MCP.Market

Nupay MCP server

by codespar·io.github.codespar/mcp-nupay·v0.2.2·271 stars
No reviews yet

MCP server for NuPay — Nubank merchant checkout: Pix + wallet one-click for 100M+ BR users

B82/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
Growing

271 stars

Reviews

Write one

Nobody has reviewed Nupay yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Nupay tools (22, 8 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • backchannel_complete

    Complete a CIBA/OTP flow by submitting the OTP the shopper received. Returns the access_token once validated.

  • backchannel_resend_otp

    Resend the OTP to the shopper for an in-flight authorization ticket.

  • backchannel_start

    Start a CIBA / OTP pre-authorization for a shopper. Sends a push to Nubank app (CIBA) or triggers an OTP SMS. Returns an auth_req_id/ticket to complete later.

  • cancel_paymentwrite action

    Cancel a payment that has not yet been captured/settled.

  • create_paymentwrite action

    Create a NuPay checkout payment. Returns pspReferenceId + the redirect/QR payload the shopper needs to complete the charge (NuPay wallet push or Pix). Use merchant-key auth.

  • create_preauth_paymentwrite action

    Create a NuPay payment using a pre-authorized Bearer access_token (pre-auth / recurrence flow). Same body as create_payment, but auth is Bearer instead of merchant-key. Use after exchange_token.

  • create_recipientwrite action

    Register a final beneficiary (required for regulatory split payments). Up to 10 recipients can later be attached to a payment.

  • create_refundwrite action

    Refund a settled payment (full or partial). Idempotent via transactionRefundId.

  • delete_recipientwrite action

    Remove a registered recipient. Will fail if the recipient is currently attached to in-flight payments.

  • exchange_token

    Exchange an authorization_code or refresh_token at POST /v1/token. Expects an already-signed JWT client_assertion. Returns access_token (5 min) + refresh_token for recurrence. Access tokens are scoped (openid, charge, refund, payment_conditions).

  • get_payment

    Retrieve full payment details (amount, shopper, items, current status, timestamps) by pspReferenceId. Use this for richer detail than get_payment_status.

  • get_payment_status

    Retrieve a payment's status by pspReferenceId.

  • get_recipient

    Retrieve a registered recipient by referenceId.

  • get_refundwrite action

    Retrieve refund status by pspReferenceId + refundId.

  • get_settlement

    Retrieve a single settlement (payout batch) including the list of underlying transactions.

  • list_payments_by_date

    List payments created within a date range. Supports cursor pagination via limit + offset. Useful for reconciliation and reporting.

  • list_recipients

    List registered recipients (final beneficiaries) for the merchant. Supports pagination.

  • list_refunds

    List all refunds issued against a given payment.

  • list_settlements

    List settlement reports (payouts to the merchant bank account) within a date range. Use for reconciliation.

  • query_payment_conditions

    Query available installment/payment conditions for a given amount and (optionally) shopper CPF. Use before rendering checkout so the agent can pick the best offer.

  • revoke_token

    Revoke an issued access_token or refresh_token at POST /v1/token/revoke. Use to terminate a recurrence mandate or after card-token deletion. Form-encoded; expects a signed JWT client_assertion.

  • update_recipientwrite action

    Update a registered final beneficiary (name, document, country, type). referenceId is the path key and cannot be changed.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan5 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 29 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Nupay compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 63% of 48,255 servers
Tools
22
the typical server has 7
Tools that change things
36%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
271
more than 95% of 28,688 servers

What its tools let an agent do: 13 read · 4 create · 2 change · 3 delete

Install Nupay in Claude Code, Cursor or VS Code

Runs npx -y @codespar/mcp-nupay on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-nupay -- npx -y @codespar/mcp-nupay
Add to Cursor

What the publisher says

From the Nupay repository's README, as published. We do not edit it. Read it on GitHub

MCP Dev LATAM 🌎 Every commerce API your AI agent needs to run a business in Latin America. Brazil 🇧🇷 · Mexico 🇲🇽 · Argentina 🇦🇷 · Colombia 🇨🇴 · Chile 🇨🇱 · Peru 🇵🇪 · plus 4 agentic payment protocols. MCP servers for LATAM commerce · live in the official MCP Registry · MIT License Machine-readable catalog: codespar.dev/api/servers Catalog · Quick Start · Agentic Protocols · All Servers · Contribute

The Problem

AI agents can write code, analyze data, and chat. But they can't operate a business — collect payments, issue invoices, ship products, or notify customers. Especially not in Latin America, where every service has its own API, auth pattern, and quirks (mTLS for BACEN Pix v2, JWT-RSA for STP-SPEI, AFIP web services, contract-gated developer portals, and on).

Meanwhile, four agentic payment protocols are shipping in parallel — checkout protocols (Stripe ACP, Google UCP), authorization layers (AP2), and micropayment rails (x402) — and none of them compose cleanly with each other or with the regional rails businesses actually run on.

MCP Dev LATAM bridges both gaps. Traditional LATAM services + the new agentic payment protocols, all accessible through a single MCP interface.

The Solution

Each MCP server in this repo wraps a real provider — payments, fiscal, logistics, messaging, banking, ERP, identity, fraud, crypto, and the agentic protocols — so your agent can operate a complete business workflow.

🛒 Customer places order
  → 💳 Agent charges via Pix (Asaas / Mercado Pago / Zoop)
  → 📄 Agent issues NFe (Nuvem Fiscal / Focus NFe / NFe.io)
  → 📦 Agent generates shipping label (Melhor Envio / Skydropx)
  → 📱 Agent sends tracking via WhatsApp (Z-API / WhatsApp Cloud)
  → 📊 Agent records in ERP (Omie / Bling / Tiny)
  → 🏦 Agent reconciles balance (Stark Bank / Itaú / BTG)

Six systems. Zero human intervention. One agent.

Agentic Payment Protocols

Four servers for the emerging agentic payment stack:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Nupay: common questions

Is Nupay MCP server safe?
Mostly: it is graded B (82/100). Read the Nupay safety report
How do I install Nupay?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Nupay need an API key?
Yes. The registry entry asks for NUPAY_MERCHANT_TOKEN, NUPAY_CLIENT_SECRET.
Is Nupay maintained?
The last commit was 67 days ago (2026-08-29). The latest release is v0.2.2.
How does Nupay compare with other MCP servers?
safety score 82/100 (higher than 63% of 48,255 servers); tools 22 (the typical server has 7); tools that change things 36% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

More from codespar →