Next free-source huntWe check for new free data every weekday.
FinancialMCP serverFirst audited Nov 13, 2026

Lunium — Brazilian PIX and stablecoin payments

Accept Pix in Brazil and settle in USDT/USDC; pay Pix with crypto; verify a Pix with no API key.The vendor's description, from its MCP Registry listing.

Passed public checksAudited Nov 13, 2026

Every public check ran and passed. Public audit: we connect as an AI client would, list the tools and check what they say. We do not run them. How we audit

Does it work?
YesConnected in 493 ms.
Sign-up?
None neededIt answered without any account or key.
Can it change things?
YesSome tools say they can change things. Your AI client should ask you first.
Endpointhttps://api.luniumpay.com/mcp

Source code Website Streamable HTTP · protocol 2025-06-18 · server version 1.2.0

What we checked, the evidence, and the tools it offers.

What we checked

Security

  • Passed: Connections are encrypted (HTTPS).

  • Passed: No hidden instructions found in tool text.

Safety labels

  • Note: 9 tools are labelled as able to change things.

    Expected for tools that send, write or buy. Your AI client should ask before calling them.

    • lunium_create_sandbox_key
    • lunium_contact
    • lunium_quote_crypto_sale
    • lunium_confirm_crypto_sale
    • lunium_create_pix_charge
    • lunium_request_usdt_deposit
    • lunium_pay_pix_with_usdt
    • lunium_start_sandbox_demo
    • and 1 more
  • Passed: Every tool says whether it only reads or can change things.

Tools

  • Note: Some tool text is long, so it uses more of the AI's working memory.

    • server instructions (5,727 characters)
  • Passed: 20 tools listed.

  • Passed: Every tool describes its inputs with a valid schema.

Protocol

  • Note: Protocol version 2025-06-18.

  • Passed: The MCP handshake works (Streamable HTTP).

  • Passed: Unknown requests are refused.

Connection

  • Passed: The server responds.

Tools (20)

As the server describes them. The labels are the server's own: it says whether each tool only reads or can change things.

  • lunium_create_sandbox_keyProvisions a Lunium TEST api key for you, in one call, with no prior credentials, no human approval and no money involved. Use it when a Lunium tool told you erro="chave_ausente" and you want to expl…Can change things
  • lunium_contactHands a message to a human at Lunium and returns immediately. Use it ONLY when your user explicitly asked to talk to a person, or asked for something no tool and no page can settle: volume pricing, a…Can change things
  • lunium_check_network_healthReal-time operational state of the public Lunium services, measured by an internal probe every 5 minutes: overall state plus per-component state (api, pix_charge = cash-in rail, crypto_sale = cash-ou…Read-only
  • lunium_verify_pix_paymentConfirms that a specific PIX payment actually settled in Brazil, using the Central Bank end-to-end identifier (E2E). Free and open: no API key, no Lunium account. You can verify a payment you did not…Read-only
  • lunium_list_settlement_optionsPublic catalog with explicit direction and pagination. direction=deposit is crypto-to-PIX (GET /catalog); direction=delivery is PIX/custody-to-crypto (GET /cashin/catalog). Filter by asset/network. F…Read-only
  • lunium_check_payer_limitRequires an API key. Returns how much a specific Brazilian taxpayer (CPF for a person, CNPJ for a company) can move through a PIX charge right now, in cents. Read-only — no charge is created. Call i…Read-only
  • lunium_get_crypto_saleRequires an API key. Returns the current state of a crypto sale and, once settled, the receipt: pix_e2e (Central Bank identifier), receipt_url (a page to show a person), receipt_pdf_url and verify_ur…Read-only
  • lunium_get_pix_chargeRequires an API key. Returns the state of a charge created with lunium_create_pix_charge. Read BOTH status (PIX state) and settlement_status (crypto delivery). status=paid alone does not mean crypto…Read-only
  • lunium_quote_crypto_saleRequires an API key. Pay a PIX key or PIX copy-and-paste charge with crypto. Choose ONE mode: amount + pix_key (sell that crypto amount); brl_amount + pix_key (quote for a target BRL amount); or br_c…Can change things
  • lunium_confirm_crypto_saleRequires an API key. Step 2 of 3. Accepts the quote and returns deposit_address — the address the crypto must be sent to. Crypto arriving there will be converted and paid out to the PIX recipient fro…Can change things
  • lunium_create_pix_chargeRequires an API key. Creates a PIX charge: returns a QR code and a copy-and-paste string any Brazilian payer can pay from their bank app. When it is paid, crypto is delivered to payout_address. The p…Can change things
  • lunium_get_usdt_walletRequires an API key. The project's USDT wallet: balance.available (what can pay PIX now), balance.reserved (held by PIX payments in progress) and balance.confirming (deposits seen, not yet credited),…Read-only
  • lunium_request_usdt_depositRequires an API key. Opens a deposit request and returns amount_to_send, address, network_name and expires_at. Nothing moves until the USER sends crypto from their own wallet or exchange. Show the us…Can change things
  • lunium_list_usdt_depositsRequires an API key. The 100 most recent deposit requests with status (waiting, confirming, available, expired, under_review, reversed), amount_to_send, amount_received and credited_at. available = c…Read-only
  • lunium_quote_pix_with_usdtRequires an API key. No effect: how much USDT a PIX costs. Send EITHER brl_amount (what the recipient receives, in BRL, e.g. "50.00") OR br_code (a PIX Copia e Cola code; amount and recipient come fr…Read-only
  • lunium_pay_pix_with_usdtRequires an API key. Pays a PIX from the project's USDT balance: reserves USDT, pays the PIX and debits what it cost. A PIX cannot be undone. The recipient (pix_key or br_code) and the amount must co…Can change things
  • lunium_get_usdt_pix_paymentRequires an API key. The state of a payment from lunium_pay_pix_with_usdt. final=true means it will not change anymore. concluido: show pix_e2e, recipient_name, recipient_document (partial) and recei…Read-only
  • lunium_plan_integrationStart here to integrate Lunium. Returns the current API flow, runnable starter, sandbox limits and production checklist. No credentials or personal data needed.Read-only
  • lunium_start_sandbox_demoCreates a test-only key and runs the selected complete synthetic journey: cashin (PIX to BTC), custody (PIX credit then USDC withdrawal on Base), payout (PIX credit then PIX withdrawal), or cashout (…Can change things
  • lunium_get_sandbox_demoContinues the fixed test-only journey and reads its status. After a simulated custody credit it may create the planned synthetic withdrawal once, idempotently. COMPLETED is a simulated payment, not r…Can change things

Audit history

  1. Nov 13Passed

What we sent

Every request in this audit, with the answer and how long it took. We never send credentials and never call a tool.

RequestAnswerTime
initializeHTTP 200493 ms
initializedHTTP 202474 ms
tools/listHTTP 200371 ms
resources/listHTTP 200135 ms
unknown-methodHTTP 200136 ms

Run this server, or disagree with the result?

Fix the issue and it shows in the next weekly audit, or email us to ask for a re-audit or to dispute a finding. Read how we audit for what each check means.