OpenFinDataSAFE
Dados Financeiros Abertos — infraestrutura open source para dados financeiros públicos do Brasil via API REST, MCP, CLI e Python.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Infraestrutura open source para consultar dados financeiros públicos do Brasil em Python, REST, CLI e MCP.
[](https://github.com/robertoecf/openfindata/actions/workflows/ci.yml) [](LICENSE)
O que é
O projeto agrega fontes públicas brasileiras em uma camada única e auditável para analistas, desenvolvedores, pesquisadores e agentes:
- biblioteca Python assíncrona;
- API REST com Swagger e ReDoc;
- CLI
findata; - servidor MCP em
/mcp; - registro local para resolver CNPJ, ticker e nome.
As fontes principais não exigem chaves de API e os testes unitários não acessam a rede. O slug de distribuição é openfindata; o pacote importável e a CLI continuam sendo findata.
Instalação
pip install openfindata
Para desenvolvimento local:
git clone https://github.com/robertoecf/openfindata.git cd openfindata pip install -e '.[dev]' bash scripts/git/install-hooks.sh
Uso rápido
CLI
findata bcb get selic -n 10 findata bcb ptax findata cvm search Petrobras findata b3 quote PETR4 findata registry lookup 33000167000101 findata serve
Python
import asyncio
from findata.registry import lookup
from findata.sources.bcb import sgs
async def main() -> None:
selic = await sgs.get_series_by_name("selic", n=5)
print(selic)
entity = await lookup("PETR4")
print(entity.entities[0])
asyncio.run(main())REST e MCP
findata serve curl 'http://localhost:8000/bcb/series/name/selic?n=5' curl 'http://localhost:8000/registry/lookup?q=PETR4'
f8b80405fd4eOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add openfindata-mcp -- npx -y [email protected]
{
"mcpServers": {
"openfindata-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (10)
10 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
bcb_focus | read | |
bcb_ptax | read | |
bcb_series | read | |
cvm_fund | read | |
ibge_indicator | read | |
ibge_ipca_breakdown | read | |
ipea_search | read | |
ipea_series | read | |
openfinance_directory | read | |
tesouro_siconfi | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (15)
# # then cloudflared points at http://127.0.0.1:8001
curl -sS http://127.0.0.1:8001/health
| Ingress | `http://127.0.0.1:8001` |
-X POST http://127.0.0.1:8001/mcp \
http://127.0.0.1:8001/stats
decoded = json.loads(base64.b64decode(encoded).decode("utf-8"))decoded = json.loads(base64.b64decode(encoded).decode("utf-8"))return json.loads(base64.b64decode(encoded).decode("utf-8"))decoded = json.loads(base64.b64decode(encoded).decode("utf-8"))@cloudflare/workers-types, @modelcontextprotocol/server, agents, wrangler, zod
- Token endpoint: `POST /oauth/access-token` (não `/oauth/token`).
src/findata/data/registry.sqlite
cat > deploy/.env <<EOF
| **BNDES Open Banking** | API key | Issue ou PR |
curl -L https://pkg.cloudflare.com/install.sh | sudo bash
Gates applied: no_behavioural_pass.
f8b80405fd4efull audit observations/trust-audit/mcp-server/robertoecf__openfindata.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | f8b80405fd4e | SAFE | B | 89 | first audit |
Questions
What is the OpenFinData MCP server?
Dados Financeiros Abertos — infraestrutura open source para dados financeiros públicos do Brasil via API REST, MCP, CLI e Python.
What tools does OpenFinData expose?
10 in total: 10 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is OpenFinData safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does OpenFinData need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (f8b80405fd4e), read on 2026-10-10. The repository is watched and re-audited when it changes.