← Back to search

@garuhq/mcp

GitHub Actions Scanned 1h ago

Garu MCP server — payments for AI agents. PIX, card, boleto.

B
81.4 / 100

Versions

No versions found.

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 54

create_pix_charge
annotations: none low

Create a PIX charge. Returns a QR code for the customer to pay.

productId string
change_scheduled_charge_payment_method
annotations: none low

Swap the saved card on a recurring series. The new PaymentMethod must belong to the same customerId. Future cycles silent-charge the new card; the in-flight cycle is not retroactively rebound.

id string
clear_scheduled_charge_payment_method
annotations: none low

Clear the saved card on a recurring series. Future cycles fall back to the email-with-link flow so the customer can re-enter card details or pay via PIX/Boleto.

id string
list_scheduled_charge_attempts
annotations: none low

Per-attempt billing log for a scheduled charge series (SPEC §4.2). One row per logical billing event: cycle 1 interactive charge, every silent-charge attempt, every retry cron retry, every manual mark-paid. Each row carries the canonical Garu failureCode for declines, the gateway raw code for forensics, and a snapshot of the card last4 / brand even after the PaymentMethod is deleted (LGPD survival). Use this to audit why a recurring series fell behind.

id string page number
list_offers
annotations: none low

List a product

page number productUuid string
get_offer
annotations: none low

Get one offer by id. Use it to read the current price and whether it is still active.

create_offer
annotations: none low

Create an offer so the same product can be sold at a second price behind its

isActive boolean
update_offer
annotations: none low

Update an offer — reprice, rename, or activate/deactivate it. Deactivating is

name string offerId string
delete_offer
annotations: none low

Delete an offer permanently. Works ONLY while it has never sold — once a

offerId string
create_scheduled_charge
annotations: none low

Schedule a future charge for an existing customer. Use list_customers first to find the customerId. type=

endsOn string endsAfter number intervalCount number
list_scheduled_charges
annotations: none low

List scheduled charges for the authenticated seller, with pagination and filters. Pass status as a single value or an array. Use search to match against the linked customer

page number
get_scheduled_charge
annotations: none low

Get a scheduled charge by ID, bundled with its event timeline and any linked Garu transactions. The response shape is { charge, events, transactions }. Both charge.amount and transactions[].value are decimal BRL (e.g. 297.50) — never centavos, no conversion needed.

id string
postpone_scheduled_charge
annotations: none low

Postpone a scheduled charge to a new due date. Allowed from scheduled / due_today / overdue / paused. Clears any pending dunning so the customer gets a fresh reminder on the new date.

id string
pause_scheduled_charge
annotations: none low

Pause a scheduled charge. No reminders fire while paused. Allowed from scheduled / due_today / overdue. Use resume_scheduled_charge to bring it back.

id string
resume_scheduled_charge
annotations: none low

Resume a paused scheduled charge. Only valid from `paused`.

id string
mark_paid_scheduled_charge
annotations: none low

Manually mark a scheduled charge as paid (e.g. customer paid via bank transfer outside Garu). For one-time: omit cycleNumber, allowed from due_today / overdue. For recurring: pass cycleNumber, allowed from cycle status due_today / overdue / failed; future cycles continue.

id string
charge_now_scheduled_charge
annotations: none low

Force-bill the current cycle right now instead of waiting for its due date. Runs the same dispatch the daily billing cron would: customer email/notification + outbound webhook + timeline event. Allowed only from a billable status (scheduled / due_today); a recurring series must also have an open cycle (otherwise the gateway returns 400). IDEMPOTENT — NOT a re-charge: if this cycle

id string
cancel_recurrence_scheduled_charge
annotations: none low

Stop future cycles for a recurring scheduled charge. The currently in-flight cycle (if any) remains active until paid, postponed, or marked-paid; only after that resolves does the series flip to recurrence_canceled. Final — use a new series to restart. Recurring-only.

id string
set_cancel_at_period_end_scheduled_charge
annotations: none low

Toggle Stripe-style soft cancel on a recurring series. With enabled=true, the cycle generator stops emitting new cycles after the next paid cycle (the in-flight cycle still bills + can be paid). Reversible by passing enabled=false. Mutually exclusive with recurrence.endsAfter and recurrence.endsOn.

id string
create_boleto_charge
annotations: none low

Create a boleto bancario charge. Returns a bank slip line for payment.

productId string additionalInfo string
list_charges
annotations: none low

List charges for the authenticated seller with pagination and filters.

