ibge-br-mcpSAFE
MCP Server for IBGE APIs - Brazilian geographic, demographic and statistical data
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/ibge-br-mcp) [](https://www.npmjs.com/package/ibge-br-mcp) [](https://www.npmjs.com/package/ibge-br-mcp) [](https://registry.modelcontextprotocol.io) [](https://lobehub.com/mcp/sidneybissoli-ibge-br-mcp) [](https://smithery.ai/server/sidneybissoli/ibge-br-mcp) [](https://glama.ai/mcp/servers/@SidneyBissoli/ibge-br-mcp) [](https://github.com/SidneyBissoli/ibge-br-mcp/actions/workflows/ci.yml) [](https://github.com/SidneyBissoli/ibge-br-mcp/blob/main/vitest.config.ts) [](https://github.com/SidneyBissoli/ibge-br-mcp) [](https://github.com/sponsors/SidneyBissoli) [](https://opensource.org/licenses/MIT)
Live, exact Brazilian public data for your AI assistant — with provenance, not guesswork.
Ask an LLM "what was Belo Horizonte's population in the 2022 Census?" and you get a plausible number from its training data: maybe right, maybe outdated, with no source. ibge-br-mcp instead has your assistant query the official IBGE APIs in real time — returning the exact figure together with the table
84791e53320aOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add ibge-br-mcp -- npx -y [email protected]
Exposed tools (21)
21 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ibge_calendario | read | |
ibge_censo | read | |
ibge_cidades | read | |
ibge_cnae | read | |
ibge_comparar | read | |
ibge_datasaude | read | |
ibge_estados | read | |
ibge_geocodigo | read | |
ibge_indicadores | read | |
ibge_localidade | read | |
ibge_malhas | read | |
ibge_malhas_tema | read | |
ibge_municipios | read | |
ibge_nomes | read | |
ibge_noticias | read | |
ibge_paises | read | |
ibge_pesquisas | read | |
ibge_sidra | read | |
ibge_sidra_metadados | read | |
ibge_sidra_tabelas | read | |
ibge_vizinhos | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
"iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAIAAAB7GkOtAAEAAElEQVR42uxdd5wkVbU+59zq7sk7s7vswpKjBEUMYMDsExQDiDmhok8FFQMqJhSfiFkB41NUzCCCAQyYRR6SJClpScsCm+PM7Mx0d91z3h+3wq3Y1Wlmdun6+cMNs11dVbfOOfc73/k+FBHoHb2jd/S
# A raiz vem primeiro: o worker importa ../../dist/server.js e resolve o
import { AREA_BY_TOOL, CATALOG } from "../../evals/catalog.js";import { FIXTURES } from "../../evals/fixtures/queries.js";import { SERVER_VERSION } from "../../dist/server.js";import { classeDoErroRpc, classifyError, errorText, type ErrorClass } from "../../dist/call-shape.js";const ICON_PNG = Uint8Array.from(atob(ICON_PNG_BASE64), (c) => c.charCodeAt(0));
@modelcontextprotocol/server, @sbissoli/mcp-provenance, @sbissoli/mcp-search, @sbissoli/mcp-stats, @sbissoli/mcp-upstream, zod, @eslint/js, @modelcontextprotocol/client
agents, @cloudflare/workers-types, typescript, vite, vitest, wrangler
Gates applied: no_behavioural_pass.
84791e53320afull audit observations/trust-audit/mcp-server/sidneybissoli__ibge-br-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 84791e53320a | SAFE | B | 89 | first audit |
Questions
What is the ibge-br-mcp MCP server?
MCP Server for IBGE APIs - Brazilian geographic, demographic and statistical data
What tools does ibge-br-mcp expose?
21 in total: 21 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ibge-br-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does ibge-br-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does ibge-br-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as ibge-br-mcp-worker at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (84791e53320a), read on 2026-10-10. The repository is watched and re-audited when it changes.