Back to Browse

Nfe Br MCP Server

Developer ToolsModerate5.7MCP RegistryLocal
Free

Server data from the Official MCP Registry

MCP server for Brazilian e-invoicing: NF-e and NFC-e (modelo 55/65), schema 4.00, SEFAZ.

About

MCP server for Brazilian e-invoicing: NF-e and NFC-e (modelo 55/65), schema 4.00, SEFAZ.

Security Report

5.7
Moderate5.7Moderate Risk

mcp-nfe-br is a well-structured Brazil-specific e-invoicing MCP server with proper dependency management and appropriate authentication/authorization patterns. The server implements read-only safe-mode controls, uses environment variables for sensitive configuration, and demonstrates careful API design. Minor code quality observations (broad exception handling in some areas, limited input validation hardening on edge cases) are present but do not indicate security vulnerabilities. Permissions (network_http, env_vars, file_read) are appropriate for the stated purpose of generating, validating, and submitting Brazilian fiscal documents to SEFAZ. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

3 files analyzed ยท 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

What You'll Need

Set these up before or after installing:

Master switch. Set to '1' to disable all write-side tools across NF-e, NFC-e, NFS-e, AND CT-e (br__submit_nfe, br__distribute_dfe, br__submit_nfse, br__cancel_nfse, br__submit_cte, br__cancel_cte, br__correct_cte). Read-only mode for safe exploration. Setting only this variable is sufficient to disable all CT-e writes too โ€” BR_CTE_READ_ONLY is an additional, independent gate, not a required second step.Optional

Environment variable: BR_READ_ONLY

Set to '1' to disable the three CT-e write-side tools (br__submit_cte, br__cancel_cte, br__correct_cte). Independent of BR_READ_ONLY โ€” either variable being set to '1' is sufficient to block CT-e writes; use this one to gate CT-e alone while leaving NF-e/NFS-e writes enabled.Optional

Environment variable: BR_CTE_READ_ONLY

Logging level: DEBUG, INFO (default), WARNING, or ERROROptional

Environment variable: LOG_LEVEL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cmendezs-mcp-nfe-br": {
      "env": {
        "LOG_LEVEL": "your-log-level-here",
        "BR_READ_ONLY": "your-br-read-only-here",
        "BR_CTE_READ_ONLY": "your-br-cte-read-only-here"
      },
      "args": [
        "mcp-nfe-br"
      ],
      "command": "uvx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

mcp-nfe-br ๐Ÿ‡ง๐Ÿ‡ท

English | Portugues (Brasil)

PyPI version Python License


Introduction

mcp-nfe-br is an MCP (Model Context Protocol) server providing tools for issuing and validating Brazilian electronic fiscal documents: NF-e (modelo 55), NFC-e (modelo 65), NFS-e Nacional (ADN), and CT-e (modelo 57). This server is part of the mcp-einvoicing-* / mcp-*-* family, built on mcp-einvoicing-core, which provides the base data model, HTTP/OAuth2 utilities, and shared MCP server infrastructure.

Current status (v0.6.5): NF-e/NFC-e (modelo 55/65, schema 4.00) and NFS-e Nacional (ADN, schema v1.01) generation, ICP-Brasil signing, XSD validation, and gated SEFAZ/ADN submission are implemented. NF-e/NFC-e now also covers the 010e_v.1.02 schema delta (DANFE Simplificado Tipo 2 โ€” tpImp=6, cIndOp, ISUFEmit, and the SEFAZ alert-message response group) on top of the PL_010d base. CT-e (modelo 57) generation/signing/validation and SEFAZ event submission (cancelamento, Carta de Correรงรฃo) were added starting v0.6.0 โ€” v1 scope is intentionally narrow: modal rodoviรกrio only, ICMS CST 00 only, and no bundled/verified CT-e webservice endpoint table (every SEFAZ CT-e call requires an explicit endpoint_override). See the "CT-e (modelo 57)" tools section below and context-library/countries/br.md (in the source repo) for the full field-level reference.

Installation

Requirements

Using uv (recommended)

uv add mcp-nfe-br

Using pip

pip install mcp-nfe-br

From source

git clone https://github.com/cmendezs/mcp-nfe-br.git
cd mcp-nfe-br
uv sync --all-extras

Configuration

This server needs no credentials to run. The environment variables below are optional safety/logging toggles:

Environment variables

VariableDescriptionDefault
BR_READ_ONLYMaster switch. Set to 1 to disable write tools across all sub-formats: NF-e/NFC-e (br__submit_nfe, br__distribute_dfe), NFS-e (br__submit_nfse, br__cancel_nfse), and CT-e (br__submit_cte, br__cancel_cte, br__correct_cte). Safe mode for exploration. The SEFAZ environment (production/homologation) is selected per call via the tp_amb argument.โ€”
BR_CTE_READ_ONLYSet to 1 to disable only the CT-e write tools (br__submit_cte, br__cancel_cte, br__correct_cte), leaving NF-e/NFS-e writes enabled. Independent of BR_READ_ONLY โ€” either variable set to 1 is sufficient to block CT-e writes; you do not need both.โ€”
LOG_LEVELLog level: DEBUG, INFO, WARNING, ERRORINFO

Claude Desktop integration

To use this server with Claude, add this configuration to your claude_desktop_config.json file:

{
  "mcpServers": {
    "nfe-br": {
      "command": "uvx",
      "args": ["mcp-nfe-br"]
    }
  }
}

For a local development install:

{
  "mcpServers": {
    "nfe-br": {
      "command": "uv",
      "args": ["run", "mcp-nfe-br"],
      "cwd": "/path/to/mcp-nfe-br"
    }
  }
}

Cursor integration

Cursor supports MCP servers via stdio. Add the configuration in:

  • Global (all projects): ~/.cursor/mcp.json
  • Project (this repository only): .cursor/mcp.json
{
  "mcpServers": {
    "nfe-br": {
      "command": "uvx",
      "args": ["mcp-nfe-br"]
    }
  }
}

Reload the Cursor window (Ctrl+Shift+P then Reload Window) to apply the changes.

Kiro integration

Kiro supports MCP servers via its dedicated configuration file. Two levels are available:

  • Global (all projects): ~/.kiro/settings/mcp.json
  • Workspace (this repository only): .kiro/settings/mcp.json
{
  "mcpServers": {
    "nfe-br": {
      "command": "uvx",
      "args": ["mcp-nfe-br"],
      "disabled": false,
      "autoApprove": []
    }
  }
}

The file is automatically reloaded on save. You can also open the config via the command palette (Cmd+Shift+P / Ctrl+Shift+P) then MCP.

Available tools

br__validate_cpf

Validates a CPF (Cadastro de Pessoas Fรญsicas), the individual taxpayer identification number, using the Receita Federal modulo 11 algorithm.

ParameterTypeRequiredDescription
cpfstringyesCPF with or without ./- separators

Returns a TaxIdValidationResult with valid=True and the cleaned value (11 digits) on success, or valid=False with an error message in Portuguese.


br__validate_cnpj

Validates a CNPJ (Cadastro Nacional da Pessoa Jurรญdica), the business taxpayer identification number. Accepts both the traditional numeric format (14 digits) and the alphanumeric format introduced by NT 2026.004 (PL_010d), effective in homologation from 2026-06-01 and in production from 2026-07-01.

ParameterTypeRequiredDescription
cnpjstringyesCNPJ with or without .///- separators

Returns a TaxIdValidationResult with valid=True and the cleaned value (14 characters) on success, or valid=False with an error message in Portuguese.

โš ๏ธ [Unverified]: the check-digit algorithm for the alphanumeric CNPJ format was implemented based on secondary sources, as the primary source ("NT Conjunta DFe 2025.001") is not yet available locally. See context-library/countries/br.md for details.


br__generate_nfe

Generates an unsigned NF-e/NFC-e 4.00 document (<NFe><infNFe>โ€ฆ</infNFe></NFe>) from a BRInvoice object.

ParameterTypeRequiredDescription
invoiceobjectyesBRInvoice document (modelo 55 or 65, groups ide/emit/dest/det/total/transp/pag)

Returns {"xml": ..., "chave_acesso": ..., "warnings": [...]}. The warnings in Portuguese remind that the document is not signed (ICP-Brasil) and was not transmitted to SEFAZ. Both steps are the responsibility of a separate process.

Phase 1 coverage for per-item tax groups:

TaxSupported codesBehavior
ICMSCST 00 (normal regime) or CSOSN 102 (Simples Nacional)other codes raise DocumentGenerationError
PIS/COFINSCST 01/02 (rate-based) or 04-09 (non-taxed)group omitted if pis_cst/cofins_cst are None
IPICST 00/49/50/99 (taxed) or other (non-taxed)group omitted if ipi_cst is None

[NEED: IBS/CBS/Imposto Seletivo โ€” Grupo UB/W03 (NT 2025.002-RTC) not yet modeled, see context-library/countries/br.md "Known gaps"].


br__validate_nfe_xml

Validates an NF-e/NFC-e 4.00 XML document against the official PL_010d XSD, patched with the PL_010e_v.1.02 delta (local "unsigned" variant, see note below).

ParameterTypeRequiredDescription
xml_contentstringno*XML as a string
xml_base64stringno*Base64-encoded XML

* Exactly one of xml_content/xml_base64 must be provided.

Returns {"valid": bool, "errors": [...], "metadata": {"schema_version": ...}}.

[Inference]: the official XSD (nfe_v4.00.xsd/leiauteNFe_v4.00.xsd, PL_010d) requires <ds:Signature> as a mandatory child of <NFe>. Since Phase 1 generates unsigned documents, this tool validates against a local derived copy (nfe_v4.00_unsigned.xsd) where <ds:Signature> has been made optional (minOccurs="0"). Validation of signed documents (future phase) should use the official XSD without modifications.


br__build_access_key

Builds an access key (chNFe, 44 characters) with a modulo 11 check digit, from the components cUF, dhEmi, issuer CNPJ, model, series, and document number.

ParameterTypeRequiredDescription
c_ufstringyesIBGE state code (2 digits)
dh_emistringyesIssue date/time (ISO 8601)
cnpjstringyesIssuer CNPJ (numeric or alphanumeric PL_010d)
modelostringyes55 (NF-e) or 65 (NFC-e)
seriestringyesDocument series
nnfstringyesDocument number
tp_emisstringnoIssuance type (default "1")
c_nfstringnoRandom numeric code (cNF, 8 digits); auto-generated if omitted

Returns {"chave_acesso": ..., "cnf": ...}.

CT-e (modelo 57) tools

CT-e (Conhecimento de Transporte Eletrรดnico) coverage started at v0.6.0. v1 scope is intentionally narrow: modal rodoviรกrio only (other modais raise an error), ICMS CST 00 (tributaรงรฃo normal) only, and no bundled/verified SEFAZ CT-e endpoint table โ€” every SEFAZ call below requires an explicit endpoint_override. Since v0.7.0, br__generate_cte also accepts the Reforma Tributรกria do Consumo (IBS/CBS) fields introduced by NT 2026.002 โ€” imp/IBSCBS, emit/ISUFEmit, and ide/tpPagAnt+gPagAntecipado โ€” with the NT's self-contained business rules enforced at the model layer; rules that require a live SEFAZ database lookup are not checked.

br__generate_cte

Generates an unsigned CT-e 4.00 document (<CTe><infCte>โ€ฆ</infCte></CTe>) from a BRCTeDocument object.

ParameterTypeRequiredDescription
cteobjectyesBRCTeDocument (modelo 57, modal rodoviรกrio, ICMS CST 00)

Returns {"xml": ..., "chave_acesso": ..., "warnings": [...]}.

br__validate_cte_xml

Validates a CT-e 4.00 XML document against the bundled PL_CTe_400 XSD (auto-selects the unsigned or official signed schema based on <ds:Signature> presence).

ParameterTypeRequiredDescription
xml_contentstringno*XML as a string
xml_base64stringno*Base64-encoded XML

* Exactly one of xml_content/xml_base64 must be provided.

br__consult_cte_sefaz_status

Checks SEFAZ CT-e webservice availability (CTeStatusServicoV4). Read-only, no confirmation required.

br__consult_cte

Queries a CT-e's status by access key (CTeConsultaV4). Read-only, no confirmation required โ€” it queries one already-known document, not a bulk data pull.

br__submit_cte

Submits a signed CT-e to SEFAZ authorization (CTeRecepcaoSincV4, synchronous). The payload is automatically GZip-compressed and Base64-encoded before transmission, per the CT-e MOC. Gated with a two-step confirmation (ConfirmationGate) and BR_CTE_READ_ONLY.

br__cancel_cte

Requests cancellation of an authorized CT-e (event 110111, CTeRecepcaoEventoV4). cStat=135 indicates the cancellation was homologated. Gated.

br__correct_cte

Issues a Carta de Correรงรฃo Eletrรดnica (event 110110, CTeRecepcaoEventoV4). Per Art. 58-B of CONVรŠNIO/SINIEF 06/89, a CC-e cannot alter tax values, party registration data, or the issue/departure date. Gated.

Not yet implemented: br__distribute_cte_dfe (CTeDistribuicaoDFe) โ€” the bundled specification confirms the request payload shape but not the webservice's method name, WSDL namespace, or message-wrapper element.

