io.github.codespar/mcp-santander

NPM · @CODESPAR/MCP-SANTANDER · SCANNED AUG 4

MCP server for Santander Brasil — Pix, Cobrança (boleto), Arrecadação, Extrato (OAuth2 + mTLS)

Available components

+23 this week 69 69 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security83

No malware found by supply-chain analysis.Pass
CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 42 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability76

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 2540 tokens (~110/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management30

Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @codespar/mcp-santander

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add codespar-mcp-santander -- npx -y @codespar/mcp-santander

# add to Codex CLI

codex mcp add codespar-mcp-santander -- npx -y @codespar/mcp-santander

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-santander": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-santander"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add codespar-mcp-santander --command npx --arg -y --arg @codespar/mcp-santander

# ~/.hermes/config.yaml

mcp_servers:
  codespar-mcp-santander:
    command: "npx"
    args: ["-y", "@codespar/mcp-santander"]

// mcp.json

{
  "mcpServers": {
    "codespar-mcp-santander": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-santander"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

4 Aug 26 +4
- CVE-2026-69207 affects this package: medium ▼ security
- Known CVEs: partial → fail ▼ security
- Stability: unverified → 0.30 ▲ functional
2 Aug 26 +39
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
1 Aug 26 +5
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- MCP protocol: unverified → pass ▲ functional
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Aug 2026 · Analysed npm/@codespar/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding

ID	CVE	Severity	Vector	Fix available
GHSA-8j4g-w8fx-2239	CVE-2026-69207	medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	yes

Dependencies 94 packages

94 packages in the resolved dependency tree · 94 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 23 exposed · ~2,473 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

arrecadacao_pay ~145

Pay a utility, tax, or concessionária bill via Santander Arrecadação / Pagamento de Contas. Works with barcode (código de barras) or linha digitável.

Input Output Examples

Name	Type	Req	Description
amount	string	—	Amount in BRL major units. Required when the barcode does not carry a fixed amount.
barcode	string	yes	44-digit barcode or 47/48-digit linha digitável (digits only)
due_date	string	—	Due date ISO-8601 (for validation against the barcode)
idempotency_key	string	yes	Merchant-side idempotency key (UUID recommended)
payer_account	string	yes	Merchant account to debit

No output schema declared.

No examples provided.

cancel_boleto ~64

Cancel (baixa) an outstanding boleto before payment.

Input Output Examples

Name	Type	Req	Description
bill_id	string	yes	Santander bill_id / bank_slip identifier
reason	string	—	Cancellation reason code or free text
workspace_id	string	yes	Santander workspace_id that owns the boleto

No output schema declared.

No examples provided.

create_boleto ~209

Issue a boleto via Santander Cobrança (collection_bill_management v2). Requires a pre-provisioned workspace_id that binds the covenant and webhook config. Returns bill_id, linha_digitável, barcode, and PDF URL.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in BRL major units, e.g. '150.00'
due_date	string	yes	Due date ISO-8601 (YYYY-MM-DD)
fine	object	—	Multa (fine after due date): { percentage?, amount?, days_after_due? }
instructions	array	—	Free-text instructions printed on the boleto
interest	object	—	Juros (daily interest after due date): { percentage?, amount? }
our_number	string	—	Nosso_numero. Omit to have Santander assign one.
payer	object	yes	Payer (sacado) data
workspace_id	string	yes	Santander workspace_id (defines convênio + webhook). Provision once via the Developer Portal.

No output schema declared.

No examples provided.

create_openfinance_consent ~156

Create an Open Finance consent (BACEN-regulated) for data access or payment initiation against a third-party's Santander account. Returns a consent_id and authorization_url the end user must approve.

Input Output Examples

Name	Type	Req	Description
consent_type	string	yes	DATA (read account info) \| PAYMENT (initiate a Pix)
expiration	string	—	Consent expiration ISO-8601 (max 12 months for data)
payment	object	—	Required for consent_type=PAYMENT: { amount, creditor: { document, name, account } }
permissions	array	—	Open Finance permission strings, e.g. ['ACCOUNTS_READ','RESOURCES_READ']
user_document	string	yes	End-user CPF/CNPJ digits only

No output schema declared.

