Mcp Itau

io.github.codespar由 GitHub 账号 codespar 发布v0.2.0-alpha.3更新于 Oct 24, 2026

MCP server for Itaú Unibanco — Pix, Cobrança (boleto), Arrecadação, Extrato (OAuth2 + mTLS)

已验证STDIO仅桌面金融商业与电商

概览

AI 生成的概览

本地 MCP 服务器，通过 OAuth2 与 mTLS 让助手调用 Itaú Unibanco 的 Pix、boleto、arrecadação 和账户对账单等银行接口。

可以做什么
向 Itaú 开发者门户认证并获取缓存的 OAuth2 bearer 令牌（get_oauth_token）。发送、查询和退款 Pix 支付，创建即时与带到期日的 Pix 收款，并按日期范围列出收款。解析、注册、列出和删除 DICT 键（CPF、CNPJ、邮箱、电话、EVP）。签发、查询、取消 boleto 并下载其 PDF，通过 Arrecadação 缴纳水电、税费等账单。读取账户对账单、查询费率表、列出 DDA 账单、发送 TED 转账、在 Itaú 账户间划转资金，以及预约未来日期的付款。
适用场景
适用于已与 Itaú 完成签约入驻的巴西商户或开发者，希望由助手执行 Pix、boleto、arrecadação 和资金管理操作。鉴于项目处于 alpha 阶段且接口路径未经核实，建议先在沙箱环境试用。
运行要求
以 npm 包形式在本地通过 stdio 运行（可选 HTTP 传输）。需要 Node.js、Itaú 开发者门户的合约及 OAuth 客户端凭据（ITAU_CLIENT_ID、ITAU_CLIENT_SECRET），以及门户签发的 mTLS 证书和私钥（ITAU_CERT_PATH、ITAU_KEY_PATH）。ITAU_ENV 选择 sandbox（默认）或 production；需要访问 Itaú 接口的网络连接。
安装前请注意
该服务器会动用真实资金：可发送 Pix 与 TED 转账、缴纳账单、退款 Pix、取消 boleto、注册或删除 DICT 键以及预约付款。它处理敏感凭据——OAuth 密钥 ITAU_CLIENT_SECRET 和位于 ITAU_KEY_PATH 的 mTLS 私钥——且默认使用沙箱，使用前请确认 ITAU_ENV。项目为 alpha 版：接口路径和沙箱主机均为未经核实的推测，应锁定确切版本并对照门户规范验证。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Mcp Itau，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

@codespar/mcp-itau

MCP server for Itaú Unibanco — Brazil's largest private bank.

Itaú operates the largest private-bank API surface in the country. Merchants running high-volume Pix, boleto, and cash-management workloads integrate directly instead of going through a PSP.

Status: alpha (0.1.0-alpha.1)

Itaú's Developer Portal is contract-gated — the full OpenAPI specs for Pix, Cobrança, Arrecadação, and Extrato are only visible to onboarded merchants. The endpoint paths in this server are best-guesses based on (a) BACEN Pix v2 standard paths, (b) Itaú's public marketing pages, and (c) conventions shared across Santander / Bradesco / BB. Every unverified path is flagged TODO(verify) in the source.

Pin to exact versions during 0.1.x; paths will be corrected to match the portal spec once an onboarded merchant can validate.

Tools (22)

ToolPurpose
get_oauth_tokenMint or return a cached OAuth2 client_credentials bearer token for the Itaú Developer Portal.
send_pixInitiate an outbound Pix payment from the merchant's Itaú account.
create_pix_qrCreate a dynamic Pix charge with QR code (cob).
get_pixRetrieve a Pix transaction by its BCB endToEndId (E).
resolve_dict_keyResolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix.
refund_pixRefund (devolução) a previously received Pix.
create_boletoIssue a boleto via Itaú Cobrança.
get_boletoRetrieve a boleto by its Itaú identifier (id or nosso_numero).
cancel_boletoCancel (baixa) an outstanding boleto before payment.
get_statementRetrieve account statement transactions for a given period.
arrecadacao_payPay a utility, tax, or concessionária bill via Itaú Arrecadação.
create_pix_cobvCreate a Pix charge with due date (cobv) — used for boleto-like Pix where the payer can pay at or after a d...
list_pix_chargesList immediate Pix charges (cob) registered by the merchant within a date range.
register_pix_keyRegister a DICT key (CPF, CNPJ, email, phone, or EVP) on an Itaú account owned by the merchant.
delete_pix_keyDelete a DICT key owned by the merchant.
list_pix_keysList DICT keys currently registered to the merchant's Itaú accounts.
get_boleto_pdfDownload the PDF of an issued boleto.
send_tedSend a TED transfer to an account at another bank.
transfer_between_accountsTAA — transfer between two Itaú accounts (owned by the merchant or a counterparty).
get_tariffsQuery the tariff schedule applicable to the merchant's active contracts (Pix per-transaction, boleto regist...
list_dda_billsList bills registered for the merchant under the DDA (Débito Direto Autorizado) enrolment.
schedule_paymentSchedule a future-dated payment (Pix, boleto, arrecadação, or TED).

Install

bash
npm install @codespar/[email protected]

Environment

bash
ITAU_CLIENT_ID="..."       # OAuth client_id from Itaú's Developer PortalITAU_CLIENT_SECRET="..."   # OAuth client_secretITAU_CERT_PATH="/abs/path/to/client.crt"   # mTLS client certificateITAU_KEY_PATH="/abs/path/to/client.key"    # mTLS private keyITAU_ENV="sandbox"                          # or "production" (default: sandbox)

Authentication

Two factors are both required on every call:

  1. OAuth2 client_credentials — the server calls the token endpoint, caches the bearer until ~60s before expiry, and attaches Authorization: Bearer <token> to downstream calls.
  2. mTLS — BACEN mandates mutual TLS for Pix v2, and Itaú enforces it across product families. The server loads the client certificate and private key from the paths you set, builds a Node https.Agent, and routes every request through it.

You obtain the cert + key bundle from the Itaú Developer Portal after your merchant contract is signed. They are distinct from the OAuth credentials.

Run

bash
# stdio (default)npx @codespar/mcp-itau
# HTTP transportMCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-itau

Caveats

  • Paths are unverified. See the TODO(verify) markers in src/index.ts. Onboarded merchants should validate against their portal-issued OpenAPI spec and open a PR.
  • Sandbox host is a guess. Itaú issues a sandbox subdomain per merchant; override by editing BASE_URL if your provisioned sandbox URL differs.
  • Arrecadação barcode validation is server-side in this alpha — no client-side mod-10 / mod-11 check yet.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

来源：packages/banking/itau/README.md，提交 d0a519a

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.2.0-alpha.3最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分