Mcp Sicoob

io.github.codesparPublished by GitHub account codesparv0.1.0-alpha.4Updated Oct 24, 2026

MCP server for Sicoob — Pix (cob/cobv/DICT), Cobrança (boleto), SPB (OAuth2 + mTLS)

VerifiedSTDIODesktop onlyFinance Business & Commerce

Server details

Identifier: io.github.codespar/mcp-sicoob
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account codespar for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.codespar%2Fmcp-sicoob.svg)](https://sourceweft.com/mcp/io.github.codespar%2Fmcp-sicoob?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server for Sicoob, Brazil's cooperative bank network, letting an assistant create and query Pix charges, manage DICT keys, issue boletos and check a S

What you can do: Mint or reuse a cached OAuth2 bearer token for the Sicoob Developers Portal (get_oauth_token).
When to use it: Use it when an assistant needs to work with Sicoob Pix charges, DICT keys, boletos or cooperative account balances, typically in a sandbox while validating integration paths.
Requirements: Runs as a local Node.js process via the npm package. Requires SICOOB_CLIENT_ID, SICOOB_CLIENT_SECRET, SICOOB_CERT_PATH and SICOOB_KEY_PATH, plus optional SICOOB_ENV (sandbox or production, default sandbox). Credentials and the mTLS certificate bundle come from Sicoob's Developers Portal after cooperative onboarding. Network access to Sicoob endpoints is needed.

Before you install

The server is alpha and its endpoint paths are unverified best-guesses, so calls may fail or hit wrong routes. It handles a client secret and an mTLS private key path, and in production mode can create, cancel and delete real financial records (Pix charges, DICT keys, boletos). Keep SICOOB_ENV on sandbox until paths are validated.

Installation

In SourceWeft

Open Mcp Sicoob in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-sicoob

MCP server for Sicoob — Brazil's largest cooperative bank network.

Sicoob is consistently a top-4 PSP by Pix volume in Brazil. The Sistema de Cooperativas de Crédito do Brasil aggregates hundreds of regional cooperatives behind a single Developers Portal exposing Pix, Cobrança (boleto), and SPB APIs.

Status: alpha (`0.1.0-alpha.1`)

Sicoob's Developers Portal is gated by cooperative onboarding. The endpoint paths in this server are best-guesses based on (a) BACEN Pix v2 standard paths, (b) Sicoob's public documentation snippets, and (c) conventions shared across Itaú / Bradesco / BB. Every unverified path is flagged TODO(verify) in the source.

Pin to exact versions during 0.1.x; paths will be corrected to match the portal spec once an onboarded cooperative member can validate.

Tools (13)

Tool	Purpose
`get_oauth_token`	Mint or return a cached OAuth2 client_credentials bearer token for the Sicoob Developers Portal.
`create_pix_cob`	Create an immediate Pix charge (cob) with QR code.
`get_pix_cob`	Retrieve an immediate Pix charge by its txid.
`list_pix_cob`	List immediate Pix charges (cob) registered by the merchant within a date range.
`create_pix_cobv`	Create a Pix charge with due date (cobv) — boleto-like Pix payable on or after a due date with optional fin...
`get_pix_cobv`	Retrieve a due-date Pix charge (cobv) by its txid.
`lookup_dict_key`	Resolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix.
`register_dict_key`	Register a DICT key (CPF, CNPJ, email, phone, or EVP) on a Sicoob account owned by the cooperative member.
`delete_dict_key`	Delete a DICT key owned by the cooperative member.
`create_boleto`	Issue a boleto via Sicoob Cobrança.
`get_boleto`	Retrieve a boleto by its Sicoob identifier (id or nosso_numero).
`cancel_boleto`	Cancel (baixa) an outstanding boleto before payment.
`get_account_balance`	Query the merchant cooperative account balance via Sicoob SPB.

Install

Environment

bash

SICOOB_CLIENT_ID="..."       # OAuth client_id from Sicoob's Developers PortalSICOOB_CLIENT_SECRET="..."   # OAuth client_secretSICOOB_CERT_PATH="/abs/path/to/client.crt"   # mTLS client certificateSICOOB_KEY_PATH="/abs/path/to/client.key"    # mTLS private keySICOOB_ENV="sandbox"                          # or "production" (default: sandbox)

SICOOB_CLIENT_ID="..."       # OAuth client_id from Sicoob's Developers PortalSICOOB_CLIENT_SECRET="..."   # OAuth client_secretSICOOB_CERT_PATH="/abs/path/to/client.crt"   # mTLS client certificateSICOOB_KEY_PATH="/abs/path/to/client.key"    # mTLS private keySICOOB_ENV="sandbox"                          # or "production" (default: sandbox)

Authentication

Two factors are both required on every call:

OAuth2 client_credentials — the server calls the token endpoint, caches the bearer until ~60s before expiry, and attaches Authorization: Bearer <token> to downstream calls.
mTLS — BACEN mandates mutual TLS for Pix v2, and Sicoob enforces it across product families. The server loads the client certificate and private key from the paths you set, builds a Node https.Agent, and routes every request through it.

The cert + key bundle is issued by Sicoob's Developers Portal after cooperative onboarding and is distinct from the OAuth credentials.

Run

bash

# stdio (default)npx @codespar/mcp-sicoob
# HTTP transportMCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-sicoob

# stdio (default)npx @codespar/mcp-sicoob
# HTTP transportMCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-sicoob

Caveats

Paths are unverified. See the TODO(verify) markers in src/index.ts. Onboarded cooperatives should validate against their portal-issued OpenAPI spec and open a PR.
Sandbox host is a guess. Sicoob issues a sandbox subdomain per cooperative; override by editing BASE_URL if your provisioned sandbox URL differs.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/banking/sicoob/README.md at commit d0a519a

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.0-alpha.4LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts