feat: CVM fundo aberto (cadastro + série de cotas) no MCP público by robertoecf · Pull Request #47 · robertoecf/OpenFinData

robertoecf · 2026-08-29T06:59:55Z

Contexto

O MCP público (https://openfindata.com.br/mcp) só publicava 9 tools macro. O CIO não conseguiu resolver:

AMW Previdência Gestão Ativa FIM — 38.729.027/0001-92
Icatu Vanguarda Absoluto FI Previdenciário RF CP — 21.494.444/0001-09

Hipótese inicial (gap = allowlist do Worker sobre o FastAPI): descartada. O Worker é superfície TypeScript própria; não alcança a Tailscale e não faz proxy do FastAPI. O FastAPI privado já tinha cvm_fund, mas dataset=catalog lia cad_fi.csv, que desde 2024-10 só lista fundos não adaptados à RCVM 175. Os dois CNPJs do CIO não estão nesse CSV.

Cadastro oficial: https://dados.cvm.gov.br/dados/FI/CAD/DADOS/registro_fundo_classe.zip (fundo + classe + subclasse). Série de cotas: INF_DIARIO mensal.

Superfície pública (menor)

Nova tool no Worker: cvm_fund

dataset	entrada	saída
`catalog`	`cnpj` ou `q` (obrigatório)	cadastro RCVM 175 (situação, classe, condomínio, PL, gestor/admin, subclasses)
`daily`	`cnpj` + `year`/`month` (default = mês UTC corrente)	INF_DIARIO: cota, PL, cotistas, captação/resgate

Fora do Worker (de propósito):

CDA / carteira — feed mensal atrasado, ZIP ~150MB descompactado; não é série de cotas
Lâmina, perfil mensal, B3, ANBIMA, registry FTS5, code mode
Mais Retorno (não usado)

Rate limits de /mcp não mudam: 60/60s + burst 20/10s.

FastAPI/CLI (VPS): GET /cvm/funds/cadastro, findata cvm cadastro, findata cvm daily, e matching de CNPJ normalizado no INF_DIARIO.

Caminho até o CIO

openfindata.com.br/mcp não ganha a tool até deploy do Worker:

cd workers/mcp && npx wrangler deploy

Depois:

cvm_fund(dataset="catalog", cnpj="38.729.027/0001-92")
cvm_fund(dataset="daily", cnpj="38729027000192", year=2026, month=8)

Este agente não fez o deploy.

Verificação

Offline: tests/test_cvm_fund_cadastro.py + workers/mcp node:test (12). Preflight af9887f: ruff + mypy + 343 pytest.
Live CVM (2026-08-29), os dois CNPJs do CIO: cadastro RCVM 175 + INF_DIARIO 2026-08 (19 linhas, 2026-08-03 a 2026-08-27).
ZIPs oficiais: cadastro 6,7 MB; INF_DIARIO 10,2 MB (teto Worker 16 MB / 45s). Deflate method 8, flags=0.
Review adversarial CROSS_FAMILY (Claude vs Grok) marcou BLOCK por materializar ~48 MB do CSV no isolate 128 MB. Corrigido em af9887f: scan em stream. Re-parse live: 19 cotas AMW, delta RSS ~52 MB no Node local (inclui os ZIPs no mock).

Relação com #45

Este PR é main + os commits do Worker público (#45, rebase) + CVM. Merge daqui leva Worker + cvm_fund. #45 pode fechar como superseded depois.

MCP Trust

Classificação: MCP_TOOL. Conclusão: PASS. Review no comentário abaixo.

Split the public surface onto a Cloudflare Worker (JSON sources only) and keep FastAPI Tailscale-only. Add an Access-protected Charlie stack with fail-closed origin token, Worker upstream bounds, and Tailscale bind validation. Co-authored-by: Cursor <cursoragent@cursor.com>

Enforce 60 req/60s and 20/10s burst per IP on /mcp via Workers Rate Limit bindings. Overflow is synchronous 429 + Retry-After. Landing and /health stay unlimited.

