Atlas / MCP servers / fasuizu-br / fasuizu-br-brainiall-tts

fasuizu-br-brainiall-ttsSAFE

mcp/fasuizu-br/brainiall-tts-mcp

Hosted pay-per-use text-to-speech MCP server — 54 neural voices, 9 languages incl. Brazilian Portuguese. $0.008/1K chars, $10 free credits.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
2 2r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Hosted text-to-speech for AI agents via the Model Context Protocol.

54 neural voices, 9 languages — including native Brazilian Portuguese (pf_dora, pm_alex, pm_santa) — served from a hosted, pay-per-use API. No GPU, no model downloads, no ElevenLabs subscription: bring one API key and pay $0.008 per 1,000 characters ($10 free credits on signup).

Why this server

Every other TTS MCP server either runs models locally (heavy, slow to set up) or wraps a third-party key you already pay a subscription for. This one is a hosted, metered API:

  • Zero setup — remote server, nothing to install
  • Pay per use — $0.008/1K characters, billed against your Brainiall balance
  • $10 free credits — sign up at app.brainiall.com
  • WAV out — 16-bit PCM, 24 kHz mono, returned as playable MCP audio content or base64 JSON

Quick start

Get an API key at app.brainiall.com ($10 welcome credits, no card required).

VS Code / GitHub Copilot

[](https://insiders.vscode.dev/redirect/mcp/install?name=brainiall-tts&config=%7B%22type%22%3A%22http%22%2C%22url%22%3A%22https%3A%2F%2Fapi.brainiall.com%2Fmcp%2Ftts%2Fmcp%22%7D)

The button installs the remote server in discovery mode, so VS Code can list its tools without a secret. Synthesis still fails closed until you add your Brainiall API key. For a secure workspace configuration that prompts once and stores the key in VS Code's secret storage, copy .vscode/mcp.json into your project or clone this repository, then start brainiallTts from MCP: List Servers.

{
"inputs": [
{
"type": "promptString",
"id": "brainiall-api-key",
Read from source at commit b7640f7f708aOBSERVED · 2026-10-11
02

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
check_tts_servicereadCheck health status of the TTS API service.
list_voicesreadList available TTS voices with metadata.
03

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (8)

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
examples/openai-compatible-tts-adapter/README.md:34
The default base URL is `http://127.0.0.1:8787/v1`. The adapter keeps the key
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
examples/openai-compatible-tts-adapter/README.md:44
http://127.0.0.1:8787/v1/audio/speech \
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
examples/openai-compatible-tts-adapter/test_adapter.py:84
adapter.validate_upstream_url("http://127.0.0.1:9080/tts"),
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
examples/openai-compatible-tts-adapter/test_adapter.py:85
"http://127.0.0.1:9080/tts",
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
examples/openai-compatible-tts-adapter/test_adapter.py:123
upstream_url = f"http://127.0.0.1:{upstream.server_port}/tts"
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
examples/github-copilot-cloud/README.md:21
Copilot cloud agent can use configured MCP tools autonomously. Text passed to `synthesize_speech` is sent to Brainiall for processing, and synthesis consumes the Brainiall balance. Configure this serv
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
examples/claude-code/README.md:11
read -s "BRAINIALL_API_KEY?Brainiall API key: "
Why it matters. asks the agent to read credentials
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
examples/codex/README.md:17
read -s "BRAINIALL_API_KEY?Brainiall API key: "
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha b7640f7f708afull audit observations/trust-audit/mcp-server/fasuizu-br__brainiall-tts-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11b7640f7f708aSAFEB89first audit
05

Questions

What is the fasuizu-br-brainiall-tts MCP server?

Hosted pay-per-use text-to-speech MCP server — 54 neural voices, 9 languages incl. Brazilian Portuguese. $0.008/1K chars, $10 free credits.

What tools does fasuizu-br-brainiall-tts expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is fasuizu-br-brainiall-tts safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does fasuizu-br-brainiall-tts need?

It reads APIM_KEY, BRAINIALL_API_KEY and INTERNAL_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does fasuizu-br-brainiall-tts run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (b7640f7f708a), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement