radar-cnpj-mcp

highTells the agent to hide things from the user

Instructions to keep the user in the dark are a hallmark of malicious skills.

src/data/analytics.ts:394 /** Without a state, a repeated name would silently add up different cities. */

mediumContains invisible characters

Zero-width and other invisible characters can hide words or split them so filters and reviewers miss them.

src/data/repository.ts:251 out.write(`⟦U+FEFF⟧${CSV_COLUMNS.join(';')}\r\n`);

mediumContains invisible characters

Zero-width and other invisible characters can hide words or split them so filters and reviewers miss them.

test/repository.test.ts:270 expect(lines[0]?.startsWith('⟦U+FEFF⟧cnpj;razao_social;')).toBe(true);

mediumPersonal contact data of MEIs returned by default

Search, detail and export return phone numbers and e-mails of sole proprietors (MEIs) unless the agent explicitly asks to hide them. This data is public Receita Federal data and the README discloses the issue and gives LGPD guidance. Still, bulk export of up to 200,000 rows of contacts that may belong to individuals is a privacy risk users should know about. CPFs are actively stripped from free-text fields.

src/domain/filters.ts:85 .default(false)

src/domain/filters.ts:87 'Ocultar telefone e e-mail de MEIs, que costumam ser os da própria pessoa física. Use ao compartilhar os resultados.',

src/mcp/tools.ts:14 const MAX_EXPORT_ROWS = 200_000;