# io.github.codespar/mcp-openpay (npm · @codespar/mcp-openpay)

MCP server for Openpay — BBVA-owned Mexican gateway (cards, SPEI, OXXO, subscriptions, payouts)

- Trust score: 65/100 (medium)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@codespar/mcp-openpay`: 65/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-openpay/codespar-mcp-openpay.md), [page](https://verifymcp.io/servers/codespar-mcp-openpay/codespar-mcp-openpay)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-openpay`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 41 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2593 tokens (~112/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 98/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 94% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add codespar-mcp-openpay -- npx -y @codespar/mcp-openpay
```

### Codex

```bash
codex mcp add codespar-mcp-openpay -- npx -y @codespar/mcp-openpay
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-openpay": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-openpay"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-openpay --command npx --arg -y --arg @codespar/mcp-openpay
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-openpay:
    command: "npx"
    args: ["-y", "@codespar/mcp-openpay"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-openpay": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-openpay"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 65, +30)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 35, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 20, −4)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 24, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (23)

### `create_charge` (~427 tokens)

Create a charge. Pass customer_id to charge at a customer scope (POST /customers/{customer_id}/charges); omit to charge at merchant scope (POST /charges). Methods: 'card' (requires source_id token), 'bank_account' (SPEI — returns CLABE reference), 'store' (OXXO — returns barcode/reference). Amounts are in major units (e.g. 100 = 100 MXN).

Input parameters:

- `amount` (number, required): Amount in major units (MXN).
- `capture` (boolean): If false, only authorizes — use capture_charge later. Defaults to true.
- `card` (object): Inline card object for method='card' when not using source_id. Alternatively pass source_id from a tokenized card.
- `currency` (string): ISO-4217 currency code. Defaults to MXN.
- `customer` (object): Customer identity for one-off (merchant-scope) charges. Not required when customer_id is set.
- `customer_id` (string): Optional. Openpay customer id to scope the charge to a stored customer.
- `description` (string): Charge description shown on receipts.
- `device_session_id` (string): Device session id from Openpay antifraud JS (required for card charges in production).
- `due_date` (string): For store (OXXO) / bank_account (SPEI) charges, ISO-8601 expiration.
- `method` (string, required): Payment method: card, bank_account (SPEI), or store (OXXO).
- `order_id` (string): Merchant-side unique order reference.
- `redirect_url` (string): For 3DS / redirect flows, where to return the buyer after auth.
- `send_email` (boolean): For store (OXXO) charges, email the voucher to the customer.
- `source_id` (string): Card or token id when method='card'. Required for card charges unless 'card' inline object is provided.
- `use_3d_secure` (boolean): Force 3DS for card charges.

### `get_charge` (~74 tokens)

Retrieve a charge. Pass customer_id to fetch at customer scope (GET /customers/{customer_id}/charges/{id}); omit for merchant scope (GET /charges/{id}).

Input parameters:

- `customer_id` (string): Optional. Scope the fetch to this customer.
- `id` (string, required): Openpay charge id (transaction id).

### `capture_charge` (~91 tokens)

Capture a previously authorized charge (when the original charge used capture=false). Pass amount to capture less than the authorized total; omit to capture the full authorized amount.

Input parameters:

- `amount` (number): Amount to capture in major units. Omit for full capture.
- `customer_id` (string): Optional. Customer scope if the charge was customer-scoped.
- `id` (string, required): Openpay charge id to capture.

### `refund_charge` (~91 tokens)

Refund a captured charge. Supports partial refunds via amount; omit amount for a full refund.

Input parameters:

- `amount` (number): Partial refund amount in major units. Omit for a full refund.
- `customer_id` (string): Optional. Customer scope if the charge was customer-scoped.
- `description` (string): Reason or reference for the refund.
- `id` (string, required): Openpay charge id to refund.

### `create_customer` (~120 tokens)

Create a customer record. Set requires_account=true to create an associated Openpay wallet for the customer; false for a payment-only record.

Input parameters:

- `address` (object): Customer billing address.
- `email` (string, required): Customer email (required).
- `external_id` (string): Merchant-side stable customer id.
- `last_name` (string): Customer last name.
- `name` (string, required): Customer first name.
- `phone_number` (string): Customer phone number.
- `requires_account` (boolean): true = create wallet account; false = payment-only record.

### `get_customer` (~28 tokens)

Retrieve a customer by Openpay customer id.

Input parameters:

- `id` (string, required): Openpay customer id.

### `list_customers` (~110 tokens)

List customers with optional filters. All parameters are passed as query params.

Input parameters:

- `creation` (string): Filter by creation date (YYYY-MM-DD).
- `creation[gte]` (string): Created on or after (YYYY-MM-DD).
- `creation[lte]` (string): Created on or before (YYYY-MM-DD).
- `external_id` (string): Filter by merchant-side external_id.
- `limit` (number): Page size (max 100).
- `offset` (number): Pagination offset.

### `create_card` (~225 tokens)

Tokenize a card. Pass customer_id to attach to a stored customer (POST /customers/{customer_id}/cards); omit for a merchant-level token (POST /cards). Prefer tokenizing client-side with Openpay.js to avoid PCI scope.

Input parameters:

- `address` (object): Billing address for the card.
- `card_number` (string): PAN. Only use server-side if you are PCI-compliant; prefer token_id.
- `customer_id` (string): Optional. Attach the card to this customer.
- `cvv2` (string): CVV. Only server-side if PCI-compliant.
- `device_session_id` (string): Device session id from Openpay antifraud JS.
- `expiration_month` (string): 2-digit month (e.g. '04').
- `expiration_year` (string): 2-digit year (e.g. '27').
- `holder_name` (string): Cardholder name as printed on the card.
- `token_id` (string): Token id from client-side Openpay.js tokenization (preferred, keeps you out of PCI scope).

### `delete_card` (~76 tokens)

Delete a tokenized card. Pass customer_id to delete at customer scope (DELETE /customers/{customer_id}/cards/{id}); omit for merchant scope (DELETE /cards/{id}).

Input parameters:

- `customer_id` (string): Optional. Customer scope if the card was customer-scoped.
- `id` (string, required): Openpay card id.

### `create_plan` (~148 tokens)

Create a subscription plan. Plans are templates — use create_subscription to subscribe a customer.

Input parameters:

- `amount` (number, required): Recurring charge amount in major units (MXN).
- `currency` (string): ISO-4217 currency code. Defaults to MXN.
- `name` (string, required): Plan name shown to customers.
- `repeat_every` (number, required): Interval count (e.g. 1 = every 1 unit).
- `repeat_unit` (string, required): Interval unit.
- `retry_times` (number, required): How many times to retry a failed recurring charge.
- `status_after_retry` (string, required): Subscription status after retries are exhausted.
- `trial_days` (number): Free trial length in days.

### `create_subscription` (~115 tokens)

Subscribe a customer to a plan. Requires a stored card (source_id) to charge on each cycle.

Input parameters:

- `customer_id` (string, required): Openpay customer id.
- `device_session_id` (string): Device session id from Openpay antifraud JS.
- `plan_id` (string, required): Openpay plan id from create_plan.
- `source_id` (string, required): Openpay card id to charge on each recurring cycle.
- `trial_end_date` (string): ISO-8601 date. Overrides plan.trial_days for this subscription.

### `create_payout` (~178 tokens)

Pay out MXN to a bank account. Used for marketplace seller payouts and cross-border settlement. Scope to a customer with customer_id (POST /customers/{customer_id}/payouts) or run at merchant scope (POST /payouts).

Input parameters:

- `amount` (number, required): Payout amount in major units (MXN).
- `bank_account` (object): Inline destination bank account. Use this or destination_id.
- `customer_id` (string): Optional. Payout from a customer wallet (requires customer to have requires_account=true).
- `description` (string): Payout description.
- `destination_id` (string): Stored bank account id (alternative to passing bank_account inline).
- `method` (string, required): Payout method. Currently bank_account (SPEI) only.
- `order_id` (string): Merchant-side payout reference.

### `update_customer` (~90 tokens)

Update a stored customer (PUT /customers/{id}). Only the fields provided are updated; omit fields you don't want to change.

