Mcp Nupay

io.github.codespar由 GitHub 帳號 codespar 發布v0.2.2更新於 Oct 24, 2026

MCP server for NuPay — Nubank merchant checkout: Pix + wallet one-click for 100M+ BR users

已驗證STDIO僅桌面金融商業與電商

概覽

AI 產生的概覽

NuPay（Nubank 巴西商家結帳）的 MCP 伺服器，讓助理建立、查詢、取消與退款付款，並管理結算與收款人。

可以做什麼
  • 建立、查詢、依日期列出並取消 NuPay 結帳付款，依參考號查看付款狀態。
  • 發起全額或部分退款，查詢退款狀態與某筆付款的所有退款。
  • 註冊、更新、刪除與列出最終收款人（分帳所需）。
  • 列出結算報告，檢視單筆結算批次及其包含的交易。
  • 依金額（可選擇帶入購物者 CPF）查詢分期與付款條件。
  • 執行預先授權與回購流程：發起並完成 CIBA/OTP 授權、重送 OTP、建立預先授權付款，以及換取或撤銷 OAuth 權杖。
適用情境
適合需要為巴西客戶操作 NuPay 商家帳戶的情境：收款結帳、處理退款、追蹤結算，或為回購客戶建立一鍵付款與定期扣款流程。
執行需求
透過 npm 套件以 stdio 在本機執行（需 Node.js），設定 MCP_HTTP 與 MCP_PORT 時也可改用 HTTP。需要 NUPAY_MERCHANT_KEY 與 NUPAY_MERCHANT_TOKEN；只有使用 backchannel 預先授權工具時才需要 NUPAY_CLIENT_ID 與 NUPAY_CLIENT_SECRET。NUPAY_ENV 選擇 sandbox（預設）或 production，並決定 API 與驗證的基礎位址。需要能連線至 NuPay/Spinpay 的網路。
安裝前請注意
此伺服器會處理真實金流：可建立付款、發起退款、取消付款、刪除收款人、撤銷權杖。NUPAY_MERCHANT_TOKEN 與 NUPAY_CLIENT_SECRET 是商家密鑰，必須妥善保管。NUPAY_ENV 預設為 sandbox，但改成 production 後同一批工具就會指向正式環境。預先授權流程涉及購物者 OTP 與需長期保存的 refresh token，用戶端斷言須自行簽署。付款與購物者資料（含 CPF）會傳送給 NuPay/Spinpay。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Mcp Nupay，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

@codespar/mcp-nupay

MCP server for NuPay — Nubank's merchant checkout rail.

NuPay is Nubank's answer to PayPal / Shop Pay for Brazil: a wallet-backed checkout that leverages Nubank's 100M+ BR customer distribution. Agents create a payment, the shopper confirms inside the Nubank app (push + biometric) or via Pix, and funds settle to the merchant. Pre-authorized flows (CIBA / OTP) unlock recurrence and true one-click for repeat buyers.

Tools (22)

ToolPurpose
create_paymentCreate a NuPay checkout payment.
get_paymentRetrieve full payment details (amount, shopper, items, current status, timestamps) by pspReferenceId.
get_payment_statusRetrieve a payment's status by pspReferenceId.
list_payments_by_dateList payments created within a date range.
cancel_paymentCancel a payment that has not yet been captured/settled.
create_refundRefund a settled payment (full or partial).
get_refundRetrieve refund status by pspReferenceId + refundId.
list_refundsList all refunds issued against a given payment.
create_recipientRegister a final beneficiary (required for regulatory split payments).
get_recipientRetrieve a registered recipient by referenceId.
update_recipientUpdate a registered final beneficiary (name, document, country, type).
delete_recipientRemove a registered recipient.
list_recipientsList registered recipients (final beneficiaries) for the merchant.
list_settlementsList settlement reports (payouts to the merchant bank account) within a date range.
get_settlementRetrieve a single settlement (payout batch) including the list of underlying transactions.
query_payment_conditionsQuery available installment/payment conditions for a given amount and (optionally) shopper CPF.
create_preauth_paymentCreate a NuPay payment using a pre-authorized Bearer access_token (pre-auth / recurrence flow).
backchannel_startStart a CIBA / OTP pre-authorization for a shopper.
backchannel_completeComplete a CIBA/OTP flow by submitting the OTP the shopper received.
backchannel_resend_otpResend the OTP to the shopper for an in-flight authorization ticket.
exchange_tokenExchange an authorization_code or refresh_token at POST /v1/token.
revoke_tokenRevoke an issued access_token or refresh_token at POST /v1/token/revoke.

Install

bash
npm install @codespar/mcp-nupay

Environment

bash
NUPAY_MERCHANT_KEY="..."     # X-Merchant-Key issued to your merchantNUPAY_MERCHANT_TOKEN="..."   # X-Merchant-Token (secret)NUPAY_CLIENT_ID="..."        # Optional — OAuth client_id for pre-auth / recurrenceNUPAY_CLIENT_SECRET="..."    # Optional — OAuth client_secretNUPAY_ENV="sandbox"          # sandbox (default) | production

Authentication

Two flows:

  1. Standard merchant API (payments, refunds, recipients, payment-conditions) uses X-Merchant-Key + X-Merchant-Token headers. No token exchange.
  2. Pre-authorized / recurrence uses OAuth2 + CIBA / OTP. Start with backchannel_start, validate via backchannel_complete, then call create_preauth_payment with the returned Bearer access_token. Refresh with exchange_token (grant_type=refresh_token). Access tokens expire in 5 minutes; refresh tokens should be stored long-term for recurrence.

Base URLs are derived from NUPAY_ENV:

SandboxProduction
APIhttps://sandbox-api.spinpay.com.brhttps://api.spinpay.com.br
Authhttps://sandbox-authentication.spinpay.com.br/apihttps://authentication.spinpay.com.br/api

JWT client_assertion signing is the caller's responsibility — exchange_token expects an already-signed assertion with client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

Run

bash
# stdio (default)npx @codespar/mcp-nupay
# HTTPMCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-nupay

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

來源：packages/payments/nupay/README.md，提交 d0a519a

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.2.2最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分