Atlas / MCP servers / sidneybissoli / bcb-br-mcp

bcb-br-mcpSAFE

mcp/sidneybissoli/bcb-br-mcp

MCP server for Brazil Central Bank (BCB) data — Selic, IPCA, exchange rates, GDP for AI agents

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
8 8r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
9
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/bcb-br-mcp) [](https://www.npmjs.com/package/bcb-br-mcp) [](https://www.npmjs.com/package/bcb-br-mcp) [](https://registry.modelcontextprotocol.io) [](https://lobehub.com/mcp/sidneybissoli-bcb-br-mcp) [](https://smithery.ai/servers/sidneybissoli/bcb-br-mcp) [](https://github.com/SidneyBissoli/bcb-br-mcp) [](https://github.com/sponsors/SidneyBissoli) [](https://opensource.org/licenses/MIT) [](https://allmcps.com/mcp/sidneybissoli-bcb-br-mcp) [](https://mcpindex.ai/server/io-github-sidneybissoli-bcb-br-mcp)

Leia em Português

MCP (Model Context Protocol) server for the Brazilian Central Bank (Banco Central do Brasil, BCB): SGS time series (SGS/BCB), the Focus market-expectations survey (served over the Olinda OData API) and PTAX exchange rates.

Query economic and financial indicators such as Selic (interest rate), IPCA (inflation), exchange rates, GDP, and more, directly from AI assistants like Claude.

If you find this project useful, please consider giving it a star on GitHub.
Read from source at commit 6fa91688d15aOBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add bcb-br-mcp -- npx -y [email protected]
03

Exposed tools (8)

8 read · 0 write · 0 destructive.

ToolRiskDescription
bcb_cambio_cotacaoreadConsulta a cotação PTAX de uma moeda contra o real, em um dia específico ou num intervalo de datas.
bcb_cambio_moedasreadLista as moedas com cotação publicada pelo Banco Central, com símbolo, nome e tipo, e aceita um termo
bcb_focus_expectativasreadConsulta as expectativas de mercado do boletim Focus para UM indicador, com o horizonte como parâmetro:
bcb_focus_referenciasreadLista, POR ESCOPO, os indicadores e as referências que o Focus efetivamente publica, para você usar o
bcb_focus_selicreadConsulta as expectativas de mercado do Focus para a taxa Selic, organizadas pela REUNIÃO do Copom
comparar_inflacaoreadCompara os principais índices de inflação do Brasil (IPCA, IGP-M, INPC) nos últimos 12 meses
indicadores_atuaisreadConsulta os principais indicadores econômicos do Brasil (Selic, IPCA, Dólar, IBC-Br)
panorama_economicoreadGera um panorama completo da economia brasileira com os principais indicadores
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (13)

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
worker/src/icon.ts:15
"iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAIAAADTED8xAAEAAElEQVR42oT92a9t65Ufho0xvma2q999c/pzO96GZJHFUlWxipKsJiUpMmArkiFIsktAYsEwEOVFeQnyHyQIlNh5jB0giBFIliNBkavE6lksFnnJey9vd/pu93vt1c/u60Ye5jqHl2SVvc95WHuvvde
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/evals/fixtures.test.ts:16
describe("catálogo do eval (vivo, de TOOL_DEFINITIONS)", () => {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/deploy-worker.yml:60
# O worker importa ../../dist/*.js do pacote pai e resolve o SDK do
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/config.ts:9
import { SERVER_IDENTITY } from "../../dist/identity.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/config.ts:10
import pkg from "../../package.json";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/envelope.ts:60
import { classeDoErroRpc, classifyError, errorText, type ErrorClass } from "../../dist/call-shape.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
worker/src/index.ts:13
import trava from "../../surface.lock.json";
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
worker/src/index.ts:30
const ICON_PNG = Uint8Array.from(atob(ICON_PNG_BASE64), (c) => c.charCodeAt(0));
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/server, @sbissoli/mcp-provenance, @sbissoli/mcp-search, @sbissoli/mcp-stats, @sbissoli/mcp-upstream, @modelcontextprotocol/client, @sbissoli/mcp-evals, @sbissoli/mcp-surface
Why it matters. 13 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
worker/package.json
agents, @cloudflare/workers-types, typescript, vite, vitest, wrangler
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:120
("OAuth client could send credentials to an authorization server chosen by the
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOInventory / provenance · inv.oversize · CWE-1104
mcp-publisher.exe
mcp-publisher.exe
Why it matters. 18684416 bytes not read
INFOPrompt injection · prompt.fetch_and_trust · CWE-94, CWE-1427
README.md:104
Visit [bcb-br-mcp on Smithery](https://smithery.ai/servers/sidneybissoli/bcb-br-mcp) and follow the installation instructions for your MCP client.
Why it matters. remote text is to be obeyed as instructions

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha 6fa91688d15afull audit observations/trust-audit/mcp-server/sidneybissoli__bcb-br-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-106fa91688d15aSAFEB89first audit
06

Questions

What is the bcb-br-mcp MCP server?

MCP server for Brazil Central Bank (BCB) data — Selic, IPCA, exchange rates, GDP for AI agents

What tools does bcb-br-mcp expose?

8 in total: 8 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is bcb-br-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does bcb-br-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does bcb-br-mcp run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as bcb-br-mcp-worker at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (6fa91688d15a), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement