Back to Browse

Brdata MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Brazilian company, risk & public-tender data (CNPJ, CEIS/CNEP, PNCP) as x402-paid agent tools

About

Brazilian company, risk & public-tender data (CNPJ, CEIS/CNEP, PNCP) as x402-paid agent tools

Security Report

4.2
Use Caution4.2High Risk

brdata-mcp is a well-structured MCP server for Brazilian company and procurement data with proper authentication via x402 micropayments. The code handles private keys securely (from environment variables only, never logged or sent elsewhere except for signing). However, there are moderate concerns around error handling that could leak sensitive information, overly broad exception catching, and the inherent risk model of holding cryptocurrency private keys in an MCP process that may be accessed by untrusted code. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

4 files analyzed · 11 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

crypto_key_storage

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

0x private key of a DEDICATED wallet holding USDC on Base (pays per call). Paid tools return 402 without it; the free validate_cnpj tool still works.Required

Environment variable: EVM_PRIVATE_KEY

base58 or JSON-array secret key of a DEDICATED Solana wallet holding USDC (pays per call). Configure this and/or EVM_PRIVATE_KEY; the x402 layer settles on whichever rail the 402 advertises.Required

Environment variable: SOLANA_PRIVATE_KEY

Optional Solana RPC override used to build the payment (e.g. a Helius URL).Optional

Environment variable: SOLANA_RPC_URL

Base URL of a brdata Worker. Defaults to the hosted production API (https://brdata.thomenz.me).Optional

Environment variable: BRDATA_BASE_URL

'base' (mainnet, default) or 'base-sepolia' (testnet).Optional

Environment variable: X402_NETWORK

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-thomenz-brdata-mcp": {
      "env": {
        "X402_NETWORK": "your-x402-network-here",
        "SOLANA_RPC_URL": "your-solana-rpc-url-here",
        "BRDATA_BASE_URL": "your-brdata-base-url-here",
        "EVM_PRIVATE_KEY": "your-evm-private-key-here",
        "SOLANA_PRIVATE_KEY": "your-solana-private-key-here"
      },
      "args": [
        "-y",
        "brdata-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

brdata-mcp

An MCP (Model Context Protocol) server for Brazilian company & public-procurement data, for agent harnesses (Claude Code, Claude Desktop, …). It covers: CNPJ company registry lookup (basic + full due-diligence), company search/discovery across ~28M active companies by filters (CNAE activity, state/city, size, MEI, name), public tenders / licitações via PNCP (decode Compras.gov.br IDs, resolve, header, line items, edital documents, keyword search), NF-e & boleto decoding, CEP lookup, and batch document validation — for KYB, due diligence, and B2G (public-sector) sales intelligence.

Paid tools automatically settle the underlying x402-protected HTTP endpoints in USDC on Base or Solana using a wallet you configure; a call is charged only on success. Configure a Base wallet (EVM_PRIVATE_KEY), a Solana wallet (SOLANA_PRIVATE_KEY), or both — the x402 layer settles on whichever rail the server's 402 challenge advertises.

Tools

ToolEndpointPriceDescription
lookup_companyGET /company/{cnpj}$0.005Consolidated registry profile
lookup_company_fullGET /company/{cnpj}/full$0.03+ partners (QSA) + sanctions
screen_company_riskGET /risk/company/{cnpj}$0.015Regulatory risk & compliance screen across 5 federal registries: debarment (CEIS), anti-corruption (CNEP), impeded non-profits (CEPIM), leniency & forced-labor register ("Lista Suja", MTE) → verdict + 0–100 score + per-source data_as_of
decode_nfe_keyGET /nfe/{key}$0.005NF-e/NFC-e 44-digit access-key decoder
decode_boletoPOST /boleto/decode$0.005Boleto digitable-line decoder
validate_documentsPOST /validate/batch$0.001Batch validate CPF/CNPJ/PIS/plate/Pix (≤100)
lookup_cepGET /cep/{cep}$0.002Enriched postal-code lookup
search_companiesPOST /companies/search$0.015/pageSearch & segment active companies by CNAE/location/size/age/name
decode_tender_idGET /tender/decode/{id}$0.005Offline decode of a Compras.gov.br 17-digit tender id
resolve_tenderPOST /tender/resolve$0.02Resolve any tender reference (id/URL/control number) to PNCP + summary
get_tenderGET /tender/{cnpj}/{year}/{seq}$0.01Full tender header (PNCP)
get_tender_itemsGET /tender/{cnpj}/{year}/{seq}/items$0.03All tender items + ME/EPP-exclusive flags
get_tender_documentsGET /tender/{cnpj}/{year}/{seq}/documents$0.01Tender document URIs (no PDF download)
search_tendersPOST /tender/search$0.05Search public tenders (PNCP) by keyword
validate_cnpjGET /validate/{cnpj}freeSingle CNPJ check-digit validation

search_companies requires the Worker to have the Phase 2 database configured (Hyperdrive); otherwise it returns a 503 (and no payment is charged). MEI contact data is redacted (LGPD).

Configuration

Environment variables:

VarRequiredDefaultMeaning
BRDATA_BASE_URLnohttps://brdata.thomenz.meBase URL of a brdata Worker (defaults to the hosted production API)
EVM_PRIVATE_KEYfor paid tools (Base)0x-prefixed key of the paying Base wallet (holds USDC)
SOLANA_PRIVATE_KEYfor paid tools (Solana)base58 or JSON-array secret key of the paying Solana wallet (holds USDC). Configure this and/or EVM_PRIVATE_KEY
SOLANA_RPC_URLnopublic RPCOptional Solana RPC override used to build the payment (e.g. a Helius URL)
X402_NETWORKnobasebase (mainnet, matches the default URL) or base-sepolia (testnet → Solana devnet)

⚠️ Security

EVM_PRIVATE_KEY controls real funds. Anything that can read this process' environment (or the MCP config file) can spend from that wallet.

  • Use a dedicated wallet with a small balance, funded only with what you're willing to auto-spend. Never a personal or treasury key.
  • On testnet (base-sepolia) use test USDC only.
  • The key is read from the environment; it is never sent anywhere except to sign x402 payment authorizations for BRDATA_BASE_URL.

Use with Claude Code / Claude Desktop

Add to your mcpServers configuration:

{
  "mcpServers": {
    "brdata": {
      "command": "npx",
      "args": ["-y", "brdata-mcp"],
      "env": {
        "EVM_PRIVATE_KEY": "0x<dedicated-wallet-key-with-USDC>"
      }
    }
  }
}

For local development against wrangler dev, point BRDATA_BASE_URL at http://localhost:8787 and use X402_NETWORK=base-sepolia with a testnet wallet.

If you run from source instead of npm, use:

{
  "mcpServers": {
    "brdata": {
      "command": "node",
      "args": ["/absolute/path/to/packages/brdata-mcp/dist/index.js"],
      "env": { "BRDATA_BASE_URL": "http://localhost:8787", "EVM_PRIVATE_KEY": "0x...", "X402_NETWORK": "base-sepolia" }
    }
  }
}

Example

"Use brdata to run full due diligence on CNPJ 00.000.000/0001-91."

The agent calls lookup_company_full, which pays $0.03 in USDC and returns the consolidated English profile with partners and sanction checks.

Build & publish

pnpm install
pnpm run build        # emits dist/
pnpm run typecheck
# publish (see checklist in the main repo README before doing this):
npm publish --access public

License

MIT

Reviews

No reviews yet

Be the first to review this server!

Brdata MCP Server - Brazilian company, risk & public-tender data (CNPJ, | MCP Marketplace