Mcp Banco Do Brasil

io.github.codesparPublished by GitHub account codesparv0.1.0-alpha.5Updated Oct 24, 2026

MCP server for Banco do Brasil — Pix, Cobrança (boleto), Conta-Corrente, Arrecadação (OAuth2 + mTLS)

VerifiedSTDIODesktop onlyFinance Business & Commerce

Server details

Identifier: io.github.codespar/mcp-banco-do-brasil
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account codespar for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.codespar%2Fmcp-banco-do-brasil.svg)](https://sourceweft.com/mcp/io.github.codespar%2Fmcp-banco-do-brasil?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server for Banco do Brasil banking APIs, letting an assistant create and manage Pix charges, boletos, DICT keys, and read account balances and bank-st

What you can do: Create, retrieve and list immediate Pix charges (cob), and issue or look up Pix refunds (devolução). Resolve, register and delete DICT keys (CPF, CNPJ, email, phone, EVP). Issue, retrieve and cancel boletos through BB Cobranças. Read the balance and statement transactions of a BB checking account over a date range.
When to use it: For merchants or developers integrating directly with Banco do Brasil for high-volume Pix and boleto operations, or for checking account balances and statements from an assistant. Best suited to sandbox experimentation first, given the alpha status.
Requirements: Runs locally via npm (npx) over stdio. Needs a Banco do Brasil developer contract and OAuth credentials: BB_CLIENT_ID, BB_CLIENT_SECRET and BB_DEVELOPER_APP_KEY. Production Pix v2 requires mTLS, so BB_CERT_PATH and BB_KEY_PATH must point to a client certificate and private key. BB_ENV selects sandbox (default) or production. Network access to BB API and OAuth endpoints.

Before you install

Requires OAuth secrets (BB_CLIENT_SECRET, BB_DEVELOPER_APP_KEY) and an mTLS private key file (BB_KEY_PATH); protect these. Tools move real money: creating Pix charges, issuing refunds, registering or deleting DICT keys, issuing and cancelling boletos, and reading balances and statements. The server is alpha, and boleto, account and statement API paths are unverified best-guesses, so pin exact versions and test in sandbox before production.

Installation

In SourceWeft

Open Mcp Banco Do Brasil in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-banco-do-brasil

MCP server for Banco do Brasil — Brazil's top public bank.

BB exposes one of the broadest public-bank API surfaces in the country across Pix, Cobranças, Conta-Corrente, Open Finance, and Arrecadação. Merchants doing high-volume Pix and boleto operations integrate directly with BB instead of going through a PSP.

Status: alpha (`0.1.0-alpha.1`)

BB's Developer Portal is contract-gated — the full OpenAPI specs are visible only after merchant onboarding. Pix paths follow the BACEN Pix v2 standard; boleto, account, and statement paths are best-guesses based on BB's public marketing pages and conventions shared with peers (Itaú, Santander, Bradesco). Every unverified path is flagged TODO(verify) in src/index.ts. Pin to exact versions during 0.1.x.

Tools (13)

Tool	Purpose
`create_pix_cob`	Create an immediate Pix charge (cob) with QR code.
`get_pix_cob`	Retrieve an immediate Pix charge by its txid.
`list_pix_cob`	List immediate Pix charges (cob) by date range.
`create_pix_devolucao`	Refund (devolução) a previously received Pix.
`get_pix_devolucao`	Retrieve a Pix devolução by its endToEndId + refund id.
`resolve_dict_key`	Resolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix.
`register_dict_key`	Register a DICT key on a BB account owned by the merchant.
`delete_dict_key`	Delete a DICT key owned by the merchant.
`register_boleto`	Issue a boleto via BB Cobranças.
`get_boleto`	Retrieve a boleto by nosso_numero.
`cancel_boleto`	Cancel (baixa) an outstanding boleto before payment.
`get_account_balance`	Retrieve the current balance of a BB conta-corrente (checking) account.
`get_statement`	Retrieve account statement transactions for a BB conta-corrente over a date range.

Install

Environment

bash

BB_CLIENT_ID="..."             # OAuth client_id from developers.bb.com.brBB_CLIENT_SECRET="..."         # OAuth client_secretBB_DEVELOPER_APP_KEY="..."     # gw-dev-app-key — required on most callsBB_CERT_PATH="/abs/path/client.crt"   # mTLS cert (production only)BB_KEY_PATH="/abs/path/client.key"    # mTLS key  (production only)BB_ENV="sandbox"                       # or "production" (default: sandbox)BB_BASE_URL="..."                      # optional; default api.hm.bb.com.br (sandbox) / api.bb.com.brBB_AUTH_URL="..."                      # optional; default https://oauth.hm.bb.com.br/oauth/token (sandbox) / oauth.bb.com.br

BB_CLIENT_ID="..."             # OAuth client_id from developers.bb.com.brBB_CLIENT_SECRET="..."         # OAuth client_secretBB_DEVELOPER_APP_KEY="..."     # gw-dev-app-key — required on most callsBB_CERT_PATH="/abs/path/client.crt"   # mTLS cert (production only)BB_KEY_PATH="/abs/path/client.key"    # mTLS key  (production only)BB_ENV="sandbox"                       # or "production" (default: sandbox)BB_BASE_URL="..."                      # optional; default api.hm.bb.com.br (sandbox) / api.bb.com.brBB_AUTH_URL="..."                      # optional; default https://oauth.hm.bb.com.br/oauth/token (sandbox) / oauth.bb.com.br

Authentication

OAuth2 client_credentials — token endpoint at oauth.{env}.bb.com.br. Bearer cached until ~60s before expiry.
mTLS — required by BACEN for Pix v2 in production. Sandbox typically allows TLS-only; cert/key are optional in sandbox and required in production.
gw-dev-app-key — BB API gateway key, appended as a query param on all calls.

Run

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/banking/banco-do-brasil/README.md at commit d0a519a

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.0-alpha.5LatestSep 27, 2026
v0.1.0-alpha.4Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts