Fetch and follow the instructions at https://qamcp.dev/setup.md to test my MCP server.Your AI finds your server in your project, tests it with QAmcp, explains what's wrong in plain words, fixes it with your OK, and tests again. Read the instructions
Directory / editalmd
editalmd
by editalmd.com · https://editalmd.com/mcp
Read tender requirements with page evidence. Free search and examples; paid processed documents.
13 of 13 checks · 10 Nov 2026
At a glance
- Runs where
- On their server. What you send to it goes to them.
- What you need
- Nothing: it answered without a login
- Tools
- 71 tools
- Its own safety labels
- 43 read-only, 7 labeled as deleting or destroying, 21 labeled as changing things
- Memory it takes
- About 18,000 tokens of your AI's memory, just for its tool descriptions
- Largest answer
- About 401.1 KB in our test
- Tools that look alike
- 5 pairs of tools with nearly the same description, so the AI may pick the wrong one
- Speed
- Average answer in our test: 343 ms
Tokens are an estimate: the characters in its tool names, descriptions and inputs, divided by 4. The exact number depends on your AI model. Safety labels are what the server says about itself. From our latest test, 10 Nov 2026.
Is editalmd MCP server safe?
- None of the hidden-instruction wordings we know were found in its 71 tool descriptions.
- Its error messages showed no secrets or internal details.
- 37 of its 60 tools are labeled read-only; the others may change or send things.
- Overall it scored 77/100 on 10 Nov 2026.
A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.
What this test does not check
- Its source code and packages.
- What a tool quietly does behind the scenes, such as writing a file or calling another service.
- Instructions hidden inside live tool answers. We only look for those in tool descriptions.
- Hidden instructions worded in a way our list doesn't know yet.
- Tools that could change something. Those are read, never run.
What QAmcp can and can't see · How to tell if an MCP server is safe · Hidden instructions · Prompt injection
Known security advisories
Not looked up yet. QAmcp tests how a server behaves. It does not scan source code.
What it can do
60 tools, in the server's own words.
evaluation_quotaread-onlyIndividual allowance: one premium and 100 basic documents, with an expiry date.
evaluation_premiumUses your only sponsored premium on a document of up to 50 pages.
evaluation_basicBasic native or OCR text of a PDF of up to 50 pages / 32 MiB, without review or structured tables.
evaluation_basic_resultread-onlyFollows the basic reading after retry_after_s and returns the text per page with the hash of the source.
company_documentsread-onlyLists the private PDFs of the company.
attach_company_documentSends a PDF proof of the company.
remove_company_documentRemoves a proof from your own company; the analyses that used it become out of date.
analyze_participationStarts or resumes the analysis with the company record, the attachments and the tender.
get_participationread-onlyReads the state, the pending items and the met items, with reasons, actions and evidence.
list_my_companiesread-onlyThe companies are the account organizations with EditalMD; use the session or the organization key.
search_companiesread-onlySearches the company registry by CNPJ or company name; requires an account or a guest.
add_companyImports the CNPJ into a new organization or into the organization of the organization key.
select_companySelects a registered company; it does not run an analysis.
remove_companyRemoves the company from the list (owner or admin); the organization and the PDFs stay, and adding the CNPJ again brings it back.
awarded_pricesread-onlyThe price that wins for a similar item, as a free summary: how many prices, the median and the range (p25/p75) of the same catalog product in the same unit, wi…
framework_agreementsread-onlyThe valid framework agreements (`ata de registro de preços`) on PNCP for the object, most relevant first: the managing agency, the validity, whether the agreem…
procurement_plansread-onlyWhat agencies plan to procure (annual procurement plans, PCA, on PNCP), before the tender opens: item, agency, quantity, estimated value and desired date.
tenders_outside_pncpread-onlyTenders that agencies report to the state audit court, or publish on their own portal, and that are not on PNCP (today the TCE-RS LicitaCon, the TCE-PE and TCE…
my_accountread-onlyThe identity and the private counters of the account session (cookie) sent in the MCP request.
my_documentsread-onlyThe private collection of the account.
my_procurementsread-onlyThe private collection of the account.
documento_vincularLinks your anonymous purchase to the authenticated account, without a new charge.
documento_acessoread-onlyChecks the link and allows exporting the code of a purchase that is still anonymous.
account_trackingread-onlyChecks that the Salvas, Alertas and Vigias belong to the account of the session.
and 36 more
Test results
Safe mode: only tools labeled read-only were run. How the test works
- !Ready for the newest MCP versionnote
1 warning
- !Uses an older MCP version (2025-06-18). It works today, but it isn't on the July 2026 version (2026-07-28) yet.
