
Research
/Security News
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
@codespar/mcp-braspag
Advanced tools
MCP server for Braspag — Cielo's enterprise orchestration, token vault (Cartão Protegido), recurrence, and marketplace split
MCP server for Braspag — Cielo Group's enterprise orchestration layer: multi-acquirer routing, token vault (Cartão Protegido), recurrence, marketplace split, antifraud orchestration.
CodeSpar ships two Cielo Group servers with different business contracts:
| Server | Product | What it is | Who uses it |
|---|---|---|---|
@codespar/mcp-cielo | Cielo Acquirer | Direct card acquiring rails (credit, debit, boleto, Pix) | Any merchant taking cards through Cielo |
@codespar/mcp-braspag (this) | Braspag / Pagador | Enterprise orchestration on top of any acquirer | Enterprise BR retail (Magalu-tier): multi-acquirer routing, token vault, marketplace split |
Braspag orchestrates across acquirers. You keep your Cielo (or Rede, or Stone) acquiring contract and layer Braspag on top for: smart routing, failover, vaulting cards once and reusing across acquirers (Cartão Protegido), driving recurrence, and splitting marketplace capture across sub-merchants.
Add to ~/.config/claude/claude_desktop_config.json:
{
"mcpServers": {
"braspag": {
"command": "npx",
"args": ["-y", "@codespar/mcp-braspag"],
"env": {
"BRASPAG_MERCHANT_ID": "your-merchant-uuid",
"BRASPAG_MERCHANT_KEY": "your-merchant-key",
"BRASPAG_ENV": "sandbox"
}
}
}
}
claude mcp add braspag -- npx @codespar/mcp-braspag
Add to .cursor/mcp.json or .vscode/mcp.json:
{
"servers": {
"braspag": {
"command": "npx",
"args": ["-y", "@codespar/mcp-braspag"],
"env": {
"BRASPAG_MERCHANT_ID": "your-merchant-uuid",
"BRASPAG_MERCHANT_KEY": "your-merchant-key",
"BRASPAG_ENV": "sandbox"
}
}
}
}
| Tool | Description |
|---|---|
create_sale | Create a sale (CreditCard, DebitCard, Boleto, Pix, EletronicTransfer) |
capture_sale | Capture a pre-authorized sale (full or partial, with optional serviceTaxAmount) |
void_sale | Void / cancel a sale (full or partial) |
create_recurrent | Create a Braspag-managed recurrent payment |
disable_recurrent | Deactivate a recurrent payment |
update_recurrent_amount | Change the amount charged on a recurrent payment |
| Tool | Description |
|---|---|
get_sale | Get sale detail by PaymentId |
get_sale_by_order_id | Look up sale(s) by MerchantOrderId |
get_recurrent | Get recurrent payment config and history |
| Tool | Description |
|---|---|
tokenize_card | Tokenize a card into the Braspag vault |
get_card_token | Retrieve masked card data by vault token |
| Tool | Description |
|---|---|
create_split_sale | Create a sale with Payment.SplitPayments rules (marketplace split across sub-merchants) |
Braspag uses MerchantId (UUID) and MerchantKey (secret) headers on both the Transaction API and the Query API.
| Env | Transaction API | Query API |
|---|---|---|
sandbox (default) | https://apisandbox.braspag.com.br/v2 | https://apiquerysandbox.braspag.com.br/v2 |
production | https://api.braspag.com.br/v2 | https://apiquery.braspag.com.br/v2 |
Set via BRASPAG_ENV=production to switch.
| Variable | Required | Description |
|---|---|---|
BRASPAG_MERCHANT_ID | Yes | Merchant UUID |
BRASPAG_MERCHANT_KEY | Yes | Merchant secret key |
BRASPAG_ENV | No | sandbox (default) or production |
create_sale_with_card_token — convenience wrapper that uses a Cartão Protegido tokendelete_card_token — revoke a vault tokenget_sale_antifraud — Query API antifraud detailupdate_recurrent_payment — update non-amount fields on a recurrentcreate_zero_auth — zero-dollar auth for card validationWant to contribute? Open a PR or request a tool.
Need governance, budget limits, and audit trails for agent-driven payments on Braspag? CodeSpar Enterprise adds a policy engine, payment routing, and compliance templates on top of these MCP servers.
MIT
FAQs
MCP server for Braspag — Cielo's enterprise orchestration, token vault (Cartão Protegido), recurrence, and marketplace split
The npm package @codespar/mcp-braspag receives a total of 6 weekly downloads. As such, @codespar/mcp-braspag popularity was classified as not popular.
We found that @codespar/mcp-braspag demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.