No examples provided.

create_pix_cobv ~210

Create a Pix charge with due date (cobv — cobrança com vencimento). Used for boleto-replacement flows: the payer sees a Pix QR with a due date, fine, and interest. Requires payer identification.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Original amount in BRL major units, e.g. '250.00'
description	string	—	Payer-visible description
discount	object	—	Desconto: { modalidade, descontoDataFixa }
due_date	string	yes	Due date ISO-8601 (YYYY-MM-DD)
fine	object	—	Multa: { modalidade, valorPerc }
interest	object	—	Juros: { modalidade, valorPerc }
payer	object	yes	Payer identification (mandatory for cobv)
txid	string	yes	26-35 char alphanumeric txid chosen by the merchant
validity_after_due	number	—	Days the QR remains payable after due_date (default 30)

No output schema declared.

No examples provided.

create_pix_qr ~127

Create a dynamic Pix charge with QR code (cob). Returns the txid, copy-paste EMV payload, and location URL.

Input Output Examples

Name	Type	Req	Description
additional_info	array	—	Optional free-text key/value info shown to the payer
amount	string	yes	Amount in BRL major units, e.g. '99.90'
description	string	—	Payer-visible description
expires_in	number	—	QR lifetime in seconds (default 3600)
payer	object	—	Payer identification (required by BCB for cobv / common for cob)

No output schema declared.

No examples provided.

delete_dict_key ~47

Remove (unregister) a DICT key previously registered for the merchant. Does not affect received Pix that used the key historically.

Input Output Examples

Name	Type	Req	Description
key	string	yes	DICT key to remove

No output schema declared.

No examples provided.

download_boleto_pdf ~78

Fetch the PDF (second copy / segunda via) of a registered boleto. Returns a base64-encoded PDF payload or a time-limited URL, depending on Santander's workspace config.

Input Output Examples

Name	Type	Req	Description
bill_id	string	yes	Santander bill_id / bank_slip identifier
workspace_id	string	yes	Santander workspace_id that owns the boleto

No output schema declared.

No examples provided.

get_account_balance ~36

Get current available and blocked balance for a Santander merchant account.

Input Output Examples

Name	Type	Req	Description
account	string	yes	Agência-conta identifier of the merchant account

No output schema declared.

No examples provided.

get_boleto ~59

Retrieve a boleto by its Santander bill_id (SONDA query via collection_bill_management v2).

Input Output Examples

Name	Type	Req	Description
bill_id	string	yes	Santander bill_id / bank_slip identifier
workspace_id	string	yes	Santander workspace_id that owns the boleto

No output schema declared.

No examples provided.

get_oauth_token ~43

Mint or return a cached OAuth2 client_credentials bearer token for the Santander Developer Portal. Exposed so agents can inspect token freshness; normal tool calls obtain tokens implicitly.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_pix ~51

Retrieve a Pix transaction by its BCB endToEndId (E<ispb><yyyymmddhhmm><sequence>).

Input Output Examples

Name	Type	Req	Description
end_to_end_id	string	yes	BCB endToEndId

No output schema declared.

No examples provided.

get_pix_cob ~50

Retrieve a Pix immediate charge (cob) by its txid. Returns status, EMV payload, and location.

Input Output Examples

Name	Type	Req	Description
txid	string	yes	Merchant-chosen txid of the cob

No output schema declared.

No examples provided.

get_statement ~97

Retrieve account statement transactions for a given period. Paginated.

Input Output Examples

Name	Type	Req	Description
account	string	yes	Agência-conta identifier of the merchant account
from	string	yes	Start date ISO-8601 (YYYY-MM-DD)
page	number	—	Page number (1-indexed)
page_size	number	—	Items per page (default 50)
to	string	yes	End date ISO-8601 (YYYY-MM-DD)

No output schema declared.

No examples provided.

list_pix_cob ~135

List Pix immediate charges (cob) created in a given period. Paginated; filter by status optional.

Input Output Examples

Name	Type	Req	Description
from	string	yes	Start timestamp ISO-8601 (inicio)
page	number	—	Page number (paginacao.paginaAtual)
page_size	number	—	Items per page (paginacao.itensPorPagina)
status	string	—	Filter by cob status: ATIVA \| CONCLUIDA \| REMOVIDA_PELO_USUARIO_RECEBEDOR \| REMOVIDA_PELO_PSP
to	string	yes	End timestamp ISO-8601 (fim)

No output schema declared.

No examples provided.

list_pix_received ~135

List received Pix (Pix recebidos) in a given period. Used for reconciliation of inbound payments, including those without an associated cob.

Input Output Examples

Name	Type	Req	Description
cnpj	string	—	Optional: filter by payer CNPJ digits only
cpf	string	—	Optional: filter by payer CPF digits only
from	string	yes	Start timestamp ISO-8601 (inicio)
page	number	—	Page number
page_size	number	—	Items per page
to	string	yes	End timestamp ISO-8601 (fim)
txid	string	—	Optional: filter by txid of originating cob

No output schema declared.

No examples provided.

refund_pix ~109

Refund (devolução) a previously received Pix. Must reference the original endToEndId and a merchant-side refund id.

Input Output Examples

Name	Type	Req	Description
amount	string	—	Refund amount in BRL major units. Omit for full refund.
end_to_end_id	string	yes	Original Pix endToEndId to refund
reason	string	—	Free-text reason (stored by BCB for audit)
refund_id	string	yes	Merchant-side refund identifier (alphanumeric up to 35 chars)

No output schema declared.

No examples provided.

register_dict_key ~117

Register a new DICT key for one of the merchant's Santander accounts. BACEN enforces ownership proof (the account document must match the key for CPF/CNPJ keys).

Input Output Examples

Name	Type	Req	Description
account	string	yes	Merchant agência-conta that the key will point to
account_type	string	—	CACC (checking) \| SVGS (savings)
key	string	—	Key value (omit for EVP — BCB generates a UUID)
key_type	string	yes	CPF \| CNPJ \| EMAIL \| PHONE \| EVP

No output schema declared.

No examples provided.

resolve_dict_key ~92

Resolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix. Subject to BCB rate limits per consenting payer.

Input Output Examples

Name	Type	Req	Description
key	string	yes	DICT key — CPF, CNPJ, email, phone (+55...), or EVP UUID
payer_document	string	—	Merchant / end-payer CPF/CNPJ for BCB audit logging

No output schema declared.

No examples provided.

send_pix ~136

Initiate an outbound Pix payment from the merchant's Santander account. Amount in BRL major units (e.g. '10.50').

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in BRL major units with two decimals, e.g. '10.50'
description	string	—	Free-text description shown on the statement (max 140 chars)
idempotency_key	string	yes	Merchant-side idempotency key (UUID recommended)
payee	object	yes	Payee identification — either a DICT key or explicit bank account
payer_account	string	yes	Merchant account to debit (agência-conta)

No output schema declared.

No examples provided.

send_ted ~127

Initiate a TED transfer from a Santander merchant account to an account at another bank. For same-day settlement within the TED cutoff window.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in BRL major units, e.g. '5000.00'
idempotency_key	string	yes	Merchant-side idempotency key (UUID recommended)
payee	object	yes	Payee bank account
payer_account	string	yes	Merchant account to debit (agência-conta)
purpose_code	string	—	BACEN TED finalidade code (default 1 - Crédito em Conta)

No output schema declared.

No examples provided.

transfer_internal ~126

Transfer between two Santander accounts (TEF / mesma instituição). Settles instantly and is fee-free for most covenants.

Input Output Examples

Name	Type	Req	Description
amount	string	yes	Amount in BRL major units
description	string	—	Free-text description on the statement
idempotency_key	string	yes	Merchant-side idempotency key (UUID recommended)
payee_account	string	yes	Destination Santander account (agência-conta)
payee_document	string	—	Destination owner CPF/CNPJ digits only
payer_account	string	yes	Source merchant account (agência-conta)

No output schema declared.

No examples provided.

update_pix_cob ~124

Update (PATCH) an existing Pix immediate charge. Typical uses: change status to REMOVIDA_PELO_USUARIO_RECEBEDOR, adjust amount or payer info on an ATIVA charge.

Input Output Examples

Name	Type	Req	Description
amount	string	—	New original amount (if editable)
description	string	—	Updated payer-visible description
payer	object	—	Updated payer data (document, name)
status	string	—	New status, e.g. REMOVIDA_PELO_USUARIO_RECEBEDOR
txid	string	yes	txid of the cob to update

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 4 Aug

Day	Score
27 Jul	46
28 Jul	46
30 Jul	46
31 Jul	21
1 Aug	26
2 Aug	65
3 Aug	65
4 Aug	69