# FalaAI API (MCP) (remote · mcp-falaai.action.tec.br)

FalaAI API MCP server: transcribe audio, diagnose conversations, audit compliance (ISO 18295-1).

- Trust score: 68/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `mcp-falaai.action.tec.br`: 68/100 (this document), [markdown](https://verifymcp.io/servers/actiontecbr-falaai-mcp/mcp-falaai.md), [page](https://verifymcp.io/servers/actiontecbr-falaai-mcp/mcp-falaai)

## Channel facts

- Endpoint: `https://mcp-falaai.action.tec.br/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.21.67`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 5 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 53/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2499 tokens (~499/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 57/100
  - Stability observed for 17 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the FalaAI API (MCP) server?

FalaAI API (MCP) is a hosted endpoint at https://mcp-falaai.action.tec.br/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http actiontecbr-falaai-mcp 'https://mcp-falaai.action.tec.br/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "actiontecbr-falaai-mcp": {
      "url": "https://mcp-falaai.action.tec.br/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "actiontecbr-falaai-mcp": {
      "type": "http",
      "url": "https://mcp-falaai.action.tec.br/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.actiontecbr-falaai-mcp]
url = "https://mcp-falaai.action.tec.br/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "actiontecbr-falaai-mcp": {
      "type": "remote",
      "url": "https://mcp-falaai.action.tec.br/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add actiontecbr-falaai-mcp --url 'https://mcp-falaai.action.tec.br/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  actiontecbr-falaai-mcp:
    url: "https://mcp-falaai.action.tec.br/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "actiontecbr-falaai-mcp": {
      "Transport": "http",
      "Url": "https://mcp-falaai.action.tec.br/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add actiontecbr-falaai-mcp -t streamable-http -u 'https://mcp-falaai.action.tec.br/mcp'
```

### Other

```json
{
  "mcpServers": {
    "actiontecbr-falaai-mcp": {
      "type": "http",
      "url": "https://mcp-falaai.action.tec.br/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 65, +1)

- [security] Tool “extract_whatsapp” rewrote its description, which is the text the model reads
- [security] Tool “transcribe_audio” rewrote its description, which is the text the model reads

### 2026-10-26 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-24 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-22 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-20 (score 61, +1)

- [functional improvement] Stability: unverified → 0.03

## MCP tools (5)

### `risk_audit` (~523 tokens)

Runs a compliance risk audit on a diarized call transcript, detecting violations and positives, applying the ISO 31000 risk matrix, classifying the conversation into a level and returning the verdict with the applied actions and the NIST/OWASP risk framework enquadramento; use it for compliance and quality audits of company-agent-to-client calls, not for generic conversation summarization. Required fields: dialog (diarized transcript in the format 'Speaker 1: [00:00:00.540 - 00:00:01.139] text', speaker labels accepted in any case as Speaker, Interlocutor, Hablante, Locutor or Orador plus number; plain text is not accepted; max 300,000 characters), duration_seconds (total audio duration in seconds, must be >= the last turn end time) and language plus response_language (only pt-BR, en-US or es-ES). Optional: model (always 'falaai-risk-audit-1'), audio_events (up to 500, each requiring event and start_s), participants (up to 10 with interlocutor and role agent/client/bot, ground truth when provided, else inferred), call_direction (inbound/outbound, inferred when omitted), response_format (only 'v2'), client_reference_id (echoed verbatim, charset [A-Za-z0-9 _/:.-], max 60). Returns response (V2) with meta+usage, participants, verdict with level and applied actions, scores, detections (violations, positives, client alerts), analysis frameworks, timeline, categories_summary, executive summary, scoring explanation and an HTML report (gzip+base64). This call consumes credits and the amount actually charged is returned in response.meta.usage.credits_consumed. Stateless: neither the transcript nor the analysis is persisted (only billing and usage metadata is logged), protecting personal data under LGPD. IMPORTANT: this call charges credits and the result is NOT stored — you MUST read the FULL response and relay ALL of its information to the user (every field, including verdict, scores, detections, timeline and html_report; no omissions, no shortening), and persist it if the…

Input parameters:

- `audio_events`
- `call_direction`
- `client_reference_id`
- `dialog` (string, required)
- `duration_seconds` (number, required)
- `language` (string, required)
- `participants`
- `response_format` (string)
- `response_language`

### `diagnostic` (~494 tokens)

Analyzes a call transcript and returns six structured blocks: dialogue summary, contact reason, identified action, theme label, predominant sentiment and identified participants with roles, names, confidence and evidence; use it for a fast, generic diagnosis of what happened in a call, and use /v1/analyze/riskAudit instead when the goal is compliance violation auditing. Provide at least one of dialog (primary source: diarized transcript in the format 'Speaker 1: [00:00:00.540 - 00:00:01.139] text', speaker labels accepted in any case as Speaker, Interlocutor, Hablante, Locutor or Orador plus number) or text (plain transcript fallback), each up to 300,000 characters; when dialog is used duration_seconds is required by the schema and, when provided, must be >= the last turn end time. Required: language; optional: model (always 'falaai-diagnostic-1'), audio_events, response_language (language of the results, defaulting to language), participants (up to 10 with interlocutor and optional name and role agent/client/bot, ground truth when the role is informed and otherwise inferred), call_direction (inferred when omitted), client_reference_id (echoed verbatim, charset [A-Za-z0-9 _/:.-], max 60). Returns id, object 'analysis', response_language, analysis with the six blocks, usage (characters, credits_consumed, processing_ms) and html_report (base64 gzip) only when dialog is provided; with text-only input the participant roles are forced to confidence 'low'. This call consumes credits and the amount actually charged is returned in usage.credits_consumed. Stateless: neither the transcript nor the analysis is persisted (only billing and usage metadata is logged), protecting personal data under LGPD. IMPORTANT: this call charges credits and the result is NOT stored — you MUST read the FULL response and relay ALL of its information to the user (all six blocks, usage and html_report; no omissions, no shortening), and persist it if the user may need it later; calling again charg…

Input parameters:

- `audio_events`
- `call_direction`
- `client_reference_id`
- `dialog`
- `duration_seconds`
- `language` (string, required)
- `participants`
- `response_language`
- `text`

### `transcribe_audio` (~531 tokens)

Transcribes one uploaded audio file into text with speaker diarization and timestamped audio events (laughs, sighs, pauses), returning the full transcript, a turn-by-turn dialog with speaker labels and start/end timestamps, the detected events and the word count. Use it when a recording must become text for analysis, review or storage of the transcript. Provide the audio as file_base64 (base64 of the file bytes) plus optional filename; via MCP the request body is capped at 64 MB, so the file must stay under about 45 MB (larger recordings must go to POST /v1/audio/transcriptions as multipart, limit 1 GB), and the audio duration is limited to 3 hours, with accepted MIME types audio/mpeg, audio/mp3, audio/mp4, audio/m4a, audio/wav, audio/wave, audio/x-wav, audio/flac, audio/x-flac, audio/ogg, audio/opus, video/ogg, audio/webm, video/webm, audio/aac and audio/x-aac. model is optional and defaults to falaai-transcribe-1, the only supported value; language is an optional two-letter code (pt, en, es, fr, de, it, ja, ko, nl, pl, ru, tr, zh, vi, id, th, ar, hi, cs, da, el, fi, he, hu, ms, no, ro, sk, sv, ta, uk) that forces the audio language and is auto-detected when omitted; client_reference_id is optional, charset A-Za-z0-9 space _/:.- up to 60 chars, echoed verbatim (not idempotency). This call consumes credits; usage reports credits_consumed and processing_ms. Stateless: the audio is processed in memory and never persisted (LGPD). Returns id (tr-), language, language_confidence, duration_seconds, text, dialog, audio_events, event_types, word_count and input metadata (duration, format, codec, sample rate, channels). IMPORTANT: this call charges credits and the result is NOT stored — you MUST read the FULL response and relay ALL of its information to the user (including the complete dialog and text, every audio_event with its timestamps, and input metadata; no omissions, no shortening), and persist it if the user may need it later; calling again charges again.

Input parameters:

- `client_reference_id`
- `file_base64` (string, required)
- `filename` (string)
- `language`
- `model`

### `extract_whatsapp` (~688 tokens)

Extracts and segments the conversations of a WhatsApp export (.zip or .txt containing chat.txt in UTF-8 with at least one turn) and, unless it is a preview, resolves each selected conversation with AI by transcribing voice/audio/video notes and describing visual expressions, returning the segmented conversations with speakers, dialogs, counts and usage. Provide the export as file_base64 (base64 of the .zip/.txt bytes) plus optional filename. Use dry_run=true for a PREVIEW: it validates the file, segments the conversations, counts media and ESTIMATES the credits WITHOUT calling the AI and WITHOUT charging (credits_charged=0), returning object whatsapp_preview with credits_total, the params actually used, the windows, per-conversation items and warnings. The window is given either as a single start/end pair or as windows, a JSON string holding a non-empty list of sub-objects each with start and end; windows must not be combined with start/end, and a windows selection is the deduplicated chronological union of the overlaps, which bypasses the noise filter and keeps conversations that are monologues or below min_messages, while for a single window sending only one of start/end is rejected and empty/all-zeros values select the real period of the export, both being allowed to be omitted in dry_run while outside dry_run both absent is rejected. timezone and date_format are required, where date_format must be day_first, month_first or year_first. gap_minutes is optional (default 720) and splits conversations on idle gaps, min_messages is optional (default 2) and is the minimum messages kept per conversation outside the explicit windows selection, voice_note is optional (default true) and turns voice/audio/video media into text, expression is optional (default true) and describes visual expressions (figurinha, GIF, emoji), and client_reference_id is optional, echoed verbatim, charset A-Za-z0-9 space _/:.- up to 60 chars. Outside the preview, this call consumes credits and t…

Input parameters:

- `client_reference_id`
- `date_format` (string, required)
- `dry_run` (boolean)
- `end`
- `expression`
- `file_base64` (string, required)
- `filename` (string)
- `gap_minutes`
- `min_messages`
- `start`
- `timezone` (string, required)
- `voice_note`
- `windows`

### `health` (~82 tokens)

Checks the connection to the FalaAI API and returns its health and version (status, version, uptime, database, phase, launch date). Use it FIRST to confirm the MCP is working before any billable call. This tool is FREE: it does not consume credits, does not require the API key (the health endpoint is public), performs no analysis and stores nothing.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/actiontecbr-falaai-mcp/mcp-falaai#diagnostics

## Score history

- 2026-11-05: 68
- 2026-11-04: 68
- 2026-11-03: 67
- 2026-11-02: 67
- 2026-11-01: 66
- 2026-10-31: 66
- 2026-10-30: 65
- 2026-10-29: 65
- 2026-10-28: 64
- 2026-10-27: 64
- 2026-10-26: 64
- 2026-10-25: 63
- 2026-10-24: 63
- 2026-10-23: 62
- 2026-10-22: 62
- 2026-10-21: 61
- 2026-10-20: 61
- 2026-10-19: 60

## Common questions

### What is the FalaAI API (MCP) server?

FalaAI API (MCP) is listed in the public MCP registry as io.github.ActionTecBr/falaai-mcp. FalaAI API MCP server: transcribe audio, diagnose conversations, audit compliance (ISO 18295-1). This page covers its hosted endpoint (https://mcp-falaai.action.tec.br/mcp).

### Is the FalaAI API (MCP) server safe to use?

FalaAI API (MCP) scores 68 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the FalaAI API (MCP) server expose?

FalaAI API (MCP) exposes 5 tools: risk_audit, diagnostic, transcribe_audio, extract_whatsapp, health. Their descriptions and schemas cost roughly 2,318 tokens of context every time the server is loaded.

### Does the FalaAI API (MCP) server require authentication?

No. We connected to FalaAI API (MCP) without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the FalaAI API (MCP) server still maintained?

FalaAI API (MCP) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the FalaAI API (MCP) server?

VerifyMCP ran 12 checks on FalaAI API (MCP), covering TLS certificate, HTTPS, HSTS header, DNSSEC and 8 more. One item could not be completed, a gap on our side rather than a finding about FalaAI API (MCP): Authorization. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://mcp-falaai.action.tec.br/mcp
- Changelog RSS feed: https://verifymcp.io/servers/actiontecbr-falaai-mcp/mcp-falaai.xml
- Changelog JSON feed: https://verifymcp.io/servers/actiontecbr-falaai-mcp/mcp-falaai/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/actiontecbr-falaai-mcp/mcp-falaai.json
- HTML version of this page: https://verifymcp.io/servers/actiontecbr-falaai-mcp/mcp-falaai