
Company News
Free Business Plan Upgrades for Open Source Maintainers
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.
@codespar/mcp-iniciador
Advanced tools
MCP server for Iniciador — Open Finance Brasil PISP (Pix payment initiation aggregator)
MCP server for Iniciador — Open Finance Brasil PISP (Pix payment initiation aggregator). Iniciador holds the ICP-Brasil certificate and orchestrates DCR with each Brazilian bank for instant Pix-out flows.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"iniciador": {
"command": "npx",
"args": ["@codespar/mcp-iniciador"],
"env": {
"INICIADOR_API_KEY": "your-api-key"
}
}
}
}
Same config in .cursor/mcp.json.
| Tool | Iniciador endpoint | Notes |
|---|---|---|
list_institutions | GET /institutions | Brazilian banks supported for Pix initiation |
| Tool | Iniciador endpoint | Notes |
|---|---|---|
create_consent | POST /consents | Payment consent for the payer to authorize at their bank |
get_consent | GET /consents/{id} | Current authorization status |
revoke_consent | DELETE /consents/{id} | Revoke before exercise |
| Tool | Iniciador endpoint | Notes |
|---|---|---|
create_payment | POST /payments | Initiate Pix once consent is authorized |
get_payment | GET /payments/{id} | Status / E2E id / rejection reason |
list_payments | GET /payments | Filter by date range / status |
cancel_payment | POST /payments/{id}/cancel | Best-effort cancel before settlement |
| Tool | Notes |
|---|---|
get_authorization_url | Client-side builder for the OFB authorization URL (consent id + ISPB + redirect) |
This server uses Iniciador's API key auth (X-API-KEY header). The Pix-out call itself is signed end-to-end with the consumer's bank-issued consent token, which Iniciador's backend stitches in after the payer authorizes the consent at their bank. OAuth2 client-credentials is required for some flows and lands when consent + bank-issued token plumbing is wired end-to-end.
Issue credentials during Iniciador onboarding:
Sandbox endpoint: https://sandbox.iniciador.com.br. Override via INICIADOR_API_BASE.
| Variable | Required | Description |
|---|---|---|
INICIADOR_API_KEY | yes | API key from Iniciador onboarding |
INICIADOR_API_BASE | no | Override API base URL (default https://api.iniciador.com.br) |
Three OFB aggregators in this catalog, each with a different specialty:
| Aggregator | Strength | Best for |
|---|---|---|
| Iniciador | Pix payment initiation (PISP) | Outgoing payments under OFB consent |
Pluggy (@codespar/mcp-pluggy) | Account + transaction reads | Reconciliation, balance polling |
Belvo (@codespar/mcp-belvo) | Multi-LATAM Open Finance + payroll + tax | Cross-border (BR + MX + CO + AR) |
For commerce agents that need both reads and writes, compose them — Pluggy/Belvo for account + recon visibility + Iniciador for Pix initiation.
Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.
MIT
FAQs
MCP server for Iniciador — Open Finance Brasil PISP (Pix payment initiation aggregator)
We found that @codespar/mcp-iniciador demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.