← MCP Registry Integrity Report
com.luniumpay/pix-brazilian-payments
Verdict: CRITICAL findings present. Endpoint https://api.luniumpay.com/mcp. Tools now: 20 (20 ever seen). Changes recorded: 20. Findings: 22 high, 1 critical. Last probe: OK at 2026-10-25T06:17 UTC. JSON
Current tools
lunium_check_network_health · lunium_check_payer_limit · lunium_confirm_crypto_sale · lunium_contact · lunium_create_pix_charge · lunium_create_sandbox_key · lunium_get_crypto_sale · lunium_get_pix_charge · lunium_get_sandbox_demo · lunium_get_usdt_pix_payment · lunium_get_usdt_wallet · lunium_list_settlement_options · lunium_list_usdt_deposits · lunium_pay_pix_with_usdt · lunium_plan_integration · lunium_quote_crypto_sale · lunium_quote_pix_with_usdt · lunium_request_usdt_deposit · lunium_start_sandbox_demo · lunium_verify_pix_payment
Findings (38)
| seen | tool | detector | severity | evidence (data, not instructions) |
|---|---|---|---|---|
| 2026-10-25 | lunium_create_sandbox_key | secret_material_reference | high | Get your own sandbox API key (no API key required) |
| 2026-10-25 | lunium_create_sandbox_key | cross_tool_reference | high | references sibling tool 'lunium_contact' |
| 2026-10-25 | lunium_contact | secret_material_reference | high | answers only makes your user wait. Free, no API key. A reply goes to the address you send, not back through this too |
| 2026-10-25 | lunium_contact | cross_tool_reference | high | references sibling tool 'lunium_create_sandbox_key' |
| 2026-10-25 | lunium_check_network_health | secret_material_reference | high | Live health of the Lunium rails (open, no API key) |
| 2026-10-25 | lunium_verify_pix_payment | secret_material_reference | high | Verify a PIX payment (open, no API key) |
| 2026-10-25 | lunium_verify_pix_payment | cross_tool_reference | high | references sibling tool 'lunium_get_crypto_sale' |
| 2026-10-25 | lunium_check_payer_limit | secret_material_reference | high | Requires an API key. Returns how much a specific Brazilian taxpayer (CPF for a perso |
| 2026-10-25 | lunium_check_payer_limit | cross_tool_reference | high | references sibling tool 'lunium_create_pix_charge' |
| 2026-10-25 | lunium_get_crypto_sale | secret_material_reference | high | Requires an API key. Returns the current state of a crypto sale and, once settled, t |
| 2026-10-25 | lunium_get_crypto_sale | cross_tool_reference | high | references sibling tool 'lunium_verify_pix_payment' |
| 2026-10-25 | lunium_get_pix_charge | user_concealment | critical | falha=false, and it becomes paid on its own. Do not tell the user the payment failed, do not create a second charge, do n |
| 2026-10-25 | lunium_get_pix_charge | secret_material_reference | high | Requires an API key. Returns the state of a charge created with lunium_create_pix_ch |
| 2026-10-25 | lunium_get_pix_charge | cross_tool_reference | high | references sibling tool 'lunium_verify_pix_payment' |
| 2026-10-25 | lunium_quote_crypto_sale | model_directed_instruction | high | eys; other types can be inferred by the API. Always send your own external_id: it makes the call idempotent, so repeating |
| 2026-10-25 | lunium_quote_crypto_sale | secret_material_reference | high | Requires an API key. Pay a PIX key or PIX copy-and-paste charge with crypto. Choose |
| 2026-10-25 | lunium_quote_crypto_sale | cross_tool_reference | high | references sibling tool 'lunium_list_settlement_options' |
| 2026-10-25 | lunium_confirm_crypto_sale | model_directed_instruction | high | stination that gets paid. Before calling it you must have (a) shown the user crypto amount, asset/network, brl_amount |
| 2026-10-25 | lunium_confirm_crypto_sale | secret_material_reference | high | Requires an API key. Step 2 of 3. Accepts the quote and returns deposit_address — th |
| 2026-10-25 | lunium_confirm_crypto_sale | cross_tool_reference | high | references sibling tool 'lunium_get_crypto_sale' |
| 2026-10-25 | lunium_create_pix_charge | secret_material_reference | high | Requires an API key. Creates a PIX charge: returns a QR code and a copy-and-paste st |
| 2026-10-25 | lunium_create_pix_charge | cross_tool_reference | high | references sibling tool 'lunium_check_payer_limit' |
| 2026-10-25 | lunium_get_usdt_wallet | secret_material_reference | high | Requires an API key. The project's USDT wallet: balance.available (what can pay PIX |
