registry / zuckpay-mcp / 0.3.0

zuckpay-mcp@0.3.0

Servidor MCP oficial da ZuckPay — crie cobranças PIX, SPEI e PayPal e consulte transações direto do seu assistente de IA.

AI Security Review

scanned 13h ago · by lpm-firewall-ai

At runtime, this MCP server performs payment-account API actions using user-provided ZuckPay credentials. The withdrawal capability is opt-in and requires confirm: true, but can move real funds.

Static reason

No blocking static signals were detected.

Trigger

User runs the MCP server, sets ZUCKPAY_ENABLE_WITHDRAW=true, and invokes createPixWithdraw.

Impact

Authorized MCP use can create charges, capture payments, and opt in to a real-funds withdrawal.

Mechanism

Authenticated ZuckPay API calls through MCP tools.

Rationale

Source supports a package-aligned payment MCP client, with no malicious install/import behavior or exfiltration. Its real-money withdrawal capability remains a dangerous dual-use action and warrants a warning.

Evidence

package.jsondist/index.jsdist/http.jsdist/chunk-DPJWOTQI.jsREADME.md

Network endpoints1

www.zuckpay.com.br/conta

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

zuckpay-mcp@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code