← Back to directory
M

MCP Fiscal Brasil

Community
MCP server for Brazilian tax: CNPJ, NF-e, SPED, eSocial and the 2026 tax reform (IBS/CBS) — no signup, offline tables.
Category
Other #25 of 230
Stars
★ 324 Very popular
Transport
stdio (local process)
Runtime
Python 3.10+ · Docker
Credentials
Optional API key
License
MIT
Last commit
Tools
25
67FMRS · C

MCP Fiscal Brasil is a focused Brazilian tax (fiscal) vertical MCP server with broad coverage: from CNPJ/CPF validation and Simples/MEI lookups to NF-e parsing, DANFE generation, XMLDSig signature checks, SPED/eSocial analysis, offline tax tables and 2026 reform (IBS/CBS) simulation, across roughly 44 tools plus a CLI, REST API and Python SDK. Its standout trait is that most functionality needs no account or API key, with much of the processing done locally and offline. Features that need live SEFAZ interaction require your own A1 certificate, which is opt-in and never leaves your machine. It suits Brazilian accounting, ERP and finance-automation teams; it is not for non-Brazilian tax scenarios and should not be treated as an official government project. Be mindful of third-party data source stability and the advisory nature of its tax outputs.

Strongest · Setup experience 15/20 Weakest · Reliability 11/20

Reliability
11/20
Security and permissions
14/20
Maintenance
14/20
Documentation
13/20
Setup experience
15/20
Why each score
Reliability 11/20
The manifest and README describe a stdio transport, uvx runtime and 44 tools whose names and descriptions are internally consistent; offline checks (CPF/CNPJ/NF-e validation, SPED parsing) are plausible and reproducible in principle. However, this review only has server.json and the README: no source files, tests or CI workflow definitions are supplied, so the claimed 85% coverage and CI badge are unverifiable self-assertions and do not count as execution evidence. A positive: certificate-dependent tools document their failure semantics (FiscalConfigurationError / HTTP 503) separately from transient SEFAZ outages, indicating controlled, diagnosable errors. Per the static calibration cap of 12 without verifiable tests/CI, I score 11.
Security and permissions 14/20
No red lines triggered: no malware, no credential theft, no covert exfiltration. The A1 certificate and password are user-supplied locally; the README states mTLS and XMLDSig are performed locally, secrets are never sent to external servers, and the password must come from a secrets manager rather than a versioned .env. The unauthenticated certificate-status endpoint returns only validity, not identity. Operations are mostly read-only consultations with no irreversible delete/pay/deploy defaults. Deductions: outbound calls (BrasilAPI, ReceitaWS, SEFAZ) are disclosed only in prose with no visible least-privilege or confirmation implementation; signing/download tools have no described confirmation step; the data-flow disclosure rests on a single untrusted document. Score 14.
Maintenance 14/20
Clear MIT license, consistent versioning between manifest and README (0.5.1), a CHANGELOG, a Roadmap with completed and planned releases, Discussions, a newsletter, and mentions of release automation; 295 stars and 12 open issues suggest activity. Deductions: no source is visible, so commit cadence, issue response, dependency updates and an actual security-response channel cannot be verified; the v1.0.0 maintenance-SLA item remains unfinished. Score 14.
Documentation 13/20
Reasonably layered docs: quick start, per-client config examples (Claude Desktop/Code, Cursor, VS Code+Continue, Docker), an environment-variable table, tools grouped by category (functional/guidance/certificate/experimental) with stated limits (e.g. no public name-based CNPJ search), certificate configuration, and SDK/CLI/REST usage. Deductions: per-tool parameter signatures and return schemas are not documented; cost/rate-limit boundaries are vague; demo transcripts are illustrative, not reviewable evidence; the competitor comparison table is unverifiable marketing copy. Score 13.
Setup experience 15/20
The install path is short and clear: a single `uvx mcp-fiscal-brasil` command, plus uv installation notes and an @latest refresh hint, with config snippets for mainstream clients and a Docker run command, and no API key required. That is a clean, few-step setup that should work in mainstream clients. Deductions: no verifiable in-file execution evidence (no real CI or test files visible), so per the calibration cap setup cannot exceed 15; platform/server-host compatibility nuances are not fully covered. Score 15 (at cap).

Static review · not runListed 2026-09-10

Read the FMRS scoring method →

Fit and risk

What it can accessUses the network

Best for

  • Accounting, ERP, CRM and finance-automation teams serving the Brazilian market.
  • Developers who want local, offline NF-e/SPED processing without uploading XML to third parties.
  • Users of MCP clients such as Claude or Cursor who want to query Brazilian tax data in natural language.
  • Anyone needing offline reference tables such as NCM/CFOP/CST/CEST/ICMS and BCB indexers.

Not for

  • Users needing US or other non-Brazilian tax capabilities.
  • Those expecting official government backing or an official MCP project (this server is maintained by DeHor-Labs, not officially).
  • Anyone wanting SEFAZ real-time status, distribution or manifestation without configuring an A1 certificate.
  • Large-scale CNPJ lookup by company name, which is experimental with limited coverage.

Required permissions

  • Runs locally as an MCP server over stdio; no account or API key required.
  • Network access: calls BrasilAPI (cnpj, nfe, and more) plus an optional ReceitaWS fallback.
  • Optional A1 digital certificate: requires reading a local .pfx/.p12 file and its password for SEFAZ mTLS and XMLDSig signing.
  • Optional environment variables: MCP_FISCAL_LOG_LEVEL, BRASILAPI_BASE_URL, HTTP_TIMEOUT, and NFE_CERTIFICADO_PATH, NFE_CERTIFICADO_SENHA, NFE_EMITENTE_CNPJ, NFE_AMBIENTE.

Risks and side effects

  • Third-party sources (BrasilAPI, ReceitaWS, SEFAZ) can be unstable or change, making results stale or failing.
  • With an A1 certificate enabled, the certificate file and password are sensitive local assets: inject them via a secrets manager as documented and never commit plaintext passwords.
  • Tool outputs and advice (such as risk scores or regime comparisons) are informative and do not replace a professional accountant or legal advice.
  • consultar_status_sefaz raises FiscalConfigurationError when no certificate is configured and the HTTP endpoint returns 503; distinguish this from an actual SEFAZ outage.
  • The experimental listar_cnpjs_por_nome tool has limited coverage and may return unexpected results.

Setup

Before you start

Runtime:Python 3.10+ · Docker

NFE_CERTIFICADO_SENHA optionalsecret Certificate password, should come from a secrets manager rather than a committed .env; optional (secret).
Other optional settings (6)
MCP_FISCAL_LOG_LEVEL optional Log level (DEBUG/INFO/WARNING), defaults to INFO; optional.
BRASILAPI_BASE_URL optional Base URL for BrasilAPI for custom environments, defaults to https://brasilapi.com.br/api; optional.
HTTP_TIMEOUT optional HTTP timeout in seconds, defaults to 30; optional.
NFE_CERTIFICADO_PATH optional Absolute path to a local .pfx/.p12 A1 certificate, only needed for mTLS tools; optional.
NFE_EMITENTE_CNPJ optional 14-digit CNPJ of the certificate holder; optional.
NFE_AMBIENTE optional SEFAZ environment: producao or homologacao, defaults to producao; optional.
  1. Install uv if needed: curl -LsSf https://astral.sh/uv/install.sh | sh.
  2. Easiest run: uvx mcp-fiscal-brasil; to stay current use uvx mcp-fiscal-brasil@latest or uvx --refresh mcp-fiscal-brasil (uvx caches versions).
  3. Configure a client, e.g. Claude Desktop: edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows) with {"mcpServers":{"fiscal-brasil":{"command":"uvx","args":["mcp-fiscal-brasil"]}}} and restart.
  4. For Claude Code: claude mcp add fiscal-brasil -- uvx mcp-fiscal-brasil.
  5. For Cursor write .cursor/mcp.json or a project-root .mcp.json; for VS Code + Continue add a continue.mcpServers entry in settings.json.
  6. Alternatively use Docker (ghcr.io/dehor-labs/mcp-fiscal-brasil:latest, interactive -i) or pip install mcp-fiscal-brasil. All environment variables (MCP_FISCAL_LOG_LEVEL, BRASILAPI_BASE_URL, HTTP_TIMEOUT) are optional.
claude_desktop_config.json
{
  "mcpServers": {
    "fiscal-brasil": {
      "command": "uvx",
      "args": ["mcp-fiscal-brasil"]
    }
  }
}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "fiscal-brasil": {
      "command": "uvx",
      "args": [
        "mcp-fiscal-brasil"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add fiscal-brasil -- uvx mcp-fiscal-brasil

Run it in a terminal; replace any <…> placeholders with your own values first.

Check that it works

After restarting the client, the fiscal-brasil tools (e.g. consultar_cnpj, validate_nfe_full) should appear in the tool list; asking "Consulte o CNPJ 00.000.000/0001-91" and getting real company data (e.g. Banco do Brasil S.A.) confirms the connection.

Troubleshooting

  1. Tools missing in the client: confirm you restarted the MCP client and that the JSON config path and syntax are correct.
  2. Running an old version: uvx caches, so use uvx mcp-fiscal-brasil@latest or uvx --refresh mcp-fiscal-brasil.
  3. uvx not found: install uv first (curl -LsSf https://astral.sh/uv/install.sh | sh), or use pip install mcp-fiscal-brasil and set the command to mcp-fiscal-brasil.
  4. SEFAZ status query throws a configuration error or HTTP 503: no NFE_CERTIFICADO_PATH/NFE_CERTIFICADO_SENHA is set or the certificate is invalid; configure it and retry.
  5. Network-based lookups fail: check connectivity to BrasilAPI, the HTTP_TIMEOUT value, and optionally point BRASILAPI_BASE_URL at a custom environment.
  6. Deeper logs: set MCP_FISCAL_LOG_LEVEL to DEBUG.

Things to try

Once connected, you can ask your AI assistant things like:

  • Look up CNPJ 00.000.000/0001-91 and list its partners
  • Is the NFe key 35240300623904000197550010000012341234567890 valid?
  • Is company 12.345.678/0001-90 opted into Simples Nacional?
  • Run a full validation on this NFe XML and list any issues

Tools 25

analyze_cnpj_compliance read-only
Produce a consolidated tax-compliance report for one CNPJ (CNPJ + Simples/MEI + CNAE).
risk_score_supplier read-only
Score a supplier 0-100 with risk level, contributing factors and a hiring recommendation.
consultar_empresas_lote read-only
Query many CNPJs in one call, returning compliance data and a score per company plus per-item errors.
compare_tax_regimes read-only
Compare MEI, Simples Nacional, Lucro Presumido and Lucro Real regimes for a given scenario.
validate_nfe_full read-only
Validate a whole NF-e from its XML (XML, access key, issuer) and return structured issues.
summarize_sped read-only
Turn a SPED file into an executive summary: period, company, blocks and inconsistencies.
consultar_cnpj read-only
Look up full CNPJ data: legal name, partners, CNAE, address (via BrasilAPI).
consultar_simples_nacional read-only
Check whether a company opts into Simples Nacional/MEI, with opt-in and opt-out dates (via BrasilAPI).
Show 17 more tools
validar_chave_nfe read-only
Offline check of a 44-digit NF-e access key checksum, extracting UF, CNPJ, date and number.
consultar_nfe read-only
Query a full NF-e by its 44-digit access key (via BrasilAPI).
parse_nfe_xml read-only
Parse raw NF-e/NFC-e XML offline and return structured data.
gerar_danfe read-only
Generate an A4 DANFE PDF offline from NF-e (model 55) XML.
validar_assinatura_nfe read-only
Validate the XMLDSig signature offline and extract certificate data.
consultar_status_sefaz read-only
Check real-time SEFAZ web service status per state via NfeStatusServico4 (requires A1 certificate).
baixar_nfe_distribuicao read-only
Download documents via NFeDistribuicaoDFe (requires a local A1 certificate).
manifestar_nfe writes
Submit recipient manifestation events for NF-e via NFeRecepcaoEvento (requires an A1 certificate).
validar_cpf read-only
Offline CPF check-digit validation.
analisar_sped read-only
Analyze an EFD/ECD/ECF file offline: period, company, errors.
listar_registros_sped read-only
Filter SPED records by type (such as C100, E110).
listar_eventos_esocial read-only
eSocial event catalog, filterable by group.
validar_evento_esocial read-only
Basic structural validation of eSocial event XML.
consultar_nfse read-only
Return the municipal NFS-e portal URL and the system in use (requires manual action on the portal).
consultar_certidao_federal read-only
Return the e-CAC URL for issuing the federal CND.
consultar_certidao_fgts read-only
Return the Caixa portal URL for checking the CRF.
listar_cnpjs_por_nome read-only
Experimental: search CNPJ by name; the Brazilian Federal Revenue does not expose a public name-search API, so coverage is limited.

Use cases

Supplier due diligence and batch screening with risk_score_supplier and consultar_empresas_lote.
CNPJ compliance checks via analyze_cnpj_compliance, combining company, Simples/MEI and CNAE data.
NF-e handling: parse XML offline, generate DANFE, validate XMLDSig signatures and access keys.
Offline analysis and structural validation of SPED and eSocial files.
Tax regime comparison with compare_tax_regimes across MEI, Simples, Lucro Presumido and Lucro Real.
Calling fiscal capabilities from application code via the Python SDK or the mcp-fiscal CLI.

Supported clients

Claude Desktop
Claude Code
Cursor
VS Code + Continue

Listed from the project's documentation, not tested by this site.

Overview

MCP Fiscal Brasil is a Brazilian tax (fiscal) vertical MCP server (Python, MIT license, run via uvx from the PyPI package mcp-fiscal-brasil, stdio transport, roughly 44 tools). It exposes CNPJ, CPF, Simples Nacional/MEI, NF-e, NFS-e, SPED, eSocial and tax-certificate lookups as composable tools for MCP clients such as Claude Desktop, Claude Code, Cursor and VS Code + Continue. Most tools work with no API key: CNPJ and Simples Nacional data come from BrasilAPI, while NF-e parsing, DANFE generation, XMLDSig signature validation, SPED/eSocial analysis and offline reference tables (NCM/CFOP/CST/CEST) run locally. A few tools (consultar_status_sefaz, baixar_nfe_distribuicao, manifestar_nfe) optionally require a local A1 digital certificate (.pfx/.p12) for SEFAZ mTLS traffic. Some tools only return government portal URLs or carry explicit limitations (for example, search CNPJ by name). Note: the server is maintained by DeHor-Labs and is not an official MCP or government project.

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 659 · Tools 11 Compare with this →

Source revision dcd89e7db1c7 Data synced 2026-10-19 Read the FMRS scoring method