Architecture

mcp-nfe-br/
โ”œโ”€โ”€ src/
โ”‚   โ””โ”€โ”€ mcp_nfe_br/
โ”‚       โ”œโ”€โ”€ __init__.py
โ”‚       โ”œโ”€โ”€ server.py              # MCP entry point and tool registration
โ”‚       โ”œโ”€โ”€ models/
โ”‚       โ”‚   โ”œโ”€โ”€ __init__.py
โ”‚       โ”‚   โ””โ”€โ”€ invoice.py         # BRInvoice, BRInvoiceLine, NFeModelo, TipoOperacao
โ”‚       โ”œโ”€โ”€ standards/
โ”‚       โ”‚   โ”œโ”€โ”€ __init__.py
โ”‚       โ”‚   โ””โ”€โ”€ nfe_generator.py   # NFeGenerator โ€” generates unsigned NF-e/NFC-e 4.00
โ”‚       โ”œโ”€โ”€ validators/
โ”‚       โ”‚   โ”œโ”€โ”€ __init__.py
โ”‚       โ”‚   โ””โ”€โ”€ nfe_xsd.py         # NFeXSDValidator โ€” validates against PL_010d XSD (unsigned variant)
โ”‚       โ”œโ”€โ”€ schemas/nfe/           # Bundled XSDs (official + "_unsigned" variants)
โ”‚       โ”œโ”€โ”€ tools/
โ”‚       โ”‚   โ”œโ”€โ”€ __init__.py
โ”‚       โ”‚   โ”œโ”€โ”€ validation.py      # br__validate_cpf, br__validate_cnpj
โ”‚       โ”‚   โ””โ”€โ”€ generation.py      # br__generate_nfe, br__validate_nfe_xml, br__build_access_key
โ”‚       โ””โ”€โ”€ utils/
โ”‚           โ”œโ”€โ”€ __init__.py
โ”‚           โ”œโ”€โ”€ document_ids.py    # validate_cpf, validate_cnpj
โ”‚           โ””โ”€โ”€ access_key.py      # build_access_key, access_key_check_digit
โ”œโ”€โ”€ tests/
โ”‚   โ”œโ”€โ”€ conftest.py
โ”‚   โ”œโ”€โ”€ fixtures/
โ”‚   โ”œโ”€โ”€ test_tools/
โ”‚   โ”‚   โ”œโ”€โ”€ test_validation.py
โ”‚   โ”‚   โ””โ”€โ”€ test_generation.py
โ”‚   โ”œโ”€โ”€ test_standards/
โ”‚   โ”‚   โ””โ”€โ”€ test_nfe_generator.py
โ”‚   โ”œโ”€โ”€ test_validators/
โ”‚   โ”‚   โ””โ”€โ”€ test_nfe_xsd.py
โ”‚   โ””โ”€โ”€ test_utils/
โ”‚       โ””โ”€โ”€ test_access_key.py
โ”œโ”€โ”€ specs/nfe/                     # Normative material (XSDs, MOC, Technical Notes, not published)
โ”œโ”€โ”€ audit/
โ”‚   โ”œโ”€โ”€ audit_vs_core.py
โ”‚   โ””โ”€โ”€ report.json
โ”œโ”€โ”€ .github/workflows/publish.yml
โ”œโ”€โ”€ pyproject.toml
โ”œโ”€โ”€ RELEASE.md
โ””โ”€โ”€ LICENSE

Relationship with mcp-einvoicing-core

mcp-einvoicing-core provides:

  • Base Pydantic models for invoices, parties, line items, and validation results (InvoiceDocument, InvoiceLineItem, TaxIdValidationResult)
  • Shared MCP server infrastructure (EInvoicingMCPServer)
  • HTTP/OAuth2 client, token cache, structured logging, exception hierarchy

mcp-nfe-br adds Brazil-specific logic:

  • BRInvoice (extends InvoiceDocument, as NF-e/NFC-e has no EN 16931 lineage)
  • Group I fields (NCM, CFOP, ICMS/IPI/PIS/COFINS) in BRInvoiceLine
  • CPF/CNPJ validation (including the alphanumeric CNPJ from NT 2026.004)

Contributing

Contributions are welcome. Please open an issue to discuss significant changes before submitting a pull request.

git clone https://github.com/cmendezs/mcp-nfe-br.git
cd mcp-nfe-br
uv sync --all-extras
uv run pytest
uv run ruff check src/mcp_nfe_br tests audit
uv run mypy src/mcp_nfe_br

Other e-invoicing MCP servers

CountryServer
๐ŸŒ Globalmcp-einvoicing-core
๐Ÿ‡ง๐Ÿ‡ช Belgiummcp-einvoicing-be
๐Ÿ‡ง๐Ÿ‡ท Brazilmcp-nfe-br
๐Ÿ‡ซ๐Ÿ‡ท Francemcp-facture-electronique-fr
๐Ÿ‡ฉ๐Ÿ‡ช Germanymcp-einvoicing-de
๐Ÿ‡ฎ๐Ÿ‡น Italymcp-fattura-elettronica-it
๐Ÿ‡ต๐Ÿ‡ฑ Polandmcp-ksef-pl
๐Ÿ‡ธ๐Ÿ‡ฌ Singaporemcp-invoicenow-sg
๐Ÿ‡ช๐Ÿ‡ธ Spainmcp-facturacion-electronica-es
๐Ÿ‡ฆ๐Ÿ‡ช United Arab Emiratesmcp-einvoicing-ae

License

This project is licensed under Apache 2.0. See LICENSE for details. For the full version history, see CHANGELOG.md.

Reviews

No reviews yet

Be the first to review this server!