creation[lte] | string | – | Created on or before (YYYY-MM-DD). |
| customer_id | string | – | Optional. Scope to this customer. |
| limit | number | – | Page size (max 100). |
| offset | number | – | Pagination offset. |
No output schema declared.
No examples provided.
list_customers ~110
List customers with optional filters. All parameters are passed as query params.
| Name | Type | Req | Description |
|---|---|---|---|
| creation | string | – | Filter by creation date (YYYY-MM-DD). |
| creation[gte] | string | – | Created on or after (YYYY-MM-DD). |
| creation[lte] | string | – | Created on or before (YYYY-MM-DD). |
| external_id | string | – | Filter by merchant-side external_id. |
| limit | number | – | Page size (max 100). |
| offset | number | – | Pagination offset. |
No output schema declared.
No examples provided.
list_payouts ~133
List payouts. Pass customer_id to scope to a customer (GET /customers/{customer_id}/payouts); omit for merchant-scope payouts (GET /payouts).
| Name | Type | Req | Description |
|---|---|---|---|
| creation | string | – | Filter by creation date (YYYY-MM-DD). |
| creation[gte] | string | – | Created on or after (YYYY-MM-DD). |
| creation[lte] | string | – | Created on or before (YYYY-MM-DD). |
| customer_id | string | – | Optional. Scope to this customer. |
| limit | number | – | Page size (max 100). |
| offset | number | – | Pagination offset. |
No output schema declared.
No examples provided.
list_webhooks ~19
List configured webhook subscriptions (GET /webhooks).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
refund_charge ~91
Refund a captured charge. Supports partial refunds via amount; omit amount for a full refund.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | Partial refund amount in major units. Omit for a full refund. |
| customer_id | string | – | Optional. Customer scope if the charge was customer-scoped. |
| description | string | – | Reason or reference for the refund. |
| id | string | yes | Openpay charge id to refund. |
No output schema declared.
No examples provided.
update_customer ~90
Update a stored customer (PUT /customers/{id}). Only the fields provided are updated; omit fields you don't want to change.
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | – | – |
| string | – | – | |
| external_id | string | – | – |
| id | string | yes | Openpay customer id. |
| last_name | string | – | – |
| name | string | – | – |
| phone_number | string | – | – |
No output schema declared.
No examples provided.
How do I install the io.github.codespar/mcp-openpay server?
io.github.codespar/mcp-openpay runs locally as an npm package, launched with npx -y @codespar/mcp-openpay. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @codespar/mcp-openpay
claude mcp add codespar-mcp-openpay -- npx -y @codespar/mcp-openpay
What is the io.github.codespar/mcp-openpay server?
io.github.codespar/mcp-openpay is listed in the public MCP registry as io.github.codespar/mcp-openpay. MCP server for Openpay, BBVA-owned Mexican gateway (cards, SPEI, OXXO, subscriptions, payouts). This page covers its npm package (@codespar/mcp-openpay).
Is the io.github.codespar/mcp-openpay server safe to use?
io.github.codespar/mcp-openpay scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.codespar/mcp-openpay server expose?
io.github.codespar/mcp-openpay exposes 23 tools: create_charge, get_charge, capture_charge, refund_charge, create_customer, and 18 more. Their descriptions and schemas cost roughly 2,526 tokens of context every time the server is loaded.
Is the io.github.codespar/mcp-openpay server still maintained?
io.github.codespar/mcp-openpay is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.codespar/mcp-openpay server under?
io.github.codespar/mcp-openpay declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.