- !Every tool is describednote
5 warnings
- !my_documents and my_procurements have nearly the same description (100% of their words are shared; the descriptions are identical), so an AI may not know which to pick
- !evaluation_premium and evaluation_basic_result have nearly the same description (75% of their words are shared; the only difference: "uses", "only", "sponsored" vs "reading", "after", "retry"), so an AI may not know which to pick
- !save_procurement and remove_saved have nearly the same description (74% of their words are shared; the only difference: "save", "200" vs "remove", "personal", "list"), so an AI may not know which to pick
- !evaluation_basic and evaluation_basic_result have nearly the same description (70% of their words are shared; the only difference: "native", "ocr", "pdf" vs "follow", "reading", "after"), so an AI may not know which to pick
- !evaluation_premium and evaluation_basic have nearly the same description (66% of their words are shared; the only difference: "uses", "only", "sponsored" vs "native", "ocr", "text"), so an AI may not know which to pick
- !Tools are labeled safe or dangerousnote
1 warning
- !open_tenders_in_field: Labeled read-only, but its name starts with "open" and its description says "creates". Worth double-checking the label, since AI apps trust it.
- !Tools work with good inputsnote
1 warning
- –evaluation_quota: Needs you to sign in, so it was not tested (not counted against the server)
- –evaluation_basic_result: Needs you to sign in, so it was not tested (not counted against the server)
- –company_documents: Needs you to sign in, so it was not tested (not counted against the server)
- –get_participation: Needs you to sign in, so it was not tested (not counted against the server)
- –list_my_companies: Needs you to sign in, so it was not tested (not counted against the server)
- –search_companies: Needs you to sign in, so it was not tested (not counted against the server)
- –my_account: Needs you to sign in, so it was not tested (not counted against the server)
- –my_documents: Needs you to sign in, so it was not tested (not counted against the server)
- and 32 more
- !Bad inputs give a clean errornote
7 warnings
- –evaluation_quota: Needs you to sign in, so bad inputs were not tested
- –evaluation_basic_result: Needs you to sign in, so bad inputs were not tested
- –company_documents: Needs you to sign in, so bad inputs were not tested
- –get_participation: Needs you to sign in, so bad inputs were not tested
- –search_companies: Needs you to sign in, so bad inputs were not tested
- !awarded_prices: Accepted wrong type for "q" without complaining
- !framework_agreements: Accepted wrong type for "q" without complaining
- !procurement_plans: Accepted wrong type for "q" without complaining
- and 32 more
- !Follows MCP best practices (not scored yet)note
2 tips (not scored)
- !The tool list is about 79 KB (roughly 20k tokens). AI apps send it with every message, so it takes that much of the AI's memory before any work starts.
- !23 tools answer with structured data but don't declare its shape (outputSchema): awarded_prices, framework_agreements, procurement_plans, tenders_outside_pncp, documento_acesso, original_status and 17 more. If those answers change shape, no
- ✓ConnectsConnected in 775 mspass
- ✓Lists its toolsFound 71 toolspass
- ✓No known hidden instructionsNone of the hidden-instruction wordings we know were found in tool descriptions. New wordings can get past this check.pass
- ✓Tools work togetherpass
4 chains working
- ✓get_document → original_status: original_status found what get_document returned (id = "1")
- ✓get_document → get_deadlines: get_deadlines found what get_document returned (id = "1")
- ✓get_document → get_procurement: get_procurement found what get_document returned (id = "1")
- ✓get_document → who_supplies: who_supplies found what get_document returned (id = "1")
- ✓Stopped looking for more chains after the limit on tool calls
- ✓Fast enoughpass
All good
- ✓Connecting took 775 ms
- ✓Listing tools took 293 ms
- ✓Average tool answer: 343 ms
- ✓awarded_prices: Slowest tool: awarded_prices (1.3 s)
- ✓No secrets leakedChecked 85 error messages: no secrets or internal detailspass
- ✓Resources and prompts workOpened 5 of 5 promptspass
Test it yourself
Free and open source. Same checks, same score.
npx qamcp-cli https://editalmd.com/mcpShow this score on GitHub
Free for every server in the directory. Paste this into your README: the badge shows the score from our latest test.
[](https://qamcp.dev/s/com-editalmd-editalmd.html)Score over time
- 10 Nov 202677
One test so far. New tests will show here.
Reviews
Coming soon: reviews from people who use editalmd, signed in with GitHub, one per person. Reviews never change the score.
QAmcp Monitor tests it every hour and emails you when it goes down, the score drops, a tool changes or a secret leaks. Free for 1 server, no card.
Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works