page number
get_charge
annotations: none low

Get details of a specific charge by its uuid.

uuid string
refund_charge
annotations: none low

Refund a charge fully or partially. Amount is in BRL / reais (e.g. 10.50 for R$10,50).

uuid string reason string
cancel_charge
annotations: none low

Cancel an unpaid charge by its uuid.

uuid string
create_customer
annotations: none low

Create a customer and link to the current seller. Safe to retry: the SDK attaches an

list_customers
annotations: none low

List customers for the authenticated seller with pagination, search, and an optional

page number
get_customer
annotations: none low

Get details of a specific customer by uuid.

uuid string
update_customer
annotations: none low

Update a customer

city string name string uuid string email string number string street string complement string neighborhood string
set_customer_billing_email_override
annotations: none low

Set or clear the per-seller billing email override for a customer. The override is sticky: it takes precedence over the per-seller last-used email and the global customer.email for outbound seller-to-customer emails, and is never auto-overwritten by subsequent payments. Pass null to clear and fall back to the last-used email. Use this when the customer asks for a specific billing address (e.g. financeiro@empresa.com.br) different from the email they used at checkout.

uuid string
delete_customer
annotations: none low

Remove a customer from the current seller. Does not delete the customer globally.

uuid string
create_installment_plan
annotations: none low

Sell a product as a carnê: one product paid with N monthly bank slips (boleto parcelado). This is SELLER-FINANCED credit, not a card instalment — nobody guarantees a boleto, so if the buyer stops paying at parcela 4 the seller keeps four parcelas and loses the rest. Only the FIRST boleto is registered now; the rest are emitted month by month, and the sale activates when parcela 1 compensates. The product must have carnê enabled. Use list_products for the productId and list_customers for the customerId. Idempotent: the SDK attaches a key automatically, so a retry cannot register a second real boleto.

list_installment_plans
annotations: none low

List carnês for the authenticated seller, newest first. dueFrom/dueTo filter on the FIRST parcela

page number productId string customerId number
get_installment_plan
annotations: none low

Retrieve one carnê with every parcela: due date, status, barcode line and boleto PDF. Note totalCollected (what actually cleared) against totalScheduled (what the carnê bills) — they differ once a bank adds multa or mora, so totalCollected can legitimately exceed totalScheduled.

uuid string
reissue_plan_installment
annotations: none low

Issue a segunda via (replacement boleto) for one parcela, once the current slip has expired. Garu refuses while the old barcode is still live: a boleto stays payable at any bank until its due date plus five days, and two live barcodes for one parcela is how a buyer pays it twice. Allowed once per parcela per day.

uuid string number number
postpone_plan_installment
annotations: none low

Move ONE parcela to a later date. Its siblings keep their dates — this postpones a payment, it does not restructure the carnê. A slip already emitted stays payable on its original date until it expires.

uuid string number number
mark_plan_installment_paid
annotations: none low

Record a parcela as paid, for when the buyer paid the slip but the webhook never arrived. Garu asks the provider to confirm the charge really compensated before recording it, because this settles the transaction and pays affiliate and co-producer commissions. A provider outage refuses the action rather than trusting the assertion.

uuid string number number
cancel_installment_plan
annotations: none low

Cancel the carnê. Emission and reminders stop and open slips are cancelled at the provider. Money already collected is NOT returned — use request_plan_refund for that. A cancelled carnê is never revived by a late payment; money arriving afterwards opens a refund request instead.

uuid string
request_plan_refund
annotations: none low

Ask for a carnê to be refunded. Garu does NOT move this money: a boleto cannot be reversed and the funds already settled to the seller, so the return is a bank transfer only they can make. This records the request and notifies the seller team. The carnê KEEPS RUNNING while the request is pending — future parcelas still emit. Transfer the money, then close it with confirm_refund_request. Safe to retry: the SDK attaches an idempotency key automatically, and the gateway already refuses a second pending request for the same carnê.

uuid string reason string
get_integration_setup
annotations: none low

Return the steps and dashboard URLs an agent needs to integrate an application with Garu:

list_refund_requests
annotations: none low

List refunds Garu has been asked to make. Garu does NOT move this money: a boleto cannot be reversed and Celcoin exposes no Pix devolução, so the funds already settled to the seller and the return is a bank transfer only they can make. Covers carnê and Pix/boleto charges alike. Filter status=

page number planId string
get_refund_request
annotations: none low

Retrieve one refund request. Exactly one of installmentPlanId or chargeId is set, depending on whether the refund is for a carnê or for a single Pix/boleto charge.

