Braspag MCP server

Read from the package source without running it. The installed server may list more.

• capture_sale

  Capture a pre-authorized sale (PUT /sales/{paymentId}/capture). Supports partial capture via amount, and optional serviceTaxAmount (airline / travel merchants).

• create_antifraud_analysiswrite action

  Submit a standalone Antifraud analysis (POST /fraudanalysis) through Braspag's antifraud orchestration (Cybersource Decision Manager or Konduto, depending on merchant wiring). Use when the merchant wants to run a sub-analysis without attaching it to a capture — for example to pre-score a cart. For inline-in-sale antifraud, include the FraudAnalysis block inside create_sale's Payment.

• create_boleto_salewrite action

  Convenience wrapper to create a Boleto sale (POST /sales with Payment.Type=Boleto). Returns BarCodeNumber, DigitableLine, ExpirationDate, and Url for the rendered boleto. Provider is typically 'Bradesco2', 'Santander2', 'BancoDoBrasil2', or 'Simulado' (sandbox).

• create_pix_salewrite action

  Convenience wrapper to create a Pix sale (POST /sales with Payment.Type=Pix). Returns a QrCodeBase64Image and QrCodeString (Pix copia e cola) that the merchant can display. Braspag confirms payment asynchronously via webhook (Notification URL must be configured at merchant level).

• create_recurrentwrite action

  Create a recurrent payment schedule (POST /recurrentPayments). Used for subscriptions and any schedule where Braspag (not the merchant) drives the recurrence.

• create_salewrite action

  Create a sale on the Braspag Transaction API (POST /sales). Pass a full Braspag sale payload. Payment.Type may be CreditCard, DebitCard, Boleto, Pix, or EletronicTransfer. Braspag orchestrates routing across multiple acquirers based on merchant-level rules.

• create_sale_3dswrite action

  Create a 3DS-authenticated credit sale (POST /sales). Same endpoint as create_sale but the CreditCard object carries ExternalAuthentication (Cavv, Xid/Eci, Version, ReferenceId) produced by a prior 3DS 2.0 flow. Use when the merchant already ran Braspag's 3DS 2.0 authentication (bp.mpi.braspag.com.br) and now wants to authorize the transaction with liability shift.

• create_split_capturewrite action

  Capture a previously authorized split sale with overridden per-sub-merchant amounts (PUT /sales/{paymentId}/capture with a SplitPayments body). Use when the original split mix needs adjusting at capture time (e.g. partial shipment from one seller).

• create_split_salewrite action

  Create a sale with marketplace split rules (POST /sales with Payment.SplitPayments). Same endpoint as create_sale, but exposes the split array shape explicitly: each element has a SubordinateMerchantId, Amount (cents), Fares { Mdr, Fee }. Use for marketplace / multi-seller scenarios where Braspag splits the capture across sub-merchants.

• create_zero_authwrite action

  Zero-dollar authorization / card validation (POST /zeroauth). Braspag routes a $0 (or minimum-amount) authorization through the acquirer to confirm the card is live and not blocked, without committing funds. Returns Valid=true/false plus ReturnCode/ReturnMessage. Useful before saving a card-on-file for future recurrence.

• delete_card_tokenwrite action

  Delete a Cartão Protegido vault token (DELETE /card/{token}). After deletion the token can no longer be used to create sales. Use when the cardholder requests removal or the card has been reported stolen.

• disable_recurrent

  Deactivate a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Deactivate). Stops future charges; does not refund historical ones.

• get_card_token

  Retrieve the stored card data associated with a Cartão Protegido token (GET /card/{token}). Returns masked card fields + brand + expiration.

• get_recurrent

  Get a recurrent payment's configuration and history (GET /recurrentPayments/{recurrentPaymentId} — Query API).

• get_sale

  Get sale detail by PaymentId (GET /sales/{paymentId} — Query API).

• get_sale_by_order_idwrite action

  Look up sale(s) by MerchantOrderId (GET /sales?merchantOrderId=X — Query API). Returns an array of PaymentIds matching the merchant order.

• reactivate_recurrent

  Reactivate a previously deactivated recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Reactivate). Resumes future scheduled charges from the next configured date.

• tokenize_card

  Tokenize a card into the Braspag vault / Cartão Protegido (POST /card). Returns a reusable token that can substitute CardNumber on future sales — reduces PCI scope and enables cross-acquirer reuse.

• update_recurrent_amountwrite action

  Update the charged amount on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/Amount). Body carries the new amount in cents.

• update_recurrent_next_paymentwrite action

  Update the NextPaymentDate on a recurrent payment (PUT /recurrentPayments/{recurrentPaymentId}/NextPaymentDate). Useful to skip a cycle or realign billing dates. Body carries the new date in YYYY-MM-DD.

• update_recurrent_paymentwrite action

  Update the Payment (CreditCard + Customer) on a recurrent schedule (PUT /recurrentPayments/{recurrentPaymentId}/Payment). Used when the card on file expires or the customer updates their payment method. Pass the full replacement Payment object.

• void_sale

  Void / cancel a sale (PUT /sales/{paymentId}/void). Supports full void (omit amount) or partial void.

• Code scan3 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 29 days ago15/15
• Maintainer identityregistry namespace matches repository owner7/10

Safety score

82/100

higher than 75% of 2,174 E-commerce servers

Tools

22

the typical E-commerce server has 6

Tools that change things

64%

typical: 0%. Fewer write tools means less an agent can break

GitHub stars

271

more than 95% of 1,047 E-commerce servers

Downloads a week

25

more than 13% of 411 E-commerce servers with a package

Braspag: common questions

Is Braspag MCP server safe?

Mostly: it is graded B (82/100). Read the Braspag safety report

How do I install Braspag?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Braspag need an API key?

Yes. The registry entry asks for BRASPAG_MERCHANT_ID, BRASPAG_MERCHANT_KEY.

Is Braspag maintained?

The last commit was 67 days ago (2026-08-29). The latest release is v0.2.2.

What can I use instead of Braspag?

Servers from other publishers that do the same job: Vlak MCP server, Yandex Lavka MCP server and Picnic MCP server.

How does Braspag compare with other E-commerce MCP servers?

safety score 82/100 (higher than 75% of 2,174 E-commerce servers); tools 22 (the typical E-commerce server has 6); tools that change things 64% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.