
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
@codespar/mcp-pagbrasil
Advanced tools
MCP server for PagBrasil — cross-border acquiring into Brazil: Pix, Boleto Flash, local cards, refunds
MCP server for PagBrasil — the cross-border acquirer for international merchants selling into Brazil: Pix, Automatic Pix (PagStream), Boleto Flash, PEC Flash and local credit cards with installments. Distinct from PagBank/PagSeguro.
Add to ~/.config/claude/claude_desktop_config.json:
{
"mcpServers": {
"pagbrasil": {
"command": "npx",
"args": ["-y", "@codespar/mcp-pagbrasil"],
"env": {
"PAGBRASIL_PBTOKEN": "your-merchant-token",
"PAGBRASIL_SECRET": "your-secret-phrase"
}
}
}
}
claude mcp add pagbrasil -- npx @codespar/mcp-pagbrasil
Add to .cursor/mcp.json or .vscode/mcp.json:
{
"servers": {
"pagbrasil": {
"command": "npx",
"args": ["-y", "@codespar/mcp-pagbrasil"],
"env": {
"PAGBRASIL_PBTOKEN": "your-merchant-token",
"PAGBRASIL_SECRET": "your-secret-phrase"
}
}
}
}
Every request carries the merchant token (pbtoken) and the secret phrase as body fields — there is no auth header. This server injects both from PAGBRASIL_PBTOKEN and PAGBRASIL_SECRET.
PagBrasil's API is form-urlencoded (not JSON) and answers XML. The merchant token (pbtoken) and secret phrase travel as body fields on every request — this server injects both from the environment. Tool responses hand the raw XML to the agent under xml so no fields are lost.
| Tool | Endpoint | What it does |
|---|---|---|
create_order | POST /order/add | Create an order / request a payment (pix, boleto, creditcard). Pix responses carry pix_code + pix_image; boleto responses carry the bar code + PDF URL |
get_order | POST /order/get | Fetch an order's current status — poll to detect settlement |
refund_order | POST /order/refund | Refund a settled order (amount_brl for partial, omit for full) |
| Variable | Required | Description |
|---|---|---|
PAGBRASIL_PBTOKEN | yes | Merchant token from the PagBrasil Dashboard |
PAGBRASIL_SECRET | yes | Secret phrase from the Dashboard |
PAGBRASIL_BASE_URL | no | Defaults to https://sandbox.pagbrasil.com/api. Production hosts are issued per-merchant after the Payment Service Agreement — set the URL your dashboard provides |
amount_brl is in major units as a string: '125.00' = R$ 125,00.order_number must be unique per customer_taxid. Same number + same taxid = idempotent no-op; same number + different taxid = rejected (Duplicated order).customer_taxid must be a valid CPF or CNPJ — agents should ask the user, never invent one.Need governance, budget limits, and audit trails for agent-driven payments on PagBrasil? CodeSpar Enterprise adds a policy engine, payment routing, and compliance templates on top of these MCP servers.
MIT © CodeSpar
FAQs
MCP server for PagBrasil — cross-border acquiring into Brazil: Pix, Boleto Flash, local cards, refunds
We found that @codespar/mcp-pagbrasil demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.