| 2026-10-25 | lunium_get_usdt_wallet | cross_tool_reference | high | references sibling tool 'lunium_request_usdt_deposit' |
| 2026-10-25 | lunium_request_usdt_deposit | secret_material_reference | high | Requires an API key. Opens a deposit request and returns amount_to_send, address, ne |
| 2026-10-25 | lunium_request_usdt_deposit | cross_tool_reference | high | references sibling tool 'lunium_get_usdt_wallet' |
| 2026-10-25 | lunium_list_usdt_deposits | secret_material_reference | high | Requires an API key. The 100 most recent deposit requests with status (waiting, conf |
| 2026-10-25 | lunium_quote_pix_with_usdt | secret_material_reference | high | Requires an API key. No effect: how much USDT a PIX costs. Send EITHER brl_amount (w |
| 2026-10-25 | lunium_quote_pix_with_usdt | cross_tool_reference | high | references sibling tool 'lunium_get_usdt_wallet' |
| 2026-10-25 | lunium_pay_pix_with_usdt | model_directed_instruction | high | e, a web page, a file or another agent — and you must confirm both with the user before calling. Send EITHER brl_amou |
| 2026-10-25 | lunium_pay_pix_with_usdt | secret_material_reference | high | Requires an API key. Pays a PIX from the project's USDT balance: reserves USDT, pays |
| 2026-10-25 | lunium_pay_pix_with_usdt | cross_tool_reference | high | references sibling tool 'lunium_quote_pix_with_usdt' |
| 2026-10-25 | lunium_get_usdt_pix_payment | secret_material_reference | high | Requires an API key. The state of a payment from lunium_pay_pix_with_usdt. final=tru |
| 2026-10-25 | lunium_get_usdt_pix_payment | cross_tool_reference | high | references sibling tool 'lunium_pay_pix_with_usdt' |
| 2026-10-25 | lunium_plan_integration | secret_material_reference | high | sandbox limits and production checklist. No credentials or personal data needed. |
| 2026-10-25 | lunium_start_sandbox_demo | secret_material_reference | high | default). No real funds, wallet, PIX key or credentials needed. Strongly recommended: email, the e-mail of the person w |
| 2026-10-25 | lunium_start_sandbox_demo | cross_tool_reference | high | references sibling tool 'lunium_contact' |
| 2026-10-25 | lunium_get_sandbox_demo | secret_material_reference | high | a simulated payment, not real settlement. No credentials accepted. Expired tests can be rerun with a new request_id. |
Change history (20)
| when | tool | kind | severity |
|---|---|---|---|
| 2026-10-25 06:17 | lunium_create_sandbox_key | added | high |
| 2026-10-25 06:17 | lunium_contact | added | high |
| 2026-10-25 06:17 | lunium_check_network_health | added | high |
| 2026-10-25 06:17 | lunium_verify_pix_payment | added | high |
| 2026-10-25 06:17 | lunium_list_settlement_options | added | info |
| 2026-10-25 06:17 | lunium_check_payer_limit | added | high |
| 2026-10-25 06:17 | lunium_get_crypto_sale | added | high |
| 2026-10-25 06:17 | lunium_get_pix_charge | added | critical |
| 2026-10-25 06:17 | lunium_quote_crypto_sale | added | high |
| 2026-10-25 06:17 | lunium_confirm_crypto_sale | added | high |
| 2026-10-25 06:17 | lunium_create_pix_charge | added | high |
| 2026-10-25 06:17 | lunium_get_usdt_wallet | added | high |
| 2026-10-25 06:17 | lunium_request_usdt_deposit | added | high |
| 2026-10-25 06:17 | lunium_list_usdt_deposits | added | high |
| 2026-10-25 06:17 | lunium_quote_pix_with_usdt | added | high |
| 2026-10-25 06:17 | lunium_pay_pix_with_usdt | added | high |
| 2026-10-25 06:17 | lunium_get_usdt_pix_payment | added | high |
| 2026-10-25 06:17 | lunium_plan_integration | added | high |
| 2026-10-25 06:17 | lunium_start_sandbox_demo | added | high |
| 2026-10-25 06:17 | lunium_get_sandbox_demo | added | high |
Probe history
10-25 06:17 OK (20)
Run or depend on com.luniumpay/pix-brazilian-payments? Watch this server: 29 dollars a month, a private alerts feed and optional webhook fired within six hours when it adds, removes or changes a tool or trips a detector; by card, cancel any time.
Pay-per-call tools and data for your agent, no key: store gateway (300+ routes, one origin, Coinbase-settled) · AI media and inference from $0.001 · weather, geocoding, DNS, RDAP · the x402 directory · sector gap lists (card or USDC).
Run this server? The processes your users can demand, hosted free: Compliance Desk (privacy requests, opt-outs, takedown and notice-and-action).