uuid string
confirm_refund_request
annotations: none low

Record that the seller HAS ALREADY returned the money. Call this only after the transfer actually happened — Garu never observes it and takes the seller

uuid string
reject_refund_request
annotations: none low

Decline a refund request. The carnê is untouched and keeps running exactly as it was; the fact that a refund was asked for is deliberately not erased. Idempotent.

uuid string
list_products
annotations: none low

List products for the authenticated seller with pagination and search.

page number search string
get_product
annotations: none low

Get details of a specific product by UUID.

uuid string
get_product_portal_config
annotations: none low

Get the per-product portal customization (business name, logo, primary color,

create_product
annotations: none low

Create a product for the authenticated seller. Returns the created product,

name string
update_product
annotations: none low

Update an existing product (partial PATCH — only the fields you provide are

set_product_portal_config
annotations: none low

Create or merge the per-product portal customization. Both this tool and

clear_product_portal_config
annotations: none low

Remove the per-product portal customization. The product falls back to the

list_webhook_events
annotations: none low

List webhook events for the authenticated seller. Filter by delivery status (pending, success, failed), by Garu event type (e.g.

get_webhook_event
annotations: none low

Fetch one webhook event by uuid. Returns the full payload, the embedded endpoint snapshot, the most recent response status/body, and the retry schedule. Use this to drill into why a delivery is failing.

uuid string
retry_webhook_event
annotations: none low

Re-deliver a webhook event by uuid. Resets it to

uuid string
resend_webhook_event
annotations: none low

Re-deliver a webhook event by uuid, audit-trail preserving. Inserts a fresh event (new uuid) that points back at the source via manualResendOf, then dispatches that clone — the original row is left untouched, so its prior response status/body stays on the record. Works on any status (success, failed, pending). Returns the clone event; the returned uuid is the new event

