app-mcp-server
Verified Safeby prefeitura-rio
Overview
This server acts as a backend for a conversational AI assistant for the Rio de Janeiro municipality, providing a suite of specialized tools and data access, including city information, real-time data, calculations, multi-step workflows, web search, and alert management.
Installation
uv run src/main.pyEnvironment Variables
- VALID_TOKENS
- IS_LOCAL
- DANGEROUSLY_OMIT_AUTH
- GOOGLE_API_KEY
- GOOGLE_BIGQUERY_KEY
- GOOGLE_BIGQUERY_PROJECT_ID
- GOOGLE_BIGQUERY_PAGE_SIZE
- GOOGLE_MAPS_API_KEY
- NOMINATIM_API_URL
- DHARMA_API_KEY
- CHATBOT_INTEGRATIONS_URL
- CHATBOT_INTEGRATIONS_KEY
- CHATBOT_PGM_API_URL
- CHATBOT_PGM_ACCESS_KEY
- RMI_API_URL
- RMI_OAUTH_CLIENT_ID
- RMI_OAUTH_CLIENT_SECRET
- RMI_OAUTH_TOKEN_URL
- TYPESENSE_HUB_SEARCH_URL
- SURKAI_API_KEY
- REDIS_URL
- EQUIPMENTS_VALID_THEMES
- ENVIRONMENT
- ERROR_INTERCEPTOR_URL
- BUCKET_NAME
- IPTU_API_PRIVATE_KEY_ID
- IPTU_API_PRIVATE_KEY_BASE64
- IPTU_API_PUBLIC_KEY_BASE64
Security Notes
The server implements token-based authentication via `CheckTokenMiddleware` and loads secrets from environment variables, which are good practices. However, the example `.env` provides `VALID_TOKENS="token"`, which is a very weak default and insecure for production. Critically, the `pgm_api` function disables SSL certificate verification (`"verify": False`) for requests to the PGM API, which creates a significant Man-in-the-Middle attack vulnerability if the network path is not fully trusted. While `ast.literal_eval` is used, its application in parsing expected LLM-generated structures mitigates but does not eliminate all risks.
Similar Servers
fastmcp
FastMCP is an ergonomic interface for the Model Context Protocol (MCP), providing a comprehensive framework for building and interacting with AI agents, tools, resources, and prompts across various transports and authentication methods.
gis-mcp
A Model Context Protocol (MCP) server that provides AI agents and LLMs with comprehensive GIS capabilities, enabling geospatial analysis, data gathering, and transformations through natural language.
openstudio-mcp-server
Enables AI assistants like Claude to interact with OpenStudio building energy models through a comprehensive set of natural language accessible tools for loading, inspecting, and manipulating models.
dokku-mcp
Exposes Dokku's management capabilities through the Model Context Protocol (MCP), enabling Large Language Models (LLMs) to interact with and manage a Dokku instance.