Cover 429/Retry-After and IP keying with fake Rate Limit bindings. Stop trusting X-Forwarded-For when CF-Connecting-IP is absent.

Resolve fundo aberto by CNPJ against official RCVM 175 registro and return INF_DIARIO quota/PL/cotistas. cad_fi.csv omits adapted funds. CDA carteira stays off the public Worker.

coderabbitai · 2026-08-29T07:00:04Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 15ecea02-552a-44f9-8a56-89c236adf147

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

guardrails · 2026-08-29T07:00:22Z

⚠️ We detected 1 security issue in this pull request:

Vulnerable Libraries (1)

Severity	Details
High	pkg:npm/wrangler@4.122.0 upgrade to: > 4.122.0

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Avoid materializing the ~48MB INF_DIARIO CSV in the 128MB isolate. Also run workers/mcp node:test in CI.

cursor · 2026-08-29T07:14:53Z

MCP Trust Review

Classificação: MCP_TOOL
Base: origin/main
Head: af9887f89cf4424b4dd9a0d641b205d2cf752b3d
Tools tocadas: cvm_fund (Worker: nova; FastAPI: dataset=catalog com cnpj/q passa a ler RCVM 175)
Conclusão: PASS

Achados

NO_FINDINGS no head atual.

Residuais aceitos (não High): teto 16 MB no ZIP comprimido (workers/mcp/src/tools/cvm.ts:8); FastAPI get_fund_daily ainda materializa o CSV mensal no processo da VPS (pré-existente, fora do isolate 128 MB).

Eixos

A Curation: uma tool consolidada (catalog|daily), sem flood 1:1. docs/MCP_SURFACE.md atualizado. Worker exige cnpj ou q em catalog (workers/mcp/src/tools/cvm.ts:206).
B Code mode: sem mudança; findata_run_code continua fora do Worker.
C Credenciais: só dados.cvm.gov.br. Sem keys/tokens. Rate limits 60/60s + 20/10s intactos (workers/mcp/wrangler.toml:18-32).
D Rede/testes: unitários com respx / fetch stub. CI agora roda workers/mcp npm test (.github/workflows/ci.yml:52-64).
E Over-engineering: Python e TS em paralelo porque o Worker não alcança a Tailscale. Sem layer extra.

Over-engineering

NO_FINDINGS. A capacidade nova cabe numa tool já existente no FastAPI; no Worker ela é a 10ª tool, não um catálogo novo.

Adversarial review (CROSS_FAMILY)

Autor: Grok 4.6
Reviewer: Claude Sonnet (Task)
Verdict original no 95c1ee4: BLOCK (F1: inflate de 48 MB no isolate)
Triagem: F1/F2/F3/F4/F5 tratados em af9887f (stream scan, cap de classes 2000, job CI, descrição sem fingir filtro condomínio aberto). F6/F7 Low deixados.
Verdict no head: PASS_WITH_FOLLOW_UPS só se contar F6/F7; para merge do pedido (CNPJ + cota + cadastro CVM) o bloqueio de memória está fechado.

cursor · 2026-08-29T07:16:23Z

guardrails/scan (wrangler@4.122.0): mesmo finding de #45, herdado do Worker. Não é regressão deste incremento CVM.

O aviso pede > 4.122.0. O CVE público de wrangler (CVE-2026-0933, wrangler pages deploy --commit-hash) está patchado em 4.59.1. 4.122.0 já é posterior. Não achei advisory específico contra 4.122.0.

Não vou bump de wrangler neste PR só para silenciar o scanner (CLI de deploy, não runtime do /mcp). Latest no npm hoje: 4.127.1. Se quiser, faço isso num follow-up.

CI do repo no af9887f: test 3.11/3.12/3.13, workers-mcp e build verdes. GitGuardian verde. CodeRabbit skip (repo < 10 stars).

Needle scan of the whole CSV row treated administrator/gestor CNPJs as fund identifiers. Filter to CNPJ_Fundo / CNPJ_Classe after the stream prefilter, same contract as the Python cadastro lookup.

cursor · 2026-08-29T17:22:30Z

Autoreview loop

Pass 1 (GPT, CROSS_FAMILY) no HEAD af9887f: 1 acionável — scanZipCsvForNeedles casava CNPJ de administrador/gestor na mesma linha (59281253000123 → fundos alheios). Corrigido em a56b186: filtro exato em CNPJ_Fundo / CNPJ_Classe / CNPJ_FUNDO_CLASSE, teste negativo no Worker e no Python.

Pass 2 (Claude, CROSS_FAMILY) no HEAD a56b186: ACTIONABLE=0, verdict PASS.

Não reaberto: pin wrangler@4.122.0 (Guardrails, herdado de #45). Sem CDA no Worker. Rate limits intactos.

robertoecf and others added 5 commits August 29, 2026 06:48

feat: add predictable public Worker /mcp rate limits

06ab787

Enforce 60 req/60s and 20/10s burst per IP on /mcp via Workers Rate Limit bindings. Overflow is synchronous 429 + Retry-After. Landing and /health stay unlimited.

test: execute Worker rate-limit helpers in node:test

e4a9975

Cover 429/Retry-After and IP keying with fake Rate Limit bindings. Stop trusting X-Forwarded-For when CF-Connecting-IP is absent.

chore: keep Worker node:test files out of tsc include

9f04fdb

feat: expose CVM open-fund cadastro and cota series on public MCP

95c1ee4

Resolve fundo aberto by CNPJ against official RCVM 175 registro and return INF_DIARIO quota/PL/cotistas. cad_fi.csv omits adapted funds. CDA carteira stays off the public Worker.

fix: stream CVM ZIP CSV scans on the public Worker

af9887f

Avoid materializing the ~48MB INF_DIARIO CSV in the 128MB isolate. Also run workers/mcp node:test in CI.

robertoecf marked this pull request as ready for review August 29, 2026 07:14

fix: match CVM catalog CNPJ only on fundo/classe fields

a56b186

Needle scan of the whole CSV row treated administrator/gestor CNPJs as fund identifiers. Filter to CNPJ_Fundo / CNPJ_Classe after the stream prefilter, same contract as the Python cadastro lookup.

robertoecf merged commit 7076f1b into main Aug 29, 2026
7 of 8 checks passed

robertoecf deleted the cursor/public-mcp-cvm-funds-b87c branch August 29, 2026 17:22

Navigation Menu

feat: CVM fundo aberto (cadastro + série de cotas) no MCP público - #47

feat: CVM fundo aberto (cadastro + série de cotas) no MCP público#47
robertoecf merged 7 commits into
mainfrom
cursor/public-mcp-cvm-funds-b87c

robertoecf commented Aug 29, 2026 •

edited by cursor Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

guardrails Bot commented Aug 29, 2026

Uh oh!

cursor Bot commented Aug 29, 2026

Uh oh!

cursor Bot commented Aug 29, 2026

Uh oh!

cursor Bot commented Aug 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

robertoecf commented Aug 29, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contexto

Superfície pública (menor)

Caminho até o CIO

Verificação

Relação com #45

MCP Trust

Uh oh!

coderabbitai Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

guardrails Bot commented Aug 29, 2026

Uh oh!

cursor Bot commented Aug 29, 2026

MCP Trust Review

Achados

Eixos

Over-engineering

Adversarial review (CROSS_FAMILY)

Uh oh!

cursor Bot commented Aug 29, 2026

Uh oh!

cursor Bot commented Aug 29, 2026

Autoreview loop

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

robertoecf commented Aug 29, 2026 •

edited by cursor Bot

Loading

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading