Mcp Itau

io.github.codespar由 GitHub 帳號 codespar 發布v0.2.0-alpha.3更新於 Oct 24, 2026

MCP server for Itaú Unibanco — Pix, Cobrança (boleto), Arrecadação, Extrato (OAuth2 + mTLS)

已驗證STDIO僅桌面金融商業與電商

概覽

AI 產生的概覽

本機 MCP 伺服器，透過 OAuth2 與 mTLS 讓助理呼叫 Itaú Unibanco 的 Pix、boleto、arrecadação 與帳戶對帳單等銀行介面。

可以做什麼
向 Itaú 開發者入口網站驗證並取得快取的 OAuth2 bearer 權杖（get_oauth_token）。送出、查詢與退款 Pix 付款，建立即時與含到期日的 Pix 收款，並依日期範圍列出收款。解析、註冊、列出與刪除 DICT 鍵（CPF、CNPJ、電子郵件、電話、EVP）。開立、查詢、取消 boleto 並下載其 PDF，透過 Arrecadação 繳納水電、稅費等帳單。讀取帳戶對帳單、查詢費率表、列出 DDA 帳單、送出 TED 轉帳、在 Itaú 帳戶間調撥資金，以及預約未來日期的付款。
適用情境
適用於已與 Itaú 完成簽約導入的巴西商家或開發者，希望由助理執行 Pix、boleto、arrecadação 與資金管理作業。鑑於專案處於 alpha 階段且介面路徑未經核實，建議先在沙箱環境試用。
執行需求
以 npm 套件形式在本機透過 stdio 執行（可選 HTTP 傳輸）。需要 Node.js、Itaú 開發者入口網站的合約及 OAuth 用戶端憑證（ITAU_CLIENT_ID、ITAU_CLIENT_SECRET），以及入口網站簽發的 mTLS 憑證與私鑰（ITAU_CERT_PATH、ITAU_KEY_PATH）。ITAU_ENV 選擇 sandbox（預設）或 production；需要連線至 Itaú 介面的網路存取。
安裝前請注意
此伺服器會動用真實資金：可送出 Pix 與 TED 轉帳、繳納帳單、退款 Pix、取消 boleto、註冊或刪除 DICT 鍵以及預約付款。它會處理敏感憑證——OAuth 密鑰 ITAU_CLIENT_SECRET 與位於 ITAU_KEY_PATH 的 mTLS 私鑰——且預設使用沙箱，使用前請確認 ITAU_ENV。專案為 alpha 版：介面路徑與沙箱主機皆為未經核實的推測，應鎖定確切版本並對照入口網站規格驗證。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Mcp Itau，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

@codespar/mcp-itau

MCP server for Itaú Unibanco — Brazil's largest private bank.

Itaú operates the largest private-bank API surface in the country. Merchants running high-volume Pix, boleto, and cash-management workloads integrate directly instead of going through a PSP.

Status: alpha (0.1.0-alpha.1)

Itaú's Developer Portal is contract-gated — the full OpenAPI specs for Pix, Cobrança, Arrecadação, and Extrato are only visible to onboarded merchants. The endpoint paths in this server are best-guesses based on (a) BACEN Pix v2 standard paths, (b) Itaú's public marketing pages, and (c) conventions shared across Santander / Bradesco / BB. Every unverified path is flagged TODO(verify) in the source.

Pin to exact versions during 0.1.x; paths will be corrected to match the portal spec once an onboarded merchant can validate.

Tools (22)

ToolPurpose
get_oauth_tokenMint or return a cached OAuth2 client_credentials bearer token for the Itaú Developer Portal.
send_pixInitiate an outbound Pix payment from the merchant's Itaú account.
create_pix_qrCreate a dynamic Pix charge with QR code (cob).
get_pixRetrieve a Pix transaction by its BCB endToEndId (E).
resolve_dict_keyResolve a DICT key (CPF, CNPJ, email, phone, EVP) to the owner's account data before sending a Pix.
refund_pixRefund (devolução) a previously received Pix.
create_boletoIssue a boleto via Itaú Cobrança.
get_boletoRetrieve a boleto by its Itaú identifier (id or nosso_numero).
cancel_boletoCancel (baixa) an outstanding boleto before payment.
get_statementRetrieve account statement transactions for a given period.
arrecadacao_payPay a utility, tax, or concessionária bill via Itaú Arrecadação.
create_pix_cobvCreate a Pix charge with due date (cobv) — used for boleto-like Pix where the payer can pay at or after a d...
list_pix_chargesList immediate Pix charges (cob) registered by the merchant within a date range.
register_pix_keyRegister a DICT key (CPF, CNPJ, email, phone, or EVP) on an Itaú account owned by the merchant.
delete_pix_keyDelete a DICT key owned by the merchant.
list_pix_keysList DICT keys currently registered to the merchant's Itaú accounts.
get_boleto_pdfDownload the PDF of an issued boleto.
send_tedSend a TED transfer to an account at another bank.
transfer_between_accountsTAA — transfer between two Itaú accounts (owned by the merchant or a counterparty).
get_tariffsQuery the tariff schedule applicable to the merchant's active contracts (Pix per-transaction, boleto regist...
list_dda_billsList bills registered for the merchant under the DDA (Débito Direto Autorizado) enrolment.
schedule_paymentSchedule a future-dated payment (Pix, boleto, arrecadação, or TED).

Install

bash
npm install @codespar/[email protected]

Environment

bash
ITAU_CLIENT_ID="..."       # OAuth client_id from Itaú's Developer PortalITAU_CLIENT_SECRET="..."   # OAuth client_secretITAU_CERT_PATH="/abs/path/to/client.crt"   # mTLS client certificateITAU_KEY_PATH="/abs/path/to/client.key"    # mTLS private keyITAU_ENV="sandbox"                          # or "production" (default: sandbox)

Authentication

Two factors are both required on every call:

  1. OAuth2 client_credentials — the server calls the token endpoint, caches the bearer until ~60s before expiry, and attaches Authorization: Bearer <token> to downstream calls.
  2. mTLS — BACEN mandates mutual TLS for Pix v2, and Itaú enforces it across product families. The server loads the client certificate and private key from the paths you set, builds a Node https.Agent, and routes every request through it.

You obtain the cert + key bundle from the Itaú Developer Portal after your merchant contract is signed. They are distinct from the OAuth credentials.

Run

bash
# stdio (default)npx @codespar/mcp-itau
# HTTP transportMCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-itau

Caveats

  • Paths are unverified. See the TODO(verify) markers in src/index.ts. Onboarded merchants should validate against their portal-issued OpenAPI spec and open a PR.
  • Sandbox host is a guess. Itaú issues a sandbox subdomain per merchant; override by editing BASE_URL if your provisioned sandbox URL differs.
  • Arrecadação barcode validation is server-side in this alpha — no client-side mod-10 / mod-11 check yet.

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

來源：packages/banking/itau/README.md，提交 d0a519a

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.2.0-alpha.3最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分