mcp-brasil-public-apis
Pass
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by ingesting data from 28 external Brazilian public APIs (such as IBGE, Bacen, and Câmara). Although the skill uses Pydantic schemas for data validation as seen in
schemas.py, it does not implement explicit boundary markers or instructions to disregard potential commands embedded within the external data. The skill possesses capabilities to perform network requests and tool execution. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
mcp-brasilpackage from public registries usingpiporuv. It also references its source code repository on GitHub for development purposes. - [COMMAND_EXECUTION]: The server is executed through shell commands such as
uvxandfastmcp. Additionally, the skill includes aMakefilethat facilitates various development actions, including testing, linting, and running the server environment.
Audit Metadata