Permissions 1

env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 118

low
Tool 'create_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'list_scheduled_charges' has no annotations annotation_checker · 100%
low
Tool 'get_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'postpone_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'pause_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'resume_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'mark_paid_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'charge_now_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'cancel_recurrence_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'set_cancel_at_period_end_scheduled_charge' has no annotations annotation_checker · 100%
low
Tool 'change_scheduled_charge_payment_method' has no annotations annotation_checker · 100%
low
Tool 'clear_scheduled_charge_payment_method' has no annotations annotation_checker · 100%
low
Tool 'list_scheduled_charge_attempts' has no annotations annotation_checker · 100%
low
Tool 'list_offers' has no annotations annotation_checker · 100%
low
Tool 'get_offer' has no annotations annotation_checker · 100%
low
Tool 'create_offer' has no annotations annotation_checker · 100%
low
Tool 'update_offer' has no annotations annotation_checker · 100%
low
Tool 'delete_offer' has no annotations annotation_checker · 100%
low
Tool 'create_pix_charge' has no annotations annotation_checker · 100%
low
Tool 'create_boleto_charge' has no annotations annotation_checker · 100%
low
Tool 'list_charges' has no annotations annotation_checker · 100%
low
Tool 'get_charge' has no annotations annotation_checker · 100%
low
Tool 'refund_charge' has no annotations annotation_checker · 100%
low
Tool 'cancel_charge' has no annotations annotation_checker · 100%
low
Tool 'create_customer' has no annotations annotation_checker · 100%
low
Tool 'list_customers' has no annotations annotation_checker · 100%
low
Tool 'get_customer' has no annotations annotation_checker · 100%
low
Tool 'update_customer' has no annotations annotation_checker · 100%
low
Tool 'set_customer_billing_email_override' has no annotations annotation_checker · 100%
low
Tool 'delete_customer' has no annotations annotation_checker · 100%
low
Tool 'create_installment_plan' has no annotations annotation_checker · 100%
low
Tool 'list_installment_plans' has no annotations annotation_checker · 100%
low
Tool 'get_installment_plan' has no annotations annotation_checker · 100%
low
Tool 'reissue_plan_installment' has no annotations annotation_checker · 100%
low
Tool 'postpone_plan_installment' has no annotations annotation_checker · 100%
low
Tool 'mark_plan_installment_paid' has no annotations annotation_checker · 100%
low
Tool 'cancel_installment_plan' has no annotations annotation_checker · 100%
low
Tool 'request_plan_refund' has no annotations annotation_checker · 100%
low
Tool 'get_integration_setup' has no annotations annotation_checker · 100%
low
Tool 'list_refund_requests' has no annotations annotation_checker · 100%
low
Tool 'get_refund_request' has no annotations annotation_checker · 100%
low
Tool 'confirm_refund_request' has no annotations annotation_checker · 100%
low
Tool 'reject_refund_request' has no annotations annotation_checker · 100%
low
Tool 'list_products' has no annotations annotation_checker · 100%
low
Tool 'get_product' has no annotations annotation_checker · 100%
low
Tool 'get_product_portal_config' has no annotations annotation_checker · 100%
low
Tool 'create_product' has no annotations annotation_checker · 100%
low
Tool 'update_product' has no annotations annotation_checker · 100%
low
Tool 'set_product_portal_config' has no annotations annotation_checker · 100%
low
Tool 'clear_product_portal_config' has no annotations annotation_checker · 100%
low
Tool 'list_webhook_events' has no annotations annotation_checker · 100%
low
Tool 'get_webhook_event' has no annotations annotation_checker · 100%
low
Tool 'retry_webhook_event' has no annotations annotation_checker · 100%
low
Tool 'resend_webhook_event' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: vitest@3.2.4 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.2.4 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: create_scheduled_charge manifest_parser · 70%
info
Tool: list_scheduled_charges manifest_parser · 70%
info
Tool: get_scheduled_charge manifest_parser · 70%
info
Tool: postpone_scheduled_charge manifest_parser · 70%
info
Tool: pause_scheduled_charge manifest_parser · 70%
info
Tool: resume_scheduled_charge manifest_parser · 70%
info
Tool: mark_paid_scheduled_charge manifest_parser · 70%
info
Tool: charge_now_scheduled_charge manifest_parser · 70%
info
Tool: cancel_recurrence_scheduled_charge manifest_parser · 70%
info
Tool: set_cancel_at_period_end_scheduled_charge manifest_parser · 70%
info
Tool: change_scheduled_charge_payment_method manifest_parser · 70%
info
Tool: clear_scheduled_charge_payment_method manifest_parser · 70%
info
Tool: list_scheduled_charge_attempts manifest_parser · 70%
info
Tool: list_offers manifest_parser · 70%
info
Tool: get_offer manifest_parser · 70%
info
Tool: create_offer manifest_parser · 70%
info
Tool: update_offer manifest_parser · 70%
info
Tool: delete_offer manifest_parser · 70%
info
Tool: create_pix_charge manifest_parser · 70%
info
Tool: create_boleto_charge manifest_parser · 70%
info
Tool: list_charges manifest_parser · 70%
info
Tool: get_charge manifest_parser · 70%
info
Tool: refund_charge manifest_parser · 70%
info
Tool: cancel_charge manifest_parser · 70%
info
Tool: create_customer manifest_parser · 70%
info
Tool: list_customers manifest_parser · 70%
info
Tool: get_customer manifest_parser · 70%
info
Tool: update_customer manifest_parser · 70%
info
Tool: set_customer_billing_email_override manifest_parser · 70%
info
Tool: delete_customer manifest_parser · 70%
info
Tool: create_installment_plan manifest_parser · 70%
info
Tool: list_installment_plans manifest_parser · 70%
info
Tool: get_installment_plan manifest_parser · 70%
info
Tool: reissue_plan_installment manifest_parser · 70%
info
Tool: postpone_plan_installment manifest_parser · 70%
info
Tool: mark_plan_installment_paid manifest_parser · 70%
info
Tool: cancel_installment_plan manifest_parser · 70%
info
Tool: request_plan_refund manifest_parser · 70%
info
Tool: get_integration_setup manifest_parser · 70%
info
Tool: list_refund_requests manifest_parser · 70%
info
Tool: get_refund_request manifest_parser · 70%
info
Tool: confirm_refund_request manifest_parser · 70%
info
Tool: reject_refund_request manifest_parser · 70%
info
Tool: list_products manifest_parser · 70%
info
Tool: get_product manifest_parser · 70%
info
Tool: get_product_portal_config manifest_parser · 70%
info
Tool: create_product manifest_parser · 70%
info
Tool: update_product manifest_parser · 70%
info
Tool: set_product_portal_config manifest_parser · 70%
info
Tool: clear_product_portal_config manifest_parser · 70%
info
Tool: list_webhook_events manifest_parser · 70%
info
Tool: get_webhook_event manifest_parser · 70%
info
Tool: retry_webhook_event manifest_parser · 70%
info
Tool: resend_webhook_event manifest_parser · 70%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (3) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 393 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%