Caixa Tem MCP

The material states no local keys or environment variables are required, which is a positive sign; however, its purpose is to connect a Caixa Tem/Open Finance account, and the actual authentication/authorization flow is not described. It may involve highly sensitive financial auth tokens or sessions, so authorization scope and revocation should be reviewed.

It is known to access api.mcp.ai. Given the stated features (balances, statements, cards, investments), user financial queries and account-related data will likely transit through this remote endpoint; the material does not clarify whether it also connects to bank-side or other third-party endpoints.

System checks indicate this tool executes code/spawns processes, which is a common MCP capability and therefore warrants caution by default. The available material does not show the exact system capabilities it can invoke, and there is no clear evidence here of excessive privileges beyond its stated function.

From the description, the tool targets balances, statements/transactions, cards, and investments, which are highly sensitive personal financial data. The material does not specify whether it reads/writes local files, nor does it describe data minimization or cache/log retention, so it should be treated as sensitive data access.

Positive factors include the official registry source, an open-source repository that can be audited, and updates within the last year, all of which reduce supply-chain risk. Caution remains because the README is absent, the license is undeclared, and community adoption is very low (0 stars), limiting audit context and external validation.