EQI MCP

The materials state that no local environment variables or API keys are required, which reduces static secret exposure. However, the stated function is to connect an EQI account via Brazil's Open Finance, so real use likely relies on user account authorization/session tokens tied to sensitive financial access and should be handled carefully.

It is known to connect to the remote endpoint api.mcp.ai. Based on the feature description, financial data such as balances, statements, cards, and investments may be transmitted through this service. No unrelated or unknown egress endpoint is shown, but remote transmission of such data still warrants caution.

The system checks indicate this tool has executes-code capability, meaning it runs as a local MCP process and executes code. The provided materials do not show requests for system privileges beyond its stated function, and there are no clear signs of malicious execution, so this is caution rather than risk.

Per the description, the tool’s primary data surface is EQI/Open Finance account information, including balances, statements, cards, and investments, all of which are highly sensitive financial data. The materials do not indicate local file read/write behavior or obvious overbroad access, but account access should still be granted only on a least-privilege basis.

Positive signals include an official registry source, an auditable open-source repository, and updates within the last year, all of which materially lower supply-chain risk. However, community adoption is very low (0 stars), the license is not declared, and README information is absent, limiting audit visibility; therefore caution is appropriate.