MCP server
Lets Claude, Cursor, and other assistants run real actions on your account while you build: it runs locally via npx, uses your token, and ships the tools ready to go, with BRL amount validation and automatic retry.
What it is
payzu-mcp-pix is a local MCP server. It runs on your machine via npx and talks to the AI assistant over stdio. There is also a hosted version with nothing to install. Either way, the assistant decides which tool to call and the server performs the HTTP call to the Pix Processamento API using your token.
MCP is the open protocol that lets AI assistants call external tools via JSON-RPC. Use MCP when you want the assistant to run real actions on your account during development or interactive use. If your goal is your production app talking to PayZu, use the SDK (payzu-pix).
Requires payzu-mcp-pix 0.6.0 or higher and Node 20 or higher.
Before you start
Get your API token at abrirconta.payzu.com.br:
- Sign in to your account.
- Open the credentials area (the API token section).
- Copy the token. That value goes into
PAYZU_TOKEN.
The token gives real access to your account: create charges, pay Pix and check balance. Treat it like a password. We recommend approving each agent action before it runs, instead of letting it run unattended.
Hosted server (no install)
Don't want to install anything? Point any compatible MCP client at the hosted server:
https://mcp.payzu.com.br/mcp- claude.ai and Claude Desktop: Settings → Connectors → Add custom connector → paste the URL. A PayZu page opens asking for your token once (OAuth); the assistant never sees or stores it.
- Cursor / VS Code: one-click install:
- Claude Code:
claude mcp add --transport http payzu-pix https://mcp.payzu.com.br/mcp(the authorization flow opens on first use). No-OAuth alternative: send theAuthorizationheader with your API Bearer token:--header "Authorization: Bearer <your-token>". - Claude Desktop (local installer): download payzu-mcp-pix.mcpb and open the file; Claude only asks for the token.
The hosted server is stateless: it stores no tokens and no account data. Every request is forwarded to the Pix Processamento API with your credential, exactly like a direct call.
Withdrawals, refunds and internal transfers are disabled on the hosted server. They require a token with the WITHDRAW scope, and an account that has such a token only accepts calls from a registered IP; the hosted server calls out from one IP shared by every customer. The other tools only work on the hosted server if the account has no registered IP and no active token with the WITHDRAW scope: with a registered IP, the whole API accepts only those IPs (PZA203); with no IP and an active WITHDRAW token, every call is rejected, with any token of the account (PZA205). Otherwise, use the local app (npx payzu-mcp-pix or the .mcpb installer) on a machine whose public IP is registered in the dashboard, under the Security menu, or use the dashboard. See the IP whitelist.
Google Antigravity
In the Antigravity interface:
- In the agent panel (Agent Manager), click the
...menu at the top. - Choose
MCP Servers, thenManage MCP Servers. - Click
View raw config. - Paste the config below, replacing it with your token:
{
"mcpServers": {
"payzu-pix": {
"command": "npx",
"args": ["-y", "payzu-mcp-pix"],
"env": { "PAYZU_TOKEN": "your-token-here" }
}
}
}Paste the literal token inside env. Variable expansion ${VAR} fails in some versions.
The config file lives at:
~/.gemini/config/mcp_config.jsonon newer versions (Antigravity 2.0).~/.gemini/antigravity/mcp_config.jsonon earlier builds.
Save and click Refresh on the Manage MCP Servers screen.
Antigravity needs payzu-mcp-pix 0.6.0 or higher. The dotted tool names from older versions were rejected by the models (Gemini, Claude, GPT) that Antigravity uses.
Claude Code
claude mcp add payzu-pix --env PAYZU_TOKEN=your-token -- npx -y payzu-mcp-pixUse --scope user for the server to apply across all projects:
claude mcp add payzu-pix --scope user --env PAYZU_TOKEN=your-token -- npx -y payzu-mcp-pixClaude Desktop
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"payzu-pix": {
"command": "npx",
"args": ["-y", "payzu-mcp-pix"],
"env": { "PAYZU_TOKEN": "your-token-here" }
}
}
}Restart Claude Desktop after saving.
Cursor
Edit .cursor/mcp.json in the project or ~/.cursor/mcp.json to apply everywhere:
{
"mcpServers": {
"payzu-pix": {
"command": "npx",
"args": ["-y", "payzu-mcp-pix"],
"env": { "PAYZU_TOKEN": "your-token-here" }
}
}
}VS Code (GitHub Copilot)
Edit .vscode/mcp.json. Here the key is servers (not mcpServers), with type set to stdio. Use inputs with promptString and password so the token is not committed:
{
"servers": {
"payzu-pix": {
"type": "stdio",
"command": "npx",
"args": ["-y", "payzu-mcp-pix"],
"env": { "PAYZU_TOKEN": "${input:payzu-token}" }
}
},
"inputs": [
{
"id": "payzu-token",
"type": "promptString",
"description": "PayZu API token",
"password": true
}
]
}Windsurf
Edit ~/.codeium/windsurf/mcp_config.json, same mcpServers shape:
{
"mcpServers": {
"payzu-pix": {
"command": "npx",
"args": ["-y", "payzu-mcp-pix"],
"env": { "PAYZU_TOKEN": "your-token-here" }
}
}
}Step by step
- Get your token at abrirconta.payzu.com.br.
- Configure your client (Antigravity, Claude Code, Claude Desktop, Cursor, VS Code or Windsurf) with one of the blocks above.
- Ask for a charge in plain language, for example:
"Create a R$ 50.00 Pix charge with reference pedido-001 and callback https://meusite.com.br/webhook"
- The agent calls
pix_createand returns the chargeidandqrCodeText. - Ask "what's my balance?" and the agent calls
account_balanceand answers with the number.
Not working?
- Error
[401]: invalid or expired token. Generate a new one at abrirconta.payzu.com.br. - Server missing from the tool list: reload or restart the client (in Antigravity, use
Refresh).
Tool list (48)
All names in snake_case. Each tool has a description with a direct link to the endpoint page in the docs.
Pix charges (4)
| Tool | HTTP |
|---|---|
pix_create | POST /pix |
pix_get | GET /pix |
pix_qr_code | GET /pix/qr-code/{transactionId} |
pix_proof | GET /proof/{id} |
Pix Payments (6)
| Tool | HTTP |
|---|---|
withdraw_create ¹ | POST /withdraw |
withdraw_get | GET /withdraw |
withdraw_by_qr ¹ | POST /withdraw/qrcode |
withdraw_read_qr | POST /pix/qrcode/read |
withdraw_dict | GET /pix/key?pixKey={key} |
withdraw_proof | GET /withdraw/proof/{id} |
Refunds (1)
| Tool | HTTP |
|---|---|
refund_create ¹ | POST /refund/{transactionId} |
Webhooks (8)
| Tool | HTTP |
|---|---|
webhooks_create | POST /user/webhooks |
webhooks_list | GET /user/webhooks |
webhooks_get | GET /user/webhooks/{id} |
webhooks_update | PATCH /user/webhooks/{id} |
webhooks_delete | DELETE /user/webhooks/{id} |
webhooks_rotate_secret | POST /user/webhooks/{id}/rotate-secret |
webhooks_sent_quantity | GET /user/webhooks/sent/quantity |
webhooks_sent_detail | GET /user/webhooks/{id}/sent/{callbackId} |
Internal transfer (2)
| Tool | HTTP |
|---|---|
internal_transfer_create ¹ | POST /internal-transfer |
internal_transfer_get | GET /internal-transfer |
Account (3)
| Tool | HTTP |
|---|---|
account_profile | GET /user |
account_balance | GET /user/balance |
account_pix_keys | GET /user/dict?key={key} |
Reports (11)
| Tool | HTTP |
|---|---|
reports_list_transactions | GET /user/transactions |
reports_get_transaction | GET /user/transactions/{id} |
reports_create_csv | POST /user/report |
reports_list_jobs | GET /user/report |
reports_get_job | GET /user/report/{id} |
reports_download | POST /user/report/{id}/download |
reports_bank_statements | GET /user/bank-statements |
reports_bank_statement | GET /user/bank-statements/{id} |
reports_deposit_pending | GET /user/deposit-pending |
reports_deposit_pending_get | GET /user/deposit-pending/{id} |
reports_summary | GET /user/summary |
Callbacks (8)
| Tool | HTTP |
|---|---|
callbacks_list | GET /user/callbacks |
callbacks_get | GET /user/callbacks/{id} |
callbacks_resend | POST /user/callbacks/resend/{transactionId} |
callbacks_resend_bulk | POST /user/callbacks/resend |
callbacks_resend_webhook | POST /user/callbacks/resend/webhook/{webhookId} |
callbacks_resend_webhook_bulk | POST /user/callbacks/resend/webhook |
callbacks_create_secret | POST /user/callbacks/secret |
callbacks_rotate_secret | PATCH /user/callbacks/secret/rotate |
MED infractions (5)
| Tool | HTTP |
|---|---|
infractions_list | GET /user/infractions |
infractions_get | GET /user/infractions/{id} |
infractions_create_defense | POST /user/infractions/{id}/defenses (multipart) |
infractions_list_defenses | GET /user/infractions/{id}/defenses |
infractions_get_defense | GET /user/infractions/{id}/defenses/{defenseId} |
¹ Disabled on the hosted server, for the reason in the warning above: they register as stubs and answer that the operation is unavailable. They work in the local app (npx payzu-mcp-pix or the .mcpb installer).
Applied conventions
- Values in decimal BRL, never in cents: R$ 99.90 is
99.90. clientReferencerequired on creations (idempotency).callbackUrlis optional on creations. Without it that transaction has no delivery of its own; registered webhooks still receive the events, and the status is also available through the query tool.- Auto-retry only on read requests (
GET,HEAD,OPTIONS) and only on statuses 408, 429, 500, 502, 503 and 504, with exponential backoff and jitter, up to 3 retries. Creations are never retried: a failedPOSTdoes not become a duplicate charge. - Errors include
requestId, copy and paste it into support if needed. - Zero admin endpoints, only the public and client surface.
The amount is not validated against a unit mistake. The schema accepts any positive number with up to 2 decimals, so 9990 passes and becomes a R$ 9,990.00 charge, not R$ 99.90. If your code stores amounts in cents, divide by 100 before asking the agent.
Environment variables
| Env var | Required | Default | Description |
|---|---|---|---|
PAYZU_TOKEN | yes | Token from abrirconta.payzu.com.br | |
PAYZU_API_URL | no | https://api.payzu.processamento.com/v1 | Override for whitelabel |