Mcp Itau

io.github.codesparPublished by GitHub account codesparv0.2.0-alpha.3Updated Oct 24, 2026

MCP server for Itaú Unibanco — Pix, Cobrança (boleto), Arrecadação, Extrato (OAuth2 + mTLS)

VerifiedSTDIODesktop onlyFinanceBusiness & Commerce

Overview

AI-generated overview

Local MCP server exposing Itaú Unibanco banking APIs — Pix, boleto, arrecadação and statements — to an assistant via OAuth2 and mTLS.

What you can do
Authenticate against the Itaú Developer Portal and obtain a cached OAuth2 bearer token for downstream calls (get_oauth_token). Send, retrieve and refund Pix payments, create immediate and due-date Pix charges, and list charges by date range. Resolve, register, list and delete DICT keys (CPF, CNPJ, email, phone, EVP). Issue, retrieve, cancel and download the PDF of boletos, and pay utility, tax or concessionária bills via Arrecadação. Read account statements, query tariff schedules, list DDA bills, send TED transfers, move funds between Itaú accounts, and schedule future-dated payments.
When to use it
For Brazilian merchants or developers already onboarded with Itaú who want an assistant to drive Pix, boleto, arrecadação and cash-management operations. Best suited to sandbox experimentation first, given the alpha status and unverified endpoint paths.
Requirements
Runs locally as an npm package over stdio (HTTP transport optional). Requires Node.js, an Itaú Developer Portal contract with OAuth client credentials (ITAU_CLIENT_ID, ITAU_CLIENT_SECRET) and an mTLS certificate and private key from the portal (ITAU_CERT_PATH, ITAU_KEY_PATH). ITAU_ENV selects sandbox (default) or production; network access to Itaú endpoints is needed.
Before you install
This server moves real money: it can send Pix and TED transfers, pay bills, refund Pix, cancel boletos, register or delete DICT keys and schedule payments. It handles sensitive credentials — the OAuth secret ITAU_CLIENT_SECRET and the mTLS private key at ITAU_KEY_PATH — and defaults to sandbox, so confirm ITAU_ENV before use. The project is alpha: endpoint paths and the sandbox host are unverified guesses, so pin exact versions and validate against the portal spec.

Installation

In SourceWeft

  1. Open Mcp Itau in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-itau

MCP server for Itaú Unibanco — Brazil's largest private bank.

Itaú operates the largest private-bank API surface in the country. Merchants running high-volume Pix, boleto, and cash-management workloads integrate directly instead of going through a PSP.

Status: alpha (0.1.0-alpha.1)

Itaú's Developer Portal is contract-gated — the full OpenAPI specs for Pix, Cobrança, Arrecadação, and Extrato are only visible to onboarded merchants. The endpoint paths in this server are best-guesses based on (a) BACEN Pix v2 standard paths, (b) Itaú's public marketing pages, and (c) conventions shared across Santander / Bradesco / BB. Every unverified path is flagged TODO(verify) in the source.

Pin to exact versions during 0.1.x; paths will be corrected to match the portal spec once an onboarded merchant can validate.

Tools (22)

ToolPurpose
get_oauth_tokenMint or return a cached OAuth2 client_credentials bearer token for the Itaú Developer Portal.
send_pixInitiate an outbound Pix payment from the merchant's Itaú account.
create_pix_qrCreate a dynamic Pix charge with QR code (cob).
get_pixRetrieve a Pix transaction by its BCB endToEndId (E).
resolve_dict_keyResolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix.
refund_pixRefund (devolução) a previously received Pix.
create_boletoIssue a boleto via Itaú Cobrança.
get_boletoRetrieve a boleto by its Itaú identifier (id or nosso_numero).
cancel_boletoCancel (baixa) an outstanding boleto before payment.
get_statementRetrieve account statement transactions for a given period.
arrecadacao_payPay a utility, tax, or concessionária bill via Itaú Arrecadação.
create_pix_cobvCreate a Pix charge with due date (cobv) — used for boleto-like Pix where the payer can pay at or after a d...
list_pix_chargesList immediate Pix charges (cob) registered by the merchant within a date range.
register_pix_keyRegister a DICT key (CPF, CNPJ, email, phone, or EVP) on an Itaú account owned by the merchant.
delete_pix_keyDelete a DICT key owned by the merchant.
list_pix_keysList DICT keys currently registered to the merchant's Itaú accounts.
get_boleto_pdfDownload the PDF of an issued boleto.
send_tedSend a TED transfer to an account at another bank.
transfer_between_accountsTAA — transfer between two Itaú accounts (owned by the merchant or a counterparty).
get_tariffsQuery the tariff schedule applicable to the merchant's active contracts (Pix per-transaction, boleto regist...
list_dda_billsList bills registered for the merchant under the DDA (Débito Direto Autorizado) enrolment.
schedule_paymentSchedule a future-dated payment (Pix, boleto, arrecadação, or TED).

Install

bash
npm install @codespar/[email protected]

Environment

bash
ITAU_CLIENT_ID="..."       # OAuth client_id from Itaú's Developer PortalITAU_CLIENT_SECRET="..."   # OAuth client_secretITAU_CERT_PATH="/abs/path/to/client.crt"   # mTLS client certificateITAU_KEY_PATH="/abs/path/to/client.key"    # mTLS private keyITAU_ENV="sandbox"                          # or "production" (default: sandbox)

Authentication

Two factors are both required on every call:

  1. OAuth2 client_credentials — the server calls the token endpoint, caches the bearer until ~60s before expiry, and attaches Authorization: Bearer <token> to downstream calls.
  2. mTLS — BACEN mandates mutual TLS for Pix v2, and Itaú enforces it across product families. The server loads the client certificate and private key from the paths you set, builds a Node https.Agent, and routes every request through it.

You obtain the cert + key bundle from the Itaú Developer Portal after your merchant contract is signed. They are distinct from the OAuth credentials.

Run

bash
# stdio (default)npx @codespar/mcp-itau
# HTTP transportMCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-itau

Caveats

  • Paths are unverified. See the TODO(verify) markers in src/index.ts. Onboarded merchants should validate against their portal-issued OpenAPI spec and open a PR.
  • Sandbox host is a guess. Itaú issues a sandbox subdomain per merchant; override by editing BASE_URL if your provisioned sandbox URL differs.
  • Arrecadação barcode validation is server-side in this alpha — no client-side mod-10 / mod-11 check yet.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/banking/itau/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0-alpha.3LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts