DataX

plus.datax/dataxdatax.plusstreamable-httpv1.0.0Scanned 2 hours ago

Enriquecimento de CPF e CNPJ no Brasil: telefone e e-mail dos sócios, ficha cadastral e reversos.

11 tools: 11 change things.

Reads private data · 0
Reads text others write · 11
Can send data out · 0
No findings

Tools listed without sign-in. Remote posture

Anlyon alternative

11 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

11 tools

Changes things 11Creates or changes something that can be changed back.Claude Code: ask

buscar_pessoa_por_nomeEncontra pessoas pelo nome e devolve os candidatos com CPF, data de nascimento e UF.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Encontra pessoas pelo nome e devolve os candidatos com CPF, data de nascimento e UF. Depois, use ficha_cpf ou contatos_cpf no CPF escolhido. Consome 1 requisição. Todos os planos.
Annotations the server declares
- title: Busca por nome
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
consumo_do_planoExtrato do consumo dos últimos 30 dias, agregado por dia.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Extrato do consumo dos últimos 30 dias, agregado por dia. Não consome requisições.
Annotations the server declares
- title: Consumo do plano
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
contatos_cpfSó os contatos de uma pessoa pelo CPF: telefones (com WhatsApp quando houver) e e-mails, sem o restante da ficha.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Só os contatos de uma pessoa pelo CPF: telefones (com WhatsApp quando houver) e e-mails, sem o restante da ficha. Consome 1 requisição. Todos os planos.
Annotations the server declares
- title: Contatos de um CPF
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
empresas_recentesLista empresas abertas recentemente, com CNPJ, razão social, data de abertura e UF, para prospectar negócios novos.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Lista empresas abertas recentemente, com CNPJ, razão social, data de abertura e UF, para prospectar negócios novos. Consome 1 requisição. Plano Avançado.
Annotations the server declares
- title: Empresas recentes
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
ficha_cnpjDados cadastrais de uma empresa: razão social, nome fantasia, situação na Receita Federal, data de abertura, atividades (CNAE), porte, Simples e MEI, endereço, contatos informados …Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Dados cadastrais de uma empresa: razão social, nome fantasia, situação na Receita Federal, data de abertura, atividades (CNAE), porte, Simples e MEI, endereço, contatos informados no cadastro e quadro societário. Para o telefone e o e-mail de cada sócio, use socios_cnpj. Consome 1 requisição. Planos: teste grátis, Intermediário e Avançado.
Annotations the server declares
- title: Ficha do CNPJ
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
ficha_cpfDados cadastrais de uma pessoa pelo CPF: nome, data de nascimento, situação na Receita Federal, indicação de óbito, telefones, e-mails e endereços.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Dados cadastrais de uma pessoa pelo CPF: nome, data de nascimento, situação na Receita Federal, indicação de óbito, telefones, e-mails e endereços. Consome 1 requisição. Todos os planos.
Annotations the server declares
- title: Ficha do CPF
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
limite_do_planoMostra o plano da chave e quanto já foi usado do limite do dia e do minuto.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Mostra o plano da chave e quanto já foi usado do limite do dia e do minuto. Não consome requisições. Bom primeiro teste para confirmar que a chave funciona.
Annotations the server declares
- title: Limite do plano
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
pessoas_por_enderecoEncontra as pessoas ligadas a um CEP ou a um endereço específico, com nome e CPF.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Encontra as pessoas ligadas a um CEP ou a um endereço específico, com nome e CPF. Informe cep, ou logradouro com cidade e estado; numero e bairro restringem o resultado. Buscas genéricas (só a cidade ou só o estado) são recusadas. Consome 1 requisição. Todos os planos.
Annotations the server declares
- title: Pessoas por endereço
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
reverso_emailDescobre a pessoa dona de um e-mail: nome e CPF.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Descobre a pessoa dona de um e-mail: nome e CPF. Consome 1 requisição. Todos os planos.
Annotations the server declares
- title: Reverso de e-mail
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
reverso_telefoneDescobre o titular de um telefone: nome, CPF, operadora e se o número tem WhatsApp.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Descobre o titular de um telefone: nome, CPF, operadora e se o número tem WhatsApp. Consome 1 requisição. Todos os planos.
Annotations the server declares
- title: Reverso de telefone
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
socios_cnpjRecebe um CNPJ e devolve os sócios pessoa física da empresa com nome, CPF, qualificação, telefones e e-mails (o contato de cada sócio, não o telefone da empresa que aparece no cada…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Recebe um CNPJ e devolve os sócios pessoa física da empresa com nome, CPF, qualificação, telefones e e-mails (o contato de cada sócio, não o telefone da empresa que aparece no cadastro da Receita). Consome 1 requisição do limite diário por sócio retornado (campo unidadesConsumidas) e conta 1 no limite por minuto. Planos: teste grátis, Intermediário e Avançado.
Annotations the server declares
- title: Sócios de um CNPJ
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write11: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; buscar_pessoa_por_nome
consumo_do_plano
contatos_cpf
empresas_recentes
ficha_cnpj
ficha_cpf
limite_do_plano
pessoas_por_endereco
reverso_email
reverso_telefone
socios_cnpj
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Nov 4, 2026, 02:20 UTC, unchanged since Nov 4, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 11
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: not observed
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 11 tools that change things (11 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://mcp.datax.plus/mcp: tools/list returned 11 tools to an anonymous client, including socios_cnpj (write), ficha_cnpj (write), ficha_cpf (write), contatos_cpf (write), buscar_pessoa_por_nome (write) and 6 more
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http datax https://mcp.datax.plus/mcp --header 'api-key: <your-api-key>'

claude mcp add --transport http datax https://mcp.datax.plus/mcp --header 'api-key: <your-api-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__datax__socios_cnpj",
      "mcp__datax__ficha_cnpj",
      "mcp__datax__ficha_cpf",
      "mcp__datax__contatos_cpf",
      "mcp__datax__buscar_pessoa_por_nome",
      "mcp__datax__reverso_telefone",
      "mcp__datax__reverso_email",
      "mcp__datax__pessoas_por_endereco",
      "mcp__datax__empresas_recentes",
      "mcp__datax__limite_do_plano",
      "mcp__datax__consumo_do_plano"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as datax. Review it before you use it.

Capability tags behind 11 rules

mcp__datax__socios_cnpj untrusted-input
mcp__datax__ficha_cnpj untrusted-input
mcp__datax__ficha_cpf untrusted-input
mcp__datax__contatos_cpf untrusted-input
mcp__datax__buscar_pessoa_por_nome untrusted-input
mcp__datax__reverso_telefone untrusted-input
mcp__datax__reverso_email untrusted-input
mcp__datax__pessoas_por_endereco untrusted-input
mcp__datax__empresas_recentes untrusted-input
mcp__datax__limite_do_plano untrusted-input
mcp__datax__consumo_do_plano untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/plus.datax/datax/verify?hash=164e36a005446a0a7b2a994e2ce6701f5e074ec9bb2134e9bd66050be972b1ba" | jq -e '.changed == false'

Pinned hash 164e36a00544, from Nov 4, 2026, 00:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/plus.datax/datax/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/plus.datax/datax.svg)](https://anlyon.dev/servers/plus.datax/datax)

Source: MCP Registry. Synced Nov 4, 2026, 00:18 UTC.