FalaAI API (MCP)
REMOTE · MCP-FALAAI.ACTION.TEC.BR
FalaAI API MCP server: transcribe audio, diagnose conversations, audit compliance (ISO 18295-1).
Available components
Last scanned (10 hours ago)
Scores higher than 53% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Health and Science
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability53
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2499 tokens (~499/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management57
- Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
- Tool “extract_whatsapp” rewrote its description, which is the text the model reads security
- Tool “transcribe_audio” rewrote its description, which is the text the model reads security
- 26 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 24 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://mcp-falaai.action.tec.br/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=action.tec.br | CN=WE1,O=Google Trust Services,C=US | 21 Sept 2026 | 20 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | b54711ee6bf66e9d0ef44981f902ad82 |
| SANs: action.tec.br, *.action.tec.br | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp-falaai.action.tec.br. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| br. | present | 38298 | 13 | Verified |
| tec.br. | present | 50930 | 13 | Verified |
| action.tec.br. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp-falaai.action.tec.br/mcp | Verified | 200 | |
| http (plaintext) | http://mcp-falaai.action.tec.br/mcp | HTTPS enforced | 301 | https://mcp-falaai.action.tec.br/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
diagnostic ~494
Analyzes a call transcript and returns six structured blocks: dialogue summary, contact reason, identified action, theme label, predominant sentiment and identified participants with roles, names, confidence and evidence; use it for a fast, generic diagnosis of what happened in a call, and use /v1/analyze/riskAudit instead when the goal is compliance violation auditing. Provide at least one of dialog (primary source: diarized transcript in the format 'Speaker 1: [00:00:00.540 - 00:00:01.139] text', speaker labels accepted in any case as Speaker, Interlocutor, Hablante, Locutor or Orador plus number) or text (plain transcript fallback), each up to 300,000 characters; when dialog is used duration_seconds is required by the schema and, when provided, must be >= the last turn end time. Required: language; optional: model (always 'falaai-diagnostic-1'), audio_events, response_language (language of the results, defaulting to language), participants (up to 10 with interlocutor and optional name and role agent/client/bot, ground truth when the role is informed and otherwise inferred), call_direction (inferred when omitted), client_reference_id (echoed verbatim, charset [A-Za-z0-9 _/:.-], max 60). Returns id, object 'analysis', response_language, analysis with the six blocks, usage (characters, credits_consumed, processing_ms) and html_report (base64 gzip) only when dialog is provided; with text-only input the participant roles are forced to confidence 'low'. This call consumes credits and the amount actually charged is returned in usage.credits_consumed. Stateless: neither the transcript nor the analysis is persisted (only billing and usage metadata is logged), protecting personal data under LGPD. IMPORTANT: this call charges credits and the result is NOT stored — you MUST read the FULL response and relay ALL of its information to the user (all six blocks, usage and html_report; no omissions, no shortening), and persist it if the user may need it later; calling again charg…
| Name | Type | Req | Description |
|---|---|---|---|
| audio_events | – | – | – |
| call_direction | – | – | – |
| client_reference_id | – | – | – |
| dialog | – | – | – |
| duration_seconds | – | – | – |
| language | string | yes | – |
| participants | – | – | – |
| response_language | – | – | – |
| text | – | – | – |
No output schema declared.
No examples provided.
extract_whatsapp ~688
Extracts and segments the conversations of a WhatsApp export (.zip or .txt containing chat.txt in UTF-8 with at least one turn) and, unless it is a preview, resolves each selected conversation with AI by transcribing voice/audio/video notes and describing visual expressions, returning the segmented conversations with speakers, dialogs, counts and usage. Provide the export as file_base64 (base64 of the .zip/.txt bytes) plus optional filename. Use dry_run=true for a PREVIEW: it validates the file, segments the conversations, counts media and ESTIMATES the credits WITHOUT calling the AI and WITHOUT charging (credits_charged=0), returning object whatsapp_preview with credits_total, the params actually used, the windows, per-conversation items and warnings. The window is given either as a single start/end pair or as windows, a JSON string holding a non-empty list of sub-objects each with start and end; windows must not be combined with start/end, and a windows selection is the deduplicated chronological union of the overlaps, which bypasses the noise filter and keeps conversations that are monologues or below min_messages, while for a single window sending only one of start/end is rejected and empty/all-zeros values select the real period of the export, both being allowed to be omitted in dry_run while outside dry_run both absent is rejected. timezone and date_format are required, where date_format must be day_first, month_first or year_first. gap_minutes is optional (default 720) and splits conversations on idle gaps, min_messages is optional (default 2) and is the minimum messages kept per conversation outside the explicit windows selection, voice_note is optional (default true) and turns voice/audio/video media into text, expression is optional (default true) and describes visual expressions (figurinha, GIF, emoji), and client_reference_id is optional, echoed verbatim, charset A-Za-z0-9 space _/:.- up to 60 chars. Outside the preview, this call consumes credits and t…
| Name | Type | Req | Description |
|---|---|---|---|
| client_reference_id | – | – | – |
| date_format | string | yes | – |
| dry_run | boolean | – | – |
| end | – | – | – |
| expression | – | – | – |
| file_base64 | string | yes | – |
| filename | string | – | – |
| gap_minutes | – | – | – |
| min_messages | – | – | – |
| start | – | – | – |
| timezone | string | yes | – |
| voice_note | – | – | – |
| windows | – | – | – |
No output schema declared.