Input parameters:

- `address` (object)
- `email` (string)
- `external_id` (string)
- `id` (string, required): Openpay customer id.
- `last_name` (string)
- `name` (string)
- `phone_number` (string)

### `delete_customer` (~43 tokens)

Delete a customer (DELETE /customers/{id}). Irreversible — removes the customer and associated stored tokens.

Input parameters:

- `id` (string, required): Openpay customer id to delete.

### `get_card` (~76 tokens)

Retrieve a tokenized card. Pass customer_id to fetch at customer scope (GET /customers/{customer_id}/cards/{id}); omit for merchant scope (GET /cards/{id}).

Input parameters:

- `customer_id` (string): Optional. Customer scope if the card was customer-scoped.
- `id` (string, required): Openpay card id.

### `list_cards` (~128 tokens)

List tokenized cards. Pass customer_id to list per-customer (GET /customers/{customer_id}/cards); omit for merchant-level cards (GET /cards).

Input parameters:

- `creation` (string): Filter by creation date (YYYY-MM-DD).
- `creation[gte]` (string): Created on or after (YYYY-MM-DD).
- `creation[lte]` (string): Created on or before (YYYY-MM-DD).
- `customer_id` (string): Optional. Scope to this customer.
- `limit` (number): Page size (max 100).
- `offset` (number): Pagination offset.

### `create_bank_account` (~90 tokens)

Store a customer bank account (POST /customers/{customer_id}/bankaccounts). Required before you can run destination_id-based payouts to that customer's account.

Input parameters:

- `alias` (string): Friendly alias for the account.
- `clabe` (string, required): CLABE (18-digit Mexican bank account).
- `customer_id` (string, required): Openpay customer id.
- `holder_name` (string, required): Account holder name.

### `delete_bank_account` (~53 tokens)

Delete a stored customer bank account (DELETE /customers/{customer_id}/bankaccounts/{id}).

Input parameters:

- `customer_id` (string, required): Openpay customer id.
- `id` (string, required): Openpay bank account id.

### `cancel_subscription` (~59 tokens)

Cancel a customer's subscription (DELETE /customers/{customer_id}/subscriptions/{id}). Cancellation takes effect at the end of the current paid period.

Input parameters:

- `customer_id` (string, required): Openpay customer id.
- `id` (string, required): Openpay subscription id.

### `list_payouts` (~133 tokens)

List payouts. Pass customer_id to scope to a customer (GET /customers/{customer_id}/payouts); omit for merchant-scope payouts (GET /payouts).

Input parameters:

- `creation` (string): Filter by creation date (YYYY-MM-DD).
- `creation[gte]` (string): Created on or after (YYYY-MM-DD).
- `creation[lte]` (string): Created on or before (YYYY-MM-DD).
- `customer_id` (string): Optional. Scope to this customer.
- `limit` (number): Page size (max 100).
- `offset` (number): Pagination offset.

### `create_webhook` (~119 tokens)

Register a webhook endpoint (POST /webhooks). Openpay posts event notifications to url and can optionally send HTTP Basic credentials.

Input parameters:

- `event_types` (array, required): Event subscriptions, e.g. ['charge.succeeded','charge.failed','subscription.charge.failed','payout.created','chargeback.created'].
- `password` (string): Optional HTTP Basic password Openpay should send with each notification.
- `url` (string, required): HTTPS endpoint that receives event POSTs.
- `user` (string): Optional HTTP Basic username Openpay should send with each notification.

### `list_webhooks` (~19 tokens)

List configured webhook subscriptions (GET /webhooks).

### `delete_webhook` (~33 tokens)

Delete a webhook subscription (DELETE /webhooks/{id}).

Input parameters:

- `id` (string, required): Openpay webhook id.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-openpay/codespar-mcp-openpay#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 65
- 2026-08-01: 35
- 2026-07-31: 20
- 2026-07-30: 24
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-openpay
- Socket report: https://socket.dev/npm/package/@codespar/mcp-openpay
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-openpay/codespar-mcp-openpay/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-openpay/codespar-mcp-openpay/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-openpay/codespar-mcp-openpay