Biggest private BR bank. Direct banking API for high-volume Pix, boleto, statements, and utility/tax payments. OAuth2 + mTLS (BACEN requirement for Pix v2). Alpha on npm — devportal.itau.com.br is contract-gated, endpoint paths flagged with TODO(verify).
Itaú gives your agent 22 tools it calls directly — pick the ones it needs, in Claude, Cursor, or any MCP client.
get_oauth_token — Mint or return a cached OAuth2 client_credentials bearer token for the Itaú Developer Portal. Exposed so agents can inspect token freshness; normal tool calls obtain tokens implicitly.send_pix — Initiate an outbound Pix payment from the merchant's Itaú account. Amount in BRL major units (e.g. '10.50').create_pix_qr — Create a dynamic Pix charge with QR code (cob). Returns the txid, copy-paste EMV payload, and location URL.// Your agent calls a tool directly — no glue code.
// CodeSpar's managed tier handles OAuth2, token rotation and rate limits.
const result = await session.call("get_oauth_token", { /* ... */ });$ npm install @codespar/mcp-itau@alphaAdd this entry to your claude_desktop_config.json (or any MCP-compatible client config).
{
"mcpServers": {
"itau": {
"command": "npx",
"args": [
"-y",
"@codespar/mcp-itau@alpha"
],
"env": {
"ITAU_CLIENT_ID": "<your_itau_client_id>",
"ITAU_CLIENT_SECRET": "<your_itau_client_secret>",
"ITAU_CERT_PATH": "<your_itau_cert_path>",
"ITAU_KEY_PATH": "<your_itau_key_path>"
}
}
}
}After restart, your agent can call any of the 22 tools below — try get_oauth_token first.
Required to authenticate the server. Stored encrypted when using CodeSpar managed hosting.
ITAU_CLIENT_IDItaú OAuth client_id issued via the Developer Portal after contract onboarding.
ITAU_CLIENT_SECRETItaú OAuth client_secret.
ITAU_CERT_PATHAbsolute path to the mTLS client certificate (.crt or .pem). BACEN mandates mTLS for Pix v2.
ITAU_KEY_PATHAbsolute path to the mTLS private key (.key or .pem).
ITAU_ENVEnvironment: 'sandbox' or 'production'. Defaults to 'sandbox'.
Each tool is independent — your agent loads only what it needs to reduce context and response time.
get_oauth_tokensend_pixcreate_pix_qrget_pixresolve_dict_keyrefund_pixcreate_boletoget_boletoMCP is a protocol — any framework that speaks it can mount this server.