No examples provided.
health ~82
Checks the connection to the FalaAI API and returns its health and version (status, version, uptime, database, phase, launch date). Use it FIRST to confirm the MCP is working before any billable call. This tool is FREE: it does not consume credits, does not require the API key (the health endpoint is public), performs no analysis and stores nothing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
risk_audit ~523
Runs a compliance risk audit on a diarized call transcript, detecting violations and positives, applying the ISO 31000 risk matrix, classifying the conversation into a level and returning the verdict with the applied actions and the NIST/OWASP risk framework enquadramento; use it for compliance and quality audits of company-agent-to-client calls, not for generic conversation summarization. Required fields: dialog (diarized transcript in the format 'Speaker 1: [00:00:00.540 - 00:00:01.139] text', speaker labels accepted in any case as Speaker, Interlocutor, Hablante, Locutor or Orador plus number; plain text is not accepted; max 300,000 characters), duration_seconds (total audio duration in seconds, must be >= the last turn end time) and language plus response_language (only pt-BR, en-US or es-ES). Optional: model (always 'falaai-risk-audit-1'), audio_events (up to 500, each requiring event and start_s), participants (up to 10 with interlocutor and role agent/client/bot, ground truth when provided, else inferred), call_direction (inbound/outbound, inferred when omitted), response_format (only 'v2'), client_reference_id (echoed verbatim, charset [A-Za-z0-9 _/:.-], max 60). Returns response (V2) with meta+usage, participants, verdict with level and applied actions, scores, detections (violations, positives, client alerts), analysis frameworks, timeline, categories_summary, executive summary, scoring explanation and an HTML report (gzip+base64). This call consumes credits and the amount actually charged is returned in response.meta.usage.credits_consumed. Stateless: neither the transcript nor the analysis is persisted (only billing and usage metadata is logged), protecting personal data under LGPD. IMPORTANT: this call charges credits and the result is NOT stored — you MUST read the FULL response and relay ALL of its information to the user (every field, including verdict, scores, detections, timeline and html_report; no omissions, no shortening), and persist it if the…
| Name | Type | Req | Description |
|---|---|---|---|
| audio_events | – | – | – |
| call_direction | – | – | – |
| client_reference_id | – | – | – |
| dialog | string | yes | – |
| duration_seconds | number | yes | – |
| language | string | yes | – |
| participants | – | – | – |
| response_format | string | – | – |
| response_language | – | – | – |
No output schema declared.
No examples provided.
transcribe_audio ~531
Transcribes one uploaded audio file into text with speaker diarization and timestamped audio events (laughs, sighs, pauses), returning the full transcript, a turn-by-turn dialog with speaker labels and start/end timestamps, the detected events and the word count. Use it when a recording must become text for analysis, review or storage of the transcript. Provide the audio as file_base64 (base64 of the file bytes) plus optional filename; via MCP the request body is capped at 64 MB, so the file must stay under about 45 MB (larger recordings must go to POST /v1/audio/transcriptions as multipart, limit 1 GB), and the audio duration is limited to 3 hours, with accepted MIME types audio/mpeg, audio/mp3, audio/mp4, audio/m4a, audio/wav, audio/wave, audio/x-wav, audio/flac, audio/x-flac, audio/ogg, audio/opus, video/ogg, audio/webm, video/webm, audio/aac and audio/x-aac. model is optional and defaults to falaai-transcribe-1, the only supported value; language is an optional two-letter code (pt, en, es, fr, de, it, ja, ko, nl, pl, ru, tr, zh, vi, id, th, ar, hi, cs, da, el, fi, he, hu, ms, no, ro, sk, sv, ta, uk) that forces the audio language and is auto-detected when omitted; client_reference_id is optional, charset A-Za-z0-9 space _/:.- up to 60 chars, echoed verbatim (not idempotency). This call consumes credits; usage reports credits_consumed and processing_ms. Stateless: the audio is processed in memory and never persisted (LGPD). Returns id (tr-), language, language_confidence, duration_seconds, text, dialog, audio_events, event_types, word_count and input metadata (duration, format, codec, sample rate, channels). IMPORTANT: this call charges credits and the result is NOT stored — you MUST read the FULL response and relay ALL of its information to the user (including the complete dialog and text, every audio_event with its timestamps, and input metadata; no omissions, no shortening), and persist it if the user may need it later; calling again charges again.
| Name | Type | Req | Description |
|---|---|---|---|
| client_reference_id | – | – | – |
| file_base64 | string | yes | – |
| filename | string | – | – |
| language | – | – | – |
| model | – | – | – |
No output schema declared.
No examples provided.
How do I install the FalaAI API (MCP) server?
FalaAI API (MCP) is a hosted endpoint at https://mcp-falaai.action.tec.br/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp-falaai.action.tec.br
claude mcp add --transport http actiontecbr-falaai-mcp 'https://mcp-falaai.action.tec.br/mcp'
What is the FalaAI API (MCP) server?
FalaAI API (MCP) is listed in the public MCP registry as io.github.ActionTecBr/falaai-mcp. FalaAI API MCP server: transcribe audio, diagnose conversations, audit compliance (ISO 18295-1). This page covers its hosted endpoint (https://mcp-falaai.action.tec.br/mcp).
Is the FalaAI API (MCP) server safe to use?
FalaAI API (MCP) scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the FalaAI API (MCP) server expose?
FalaAI API (MCP) exposes 5 tools: risk_audit, diagnostic, transcribe_audio, extract_whatsapp, health. Their descriptions and schemas cost roughly 2,318 tokens of context every time the server is loaded.
Does the FalaAI API (MCP) server require authentication?
No. We connected to FalaAI API (MCP) without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the FalaAI API (MCP) server still maintained?
FalaAI API (MCP) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.