# io.github.codespar/mcp-transbank (npm · @codespar/mcp-transbank)

MCP server for Transbank — Chile dominant card acquirer (Webpay Plus / Mall / OneClick)

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-transbank`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-transbank/codespar-mcp-transbank.md), [page](https://verifymcp.io/servers/codespar-mcp-transbank/codespar-mcp-transbank)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-transbank`
- Version: `0.2.0-alpha.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1521 tokens (~80/item across 19 items; 19 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-transbank -- npx -y @codespar/mcp-transbank
```

### Codex

```bash
codex mcp add codespar-mcp-transbank -- npx -y @codespar/mcp-transbank
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-transbank": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-transbank"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-transbank --command npx --arg -y --arg @codespar/mcp-transbank
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-transbank:
    command: "npx"
    args: ["-y", "@codespar/mcp-transbank"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-transbank": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-transbank"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, 0)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 69, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 65, +44)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 21, +16)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-31 (score 5, −23)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (19)

### `webpay_create_transaction` (~121 tokens)

Create a Webpay Plus transaction. Returns { token, url } — redirect the user to url?token_ws=<token> to complete payment. After the user returns to return_url, call webpay_commit_transaction.

Input parameters:

- `amount` (number, required): Amount in CLP (integer, no decimals)
- `buy_order` (string, required): Merchant-side order id (max 26 chars)
- `return_url` (string, required): URL Transbank redirects the user back to after payment
- `session_id` (string, required): Merchant-side session id (max 61 chars)

### `webpay_commit_transaction` (~53 tokens)

Commit a Webpay Plus transaction after the user has returned from the Webpay flow. Must be called to actually charge the card.

Input parameters:

- `token` (string, required): Webpay token (token_ws query param on return)

### `webpay_get_transaction_status` (~34 tokens)

Get the current status of a Webpay Plus transaction by token.

Input parameters:

- `token` (string, required): Webpay token

### `webpay_refund_transaction` (~57 tokens)

Refund a committed Webpay Plus transaction. Full refund if amount equals original; partial otherwise.

Input parameters:

- `amount` (number, required): Refund amount in CLP (integer)
- `token` (string, required): Webpay token of the original transaction

### `webpay_increase_amount` (~84 tokens)

Capture a previously authorized Webpay Plus transaction (partial-capture / deferred-capture flow).

Input parameters:

- `authorization_code` (string, required): Authorization code returned at authorization time
- `buy_order` (string, required): Original buy_order
- `capture_amount` (number, required): Amount to capture in CLP (integer)
- `token` (string, required): Webpay token of the authorized transaction

### `webpay_capture_transaction` (~100 tokens)

Deferred-capture for a previously authorized Webpay Plus transaction. Uses the official PUT /capture endpoint — prefer this over webpay_increase_amount for standard deferred-capture flows.

Input parameters:

- `authorization_code` (string, required): Authorization code returned at authorization time
- `buy_order` (string, required): Original buy_order
- `capture_amount` (number, required): Amount to capture in CLP (integer)
- `token` (string, required): Webpay token of the authorized transaction

### `webpay_mall_create_transaction` (~129 tokens)

Create a Webpay Mall transaction — one parent buy_order split across several seller commerce codes. Returns { token, url } exactly like Webpay Plus. Each details entry is a child charge with its own commerce_code, buy_order, and amount.

Input parameters:

- `buy_order` (string, required): Parent (mall) buy_order (max 26 chars)
- `details` (array, required): Child charges, one per mall seller
- `return_url` (string, required): URL Transbank redirects the user back to after payment
- `session_id` (string, required): Merchant-side session id (max 61 chars)

### `webpay_mall_commit_transaction` (~49 tokens)

Commit a Webpay Mall transaction after the user has returned. Charges all child commerce codes at once.

Input parameters:

- `token` (string, required): Webpay token (token_ws query param on return)

### `webpay_mall_get_transaction_status` (~40 tokens)

Get the status of a Webpay Mall transaction by token (includes per-child details).

Input parameters:

- `token` (string, required): Webpay token

### `webpay_mall_refund_transaction` (~91 tokens)

Refund one child seller of a Webpay Mall transaction. Must specify which child (commerce_code + buy_order) to refund.

Input parameters:

- `amount` (number, required): Refund amount in CLP (integer)
- `buy_order` (string, required): Child buy_order to refund
- `commerce_code` (string, required): Child commerce_code
- `token` (string, required): Webpay token of the original mall transaction

### `webpay_mall_capture_transaction` (~95 tokens)

Deferred-capture for one child seller inside a Webpay Mall transaction.

Input parameters:

- `authorization_code` (string, required): Authorization code returned at authorization time
- `buy_order` (string, required): Child buy_order
- `capture_amount` (number, required): Amount to capture in CLP (integer)
- `commerce_code` (string, required): Child commerce_code to capture
- `token` (string, required): Webpay token of the authorized mall transaction

### `oneclick_create_inscription` (~94 tokens)

Start a OneClick Mall card-enrollment flow. Returns { token, url_webpay } — redirect the user to complete enrollment. After return to response_url, call oneclick_finish_inscription.

Input parameters:

- `email` (string, required): User email
- `response_url` (string, required): URL Transbank redirects the user back to after enrollment
- `username` (string, required): Merchant-side stable user identifier (max 40 chars)

### `oneclick_finish_inscription` (~58 tokens)

Finalize a OneClick Mall enrollment after the user has returned. Returns the tbk_user token to store and reuse in oneclick_authorize.

Input parameters:

- `token` (string, required): Inscription token (TBK_TOKEN query param on return)

### `oneclick_delete_inscription` (~58 tokens)

Delete (revoke) a stored OneClick Mall card for a user.

Input parameters:

- `tbk_user` (string, required): Stored-card token from oneclick_finish_inscription
- `username` (string, required): Same merchant-side username used at enrollment

### `oneclick_authorize` (~109 tokens)

Charge a stored OneClick Mall card across one or more mall merchant codes. Each details entry is a separate child charge with its own commerce_code, buy_order, amount, and installments_number.

Input parameters:

- `buy_order` (string, required): Parent (mall) buy_order (max 26 chars)
- `details` (array, required): Child charges, one per mall seller
- `tbk_user` (string, required): Stored-card token
- `username` (string, required): Merchant-side username associated with the tbk_user

### `oneclick_capture` (~90 tokens)

Capture a previously authorized OneClick Mall charge (deferred-capture flow). One capture per child detail.

Input parameters:

- `authorization_code` (string, required): Authorization code returned from oneclick_authorize
- `buy_order` (string, required): Child buy_order used at authorize
- `capture_amount` (number, required): Amount to capture in CLP (integer)
- `commerce_code` (string, required): Child commerce_code used at authorize

### `oneclick_refund` (~90 tokens)

Refund a OneClick Mall charge. Parent buy_order identifies the mall transaction; detail_buy_order + commerce_code pinpoint the child to refund.

Input parameters:

- `amount` (number, required): Refund amount in CLP (integer)
- `buy_order` (string, required): Parent (mall) buy_order
- `commerce_code` (string, required): Child commerce_code
- `detail_buy_order` (string, required): Child buy_order to refund

### `oneclick_status` (~37 tokens)

Get the status of a OneClick Mall transaction by parent buy_order.

Input parameters:

- `buy_order` (string, required): Parent (mall) buy_order

### `oneclick_get_transaction_by_buy_order` (~65 tokens)

Look up a OneClick Mall transaction by parent buy_order. Functionally identical to oneclick_status — provided as an explicit name for agents that follow the 'get by identifier' naming convention.

Input parameters:

- `buy_order` (string, required): Parent (mall) buy_order

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-transbank/codespar-mcp-transbank#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 69
- 2026-08-02: 65
- 2026-08-01: 21
- 2026-07-31: 5
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-transbank
- Socket report: https://socket.dev/npm/package/@codespar/mcp-transbank
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-transbank/codespar-mcp-transbank/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-transbank/codespar-mcp-transbank/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-transbank/codespar-mcp-transbank