# io.github.codespar/mcp-rede (npm · @codespar/mcp-rede)

MCP server for Rede — Itaú-owned BR acquirer: authorize/capture/refund, zero-auth, card tokens

- Trust score: 68/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-05

## Components

- npm · `@codespar/mcp-rede`: 68/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-rede/codespar-mcp-rede.md), [page](https://verifymcp.io/servers/codespar-mcp-rede/codespar-mcp-rede)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-rede`
- Version: `0.2.0-alpha.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-05.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 43 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2243 tokens (~101/item across 22 items; 22 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 91/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 74% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-rede -- npx -y @codespar/mcp-rede
```

### Codex

```bash
codex mcp add codespar-mcp-rede -- npx -y @codespar/mcp-rede
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-rede": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-rede"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-rede --command npx --arg -y --arg @codespar/mcp-rede
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-rede:
    command: "npx"
    args: ["-y", "@codespar/mcp-rede"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-rede": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-rede"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-03 (score 67, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 63, +43)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 20, 0)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 20, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (22)

### `authorize_transaction` (~232 tokens)

Authorize a credit card transaction on Rede. Set capture=true to authorize + capture atomically; capture=false to authorize only (use capture_transaction later).

Input parameters:

- `amount` (number, required): Amount in cents
- `capture` (boolean, required): true = authorize + capture; false = authorize only
- `cardHolderName` (string): Name on card
- `cardNumber` (string): PAN; never log this value. Prefer storageCard (token) instead.
- `expirationMonth` (number): Expiration month (1-12)
- `expirationYear` (number): Expiration year (4 digits)
- `installments` (number, required): Number of installments (1 for à vista)
- `reference` (string, required): Merchant-side order reference (unique per merchant)
- `securityCode` (string): CVV
- `softDescriptor` (string): Statement descriptor shown on the cardholder bill
- `storageCard` (string): Token from tokenize_card (alternative to cardNumber)
- `subscription` (boolean): Flag as a recurring charge (MIT)
- `urls` (array): Optional callback/notification URL objects ({ url, kind })

### `capture_transaction` (~67 tokens)

Capture a previously authorized transaction (when capture=false was used). Pass amount for partial capture; omit for full.

Input parameters:

- `amount` (number): Amount to capture in cents. Omit to capture the full authorized amount.
- `tid` (string, required): Rede transaction id (tid) from authorize_transaction

### `cancel_transaction` (~51 tokens)

Cancel an authorized-but-uncaptured transaction (void). Rede uses the refunds endpoint for both voids and refunds — cancel means full amount on an uncaptured transaction.

Input parameters:

- `tid` (string, required): Rede transaction id

### `refund_transaction` (~62 tokens)

Refund a captured transaction. Pass amount for a partial refund; omit for full. Same endpoint as cancel; amount controls the behaviour.

Input parameters:

- `amount` (number): Refund amount in cents. Omit for a full refund.
- `tid` (string, required): Rede transaction id

### `get_transaction` (~51 tokens)

Retrieve a transaction by Rede tid OR by merchant reference. Pass exactly one of tid or reference.

Input parameters:

- `reference` (string): Merchant-side reference used at authorize time
- `tid` (string): Rede transaction id

### `zero_auth` (~118 tokens)

Validate a card without charging (zero-auth / account verification). Returns whether the card is authorizable, without creating a transaction.

Input parameters:

- `cardHolderName` (string)
- `cardNumber` (string): PAN; never log. Prefer storageCard.
- `expirationMonth` (number)
- `expirationYear` (number)
- `onlyStatusCode` (boolean): If true, return status code only (faster)
- `securityCode` (string)
- `storageCard` (string): Token from tokenize_card (alternative to cardNumber)

### `tokenize_card` (~77 tokens)

Tokenize a card for PCI-safe reuse. Returns a token (storageCard) to pass into authorize_transaction.storageCard.

Input parameters:

- `cardHolderName` (string, required)
- `cardNumber` (string, required): PAN; never log
- `expirationMonth` (number, required)
- `expirationYear` (number, required)
- `securityCode` (string, required)

### `delete_token` (~29 tokens)

Delete a previously created card token.

Input parameters:

- `tokenId` (string, required): Token id returned by tokenize_card

### `create_recurrence` (~191 tokens)

Create a native Rede recurrence (subscription). Rede handles retries and cardholder updates automatically.

Input parameters:

- `amount` (number, required): Recurring amount in cents
- `cardHolderName` (string)
- `cardNumber` (string): PAN; never log. Prefer storageCard.
- `endDate` (string): End date YYYY-MM-DD (optional)
- `expirationMonth` (number)
- `expirationYear` (number)
- `frequency` (string, required): Billing frequency (e.g. MONTHLY, WEEKLY, DAILY)
- `reference` (string, required): Merchant-side recurrence reference
- `securityCode` (string)
- `softDescriptor` (string)
- `startDate` (string, required): Start date YYYY-MM-DD
- `storageCard` (string): Token from tokenize_card (alternative to cardNumber)
- `totalRecurrences` (number): Total number of recurrences (omit for open-ended)

### `get_recurrence` (~28 tokens)

Retrieve a recurrence by Rede recurrence id.

Input parameters:

- `id` (string, required): Rede recurrence id

### `disable_recurrence` (~34 tokens)

Disable (cancel) an active recurrence. Stops all future billings.

Input parameters:

- `id` (string, required): Rede recurrence id

### `authorize_debit` (~187 tokens)

Authorize a debit card transaction on Rede. Requires a prior 3DS authentication — pass threeDSecure.embedded=true and a valid threeDSecure reference, or use authorize_with_3ds after authenticate_3ds.

Input parameters:

- `amount` (number, required): Amount in cents
- `cardHolderName` (string)
- `cardNumber` (string): PAN; never log. Prefer storageCard.
- `expirationMonth` (number)
- `expirationYear` (number)
- `reference` (string, required): Merchant-side order reference
- `securityCode` (string)
- `softDescriptor` (string)
- `storageCard` (string): Token from tokenize_card
- `threeDSecure` (object, required): 3DS payload: { embedded: true, onFailure: 'decline' | 'continue', userAgent, device: { ... } }. Required for débito.

### `list_transactions` (~107 tokens)

List transactions in a date range. Useful for reconciliation. Rede paginates results; pass page/size to walk pages.

Input parameters:

- `endDate` (string, required): End date YYYY-MM-DD
- `page` (number): Page index (0-based)
- `size` (number): Page size (default 20)
- `startDate` (string, required): Start date YYYY-MM-DD
- `status` (string): Optional status filter (e.g. AUTHORIZED, CAPTURED, DENIED)

### `get_token` (~45 tokens)

Retrieve metadata for a previously stored card token (brand, last 4, expiration). Does not return the PAN.

Input parameters:

- `tokenId` (string, required): Token id returned by tokenize_card

### `update_recurrence` (~115 tokens)

Update an existing recurrence — change amount, card (storageCard), end date, or pause/resume. Pass only the fields you want to change.

Input parameters:

- `amount` (number): New recurring amount in cents
- `endDate` (string): New end date YYYY-MM-DD
- `id` (string, required): Rede recurrence id
- `softDescriptor` (string)
- `status` (string): Status override: ENABLED | DISABLED | PAUSED
- `storageCard` (string): New card token to charge

### `get_recurrence_transactions` (~56 tokens)

List transactions generated by a recurrence (one row per billing cycle executed).

Input parameters:

- `id` (string, required): Rede recurrence id
- `page` (number): Page index (0-based)
- `size` (number): Page size

### `authenticate_3ds` (~195 tokens)

Initiate a 3DS (EMV 3-D Secure) authentication for a card charge. Returns a threeDSecure reference id and, when required, a challenge URL for cardholder interaction.

Input parameters:

- `amount` (number, required): Amount in cents
- `cardHolderName` (string)
- `cardNumber` (string): PAN; never log. Prefer storageCard.
- `expirationMonth` (number)
- `expirationYear` (number)
- `installments` (number): Number of installments (1 for à vista)
- `paymentMethod` (string, required): 'credit' or 'debit'
- `reference` (string, required): Merchant-side order reference
- `securityCode` (string)
- `storageCard` (string): Token from tokenize_card
- `threeDSecure` (object): 3DS options: { onFailure: 'decline' | 'continue', userAgent, device, returnUrl }

### `get_3ds_status` (~69 tokens)

Check the current status of a 3DS authentication by its reference id. Returns whether the cardholder completed the challenge and the resulting 3DS reference to attach to an authorize call.

Input parameters:

- `threeDSecureId` (string, required): 3DS reference id returned by authenticate_3ds

### `authorize_with_3ds` (~199 tokens)

Authorize a transaction after a successful 3DS authentication, attaching the 3DS reference for liability shift. Works for both credit and debit.

Input parameters:

- `amount` (number, required): Amount in cents
- `capture` (boolean): true = authorize + capture; false = authorize only (credit only)
- `cardHolderName` (string)
- `cardNumber` (string): PAN; never log. Prefer storageCard.
- `expirationMonth` (number)
- `expirationYear` (number)
- `installments` (number): Number of installments (1 for à vista)
- `kind` (string): 'credit' or 'debit'
- `reference` (string, required): Merchant-side order reference
- `securityCode` (string)
- `softDescriptor` (string)
- `storageCard` (string): Token from tokenize_card
- `threeDSecureId` (string, required): 3DS reference id from authenticate_3ds

### `create_boleto` (~156 tokens)

Issue a boleto registrado via Rede. Rede registers the slip with the banking network and returns the typable line (linha digitável) plus the PDF/URL.

Input parameters:

- `amount` (number, required): Amount in cents
- `dueDate` (string, required): Due date YYYY-MM-DD
- `instructions` (array): Optional printed instructions (strings) — e.g. fine/interest after due, discount rules.
- `payer` (object, required): Payer object: { name, document (CPF/CNPJ, digits only), email, address: { street, number, city, state, zipCode } }
- `reference` (string, required): Merchant-side reference (unique per merchant)
- `softDescriptor` (string): Statement descriptor / beneficiary name override

### `get_boleto` (~66 tokens)

Retrieve a boleto by Rede boleto id or by merchant reference. Returns status (REGISTERED, PAID, EXPIRED, CANCELED) and typable line.

Input parameters:

- `id` (string): Rede boleto id
- `reference` (string): Merchant-side reference used at create time

### `cancel_boleto` (~41 tokens)

Cancel an unpaid boleto. Paid boletos cannot be canceled — issue a refund via the payer's bank instead.

Input parameters:

- `id` (string, required): Rede boleto id

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-rede/codespar-mcp-rede#diagnostics

## Score history

- 2026-08-05: 68
- 2026-08-04: 68
- 2026-08-03: 67
- 2026-08-02: 63
- 2026-08-01: 20
- 2026-07-31: 20
- 2026-07-30: 45
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-rede
- Socket report: https://socket.dev/npm/package/@codespar/mcp-rede
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-rede/codespar-mcp-rede/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-rede/codespar-mcp-rede/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-rede/codespar-mcp-rede