Mcp Openpay

io.github.codesparPublished by GitHub account codesparv0.2.2Updated Oct 24, 2026

MCP server for Openpay — BBVA-owned Mexican gateway (cards, SPEI, OXXO, subscriptions, payouts)

VerifiedSTDIODesktop onlyFinanceBusiness & Commerce

Overview

AI-generated overview

Local MCP server for the Openpay Mexican payment gateway, letting an assistant create charges, manage customers, cards, subscriptions, payouts and webhooks.

What you can do
  • Create, retrieve, capture and refund charges, optionally scoped to a customer
  • Create, update, list and delete customers, and tokenize, list or delete stored cards
  • Create subscription plans, subscribe customers and cancel subscriptions
  • Create and list payouts to bank accounts, and store or delete customer bank accounts
  • Register, list and delete webhook endpoints
When to use it
Useful when an assistant needs to operate a Mexican Openpay merchant account: taking card, SPEI or OXXO payments, managing recurring subscriptions, paying out to bank accounts, or wiring webhooks. Sandbox mode makes it reasonable to try flows before touching production.
Requirements
Runs locally via npx from the npm package, with stdio by default (an HTTP mode is available through MCP_HTTP and MCP_PORT). Requires an Openpay merchant id in OPENPAY_MERCHANT_ID and a private API key in OPENPAY_PRIVATE_KEY; OPENPAY_ENV selects sandbox (default) or production. Network access to the Openpay API is needed.
Before you install
The private API key in OPENPAY_PRIVATE_KEY is a full merchant credential sent as HTTP Basic auth, so keep it out of logs and shared configs. Many tools move real money or change data: charges, captures, refunds, payouts, subscriptions, customer and card deletion, and webhooks. Set OPENPAY_ENV to sandbox until flows are verified. Raw card numbers and CVVs should only be sent server-side if you are PCI-DSS compliant; prefer client-side tokenization.

Installation

In SourceWeft

  1. Open Mcp Openpay in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-openpay

MCP server for Openpay — the BBVA-owned Mexican payment gateway.

Openpay is the main BBVA-backed alternative to Conekta for Mexican online merchants. Adding it to the catalog alongside @codespar/mcp-conekta closes the "big two" MX gateway story and opens the BBVA rails (SPEI, OXXO, domestic cards) to agents. Differentiators in this catalog: native subscriptions (plans + per-customer recurring billing) and marketplace payouts.

Tools (23)

ToolPurpose
create_chargeCreate a charge.
get_chargeRetrieve a charge.
capture_chargeCapture a previously authorized charge (when the original charge used capture=false).
refund_chargeRefund a captured charge.
create_customerCreate a customer record.
get_customerRetrieve a customer by Openpay customer id.
list_customersList customers with optional filters.
create_cardTokenize a card.
delete_cardDelete a tokenized card.
create_planCreate a subscription plan.
create_subscriptionSubscribe a customer to a plan.
create_payoutPay out MXN to a bank account.
update_customerUpdate a stored customer (PUT /customers/{id}).
delete_customerDelete a customer (DELETE /customers/{id}).
get_cardRetrieve a tokenized card.
list_cardsList tokenized cards.
create_bank_accountStore a customer bank account (POST /customers/{customer_id}/bankaccounts).
delete_bank_accountDelete a stored customer bank account (DELETE /customers/{customer_id}/bankaccounts/{id}).
cancel_subscriptionCancel a customer's subscription (DELETE /customers/{customer_id}/subscriptions/{id}).
list_payoutsList payouts.
create_webhookRegister a webhook endpoint (POST /webhooks).
list_webhooksList configured webhook subscriptions (GET /webhooks).
delete_webhookDelete a webhook subscription (DELETE /webhooks/{id}).

Install

bash
npm install @codespar/mcp-openpay

Environment

bash
OPENPAY_MERCHANT_ID="..."  # merchant id (part of the API URL path)OPENPAY_PRIVATE_KEY="..."  # private API key — secretOPENPAY_ENV="sandbox"      # 'sandbox' (default) | 'production'

Authentication

HTTP Basic. The private key is the username, and the password is empty:

Authorization: Basic base64(OPENPAY_PRIVATE_KEY + ":")Content-Type: application/json

The server handles the Base64 encoding automatically — you only configure the three env vars.

Base URLs

EnvHost
sandbox (default)https://sandbox-api.openpay.mx/v1/{merchant_id}
productionhttps://api.openpay.mx/v1/{merchant_id}

Run

bash
# stdio (default — for Claude Desktop, Cursor, etc)npx @codespar/mcp-openpay
# HTTP (for server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-openpay

Scoping notes

Several Openpay resources can be addressed at either merchant scope or customer scope. The tools expose this via an optional customer_id parameter:

  • create_charge, get_charge, capture_charge, refund_charge — routed to /customers/{customer_id}/... when customer_id is set, else /....
  • create_card, delete_card — same pattern.
  • create_payout — customer-scoped payout requires the customer to have requires_account=true.
  • create_subscription — customer scope is required by the API (plans are merchant-scoped; subscriptions are always per-customer).

PCI scope

Prefer client-side tokenization with Openpay.js and pass the resulting token_id / source_id to the server. Only send raw PANs/CVVs server-side if you are PCI-DSS compliant.

Docs

https://documents.openpay.mx/en/api

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/payments/openpay/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts