About mcp-bold-co
mcp-bold-co is an MCP server for Bold, a Colombian acquirer, for creating payment links and checking their status across cards, PSE, Nequi and Botón Bancolombia. It also provides local tools for checkout integrity signatures and webhook signature validation.
Key features
- 01Fixed or open amount payment links
- 02Payment links limited to a payment method
- 03Payment link status queries
- 04Merchant payment method listing
- 05Local checkout integrity signature generation
- 06Local webhook HMAC signature validation
Use cases
- 01Generate PSE or card payment links through an AI assistant
- 02Poll a payment link until it reports paid
- 03Verify the signature of incoming Bold webhooks
MCP support
This project is an MCP server that exposes 7 tools to MCP clients, including calls to the Bold API and two local signature tools.
Configuration
Local server config is the same for every client. Copy it into your client’s MCP config file.
npx -y @codespar/mcp-bold-coBOLD_API_KEYSecretBold identity API key (llave de identidad), sent as x-api-keyBOLD_SECRET_KEYSecretBold secret key. Only needed for the local checkout-signature and webhook-validation tools.Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.
Tools
7Saved tool list · updated 2w ago
| Parameter | Type | Required | Description |
|---|---|---|---|
| currency | string | No | Currency code (default COP) |
| tip_amount | number | No | Tip portion of the amount (default 0) |
| amount_type | enum | No | CLOSE for a fixed amount (default), OPEN lets the payer type the amountCLOSE | OPEN |
| description | string | Yes | What the payer sees on the checkout page |
| payer_email | string | No | Prefill the payer's email on the checkout page |
| callback_url | string | No | URL the payer is redirected to after paying |
| total_amount | number | No | Total amount in COP (required when amount_type=CLOSE) |
| expiration_date | number | No | Link expiry as a Unix timestamp in NANOSECONDS (Bold convention). Omit for no expiry. |
| payment_methods | array | No | Restrict accepted methods, e.g. ["CREDIT_CARD", "PSE", "NEQUI", "BOTON_BANCOLOMBIA"]. Omit to accept every method enabled on the merchant. |
Details
From the project README@codespar/mcp-bold-co
MCP server for Bold — Colombian acquirer (bold.co): payment links for cards, PSE, Nequi and Botón Bancolombia, plus the checkout integrity-signature and webhook-validation helpers.
Bold's public integrations API is link-first: create a payment link (fixed or open amount), hand the payer payload.url, then poll the link until it reports PAID. The embedded checkout button flow is secured with a SHA-256 integrity signature and webhooks are HMAC-signed — both covered here as local tools.
Quick Start
Claude Desktop
Add to ~/.config/claude/claude_desktop_config.json:
{
"mcpServers": {
"bold-co": {
"command": "npx",
"args": ["-y", "@codespar/mcp-bold-co"],
"env": {
"BOLD_API_KEY": "your-identity-key",
"BOLD_SECRET_KEY": "your-secret-key"
}
}
}
}
Claude Code
claude mcp add bold-co --env BOLD_API_KEY=your-identity-key -- npx -y @codespar/mcp-bold-co
Tools (7)
| Tool | Description |
|---|---|
create_payment_link | Create a payment link (POST /online/link/v1) — cards, PSE, Nequi, Botón Bancolombia |
create_pse_payment_link | Convenience: link restricted to PSE bank debit |
create_card_payment_link | Convenience: link restricted to cards |
get_payment_link | Query a link's status: ACTIVE, PROCESSING, PAID, REJECTED, EXPIRED |
list_payment_methods | Payment methods enabled for this merchant |
generate_checkout_signature | SHA-256 integrity hash for the embedded checkout button (local) |
validate_webhook_signature | Verify the HMAC signature on a Bold webhook (local) |
Environment
| Variable | Required | Description |
|---|---|---|
BOLD_API_KEY | yes | Identity key (llave de identidad), sent as Authorization: x-api-key |
BOLD_SECRET_KEY | no | Secret key — only for the local signature/webhook tools |
Bold has no separate sandbox host; test mode is driven by test keys from the Bold dashboard.
Docs
- Provider docs: https://developers.bold.co
- Managed tier (one interface across every LATAM provider, governance + audit): https://codespar.dev/agents
Enterprise
Need governance, budget limits, and audit trails for agent-driven payments on Bold? CodeSpar Enterprise adds a policy engine, payment routing, and compliance templates on top of these MCP servers.
License
MIT
Comments
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.