Mcp C6

io.github.codesparPublished by GitHub account codesparv0.1.0-alpha.4Updated Oct 24, 2026

DEPRECATED: no live endpoint (baas.c6bank.com.br does not resolve)

VerifiedSTDIODesktop onlyFinanceDeveloper ToolsBusiness & Commerce

Overview

AI-generated overview

A deprecated local MCP server for C6 Bank that would let an assistant create Pix charges, boletos, and read account data, but reaches no live service.

What you can do
It exposes 14 tools for C6 Bank merchant banking: minting an OAuth2 client_credentials token, creating and retrieving Pix immediate charges (cob) and due-date charges (cobv), resolving and registering or deleting DICT keys, issuing, retrieving and cancelling boletos, and reading account balance and statements. The README states the package is deprecated on npm and that no tool in this server reaches a service, because the production and sandbox hosts do not resolve in DNS. The endpoint paths were best-guesses and are flagged TODO(verify) in the source.
When to use it
Not for production or evaluation use: the registry description and README both mark it deprecated with no live endpoint, and the package is kept for reference only. It may be of interest only to someone studying how a C6 Bank Pix and boleto MCP integration was sketched, or who has a working endpoint to point it at.
Requirements
Runs locally over stdio as the npm package @codespar/mcp-c6, so Node.js is needed. Requires C6_CLIENT_ID, C6_CLIENT_SECRET, C6_CERT_PATH and C6_KEY_PATH, plus optional C6_ENV (sandbox or production) and C6_BASE_URL. The certificate and key come from the C6 Developer Portal after a merchant contract is signed. Desktop only.
Before you install
The server asks for an OAuth client secret (C6_CLIENT_SECRET) and the path to an mTLS private key (C6_KEY_PATH), both sensitive credentials. Its tools would create, cancel and delete real banking objects such as Pix charges, DICT keys and boletos, and read balances and statements, so mistakes could move or expose money. The README says no tool reaches a service and the package is deprecated, so it should not be relied on.

Installation

In SourceWeft

  1. Open Mcp C6 in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-c6

Deprecated: no live endpoint. Measured on 2026-09-27 against two public DNS resolvers (8.8.8.8 and 1.1.1.1): baas.c6bank.com.br (production) and baas-sandbox.c6bank.com.br (sandbox) do not resolve in DNS. C6's developer portal now documents baas-api.c6bank.info (production) and baas-api-sandbox.c6bank.info (sandbox), both behind mTLS; this server's paths and auth were not written against them and have not been checked. No tool in this server reaches a service. The package is deprecated on npm and stays in this repository for reference only. If you have a working endpoint, point the server at it with C6_BASE_URL. To bring the package back, open an issue in mcp-dev-latam with the provider's documented base URL.

MCP server for C6 Bank — a top Brazilian digital bank, JPMorgan-backed.

C6 ranks among the largest Brazilian digital banks by retail account base and has expanded aggressively into SMB and corporate banking. Merchants integrate directly for Pix, boleto, and account-data flows.

Status: alpha (0.1.0-alpha.1)

C6's Developer Portal is contract-gated — full OpenAPI specs for Pix, Cobrança, and account APIs are only visible to onboarded merchants. The endpoint paths in this server are best-guesses based on (a) the BACEN Pix v2 standard, (b) C6's public marketing pages, and (c) conventions shared across Itaú / Santander / Bradesco. Every unverified path is flagged TODO(verify) in the source.

Pin to exact versions during 0.1.x; paths will be corrected to match the portal spec once an onboarded merchant can validate.

Tools (14)

ToolPurpose
get_oauth_tokenMint or return a cached OAuth2 client_credentials bearer token for the C6 Developer Portal.
create_pix_cobCreate a Pix immediate charge (cob) with QR code.
get_pix_cobRetrieve a Pix immediate charge (cob) by its txid.
list_pix_cobList Pix immediate charges (cob) registered by the merchant within a date range.
create_pix_cobvCreate a Pix charge with due date (cobv) — used for boleto-like Pix where the payer can pay at or after a d...
get_pix_cobvRetrieve a Pix due-date charge (cobv) by its txid.
resolve_dict_keyResolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix.
register_pix_keyRegister a DICT key (CPF, CNPJ, email, phone, or EVP) on a C6 account owned by the merchant.
delete_pix_keyDelete a DICT key owned by the merchant.
create_boletoIssue a boleto via C6 Cobrança.
get_boletoRetrieve a boleto by its C6 identifier (id or nosso_numero).
cancel_boletoCancel (baixa) an outstanding boleto before payment.
get_account_balanceRetrieve the current balance snapshot for a merchant account.
get_statementRetrieve account statement transactions for a given period.

Install

bash
npm install @codespar/[email protected]

Environment

bash
C6_CLIENT_ID="..."        # OAuth client_id from C6's Developer PortalC6_CLIENT_SECRET="..."    # OAuth client_secretC6_CERT_PATH="/abs/path/to/client.crt"   # mTLS client certificateC6_KEY_PATH="/abs/path/to/client.key"    # mTLS private keyC6_ENV="sandbox"                          # or "production" (default: sandbox)

Authentication

Two factors are both required on every call:

  1. OAuth2 client_credentials — the server calls the token endpoint, caches the bearer until ~60s before expiry, and attaches Authorization: Bearer <token> to downstream calls.
  2. mTLS — BACEN mandates mutual TLS for Pix v2, and C6 enforces it across product families. The server loads the client certificate and private key from the paths you set, builds a Node https.Agent, and routes every request through it.

You obtain the cert + key bundle from the C6 Developer Portal after your merchant contract is signed.

Run

bash
# stdio (default)npx @codespar/mcp-c6

Caveats

  • Paths are unverified. See the TODO(verify) markers in src/index.ts. Onboarded merchants should validate against their portal-issued OpenAPI spec and open a PR.
  • Sandbox host is a guess. C6 issues a sandbox subdomain per merchant; override by editing BASE_URL if your provisioned sandbox URL differs.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/banking/c6/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.1.0-alpha.4LatestSep 27, 2026
  2. v0.1.0-alpha.3Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts