# CMD+RVL Receipts (remote · receipts.cmdrvl.com)

Check claims against current public CMBS filings and NPORT-P coupons, with citations.

- Trust score: 69/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `receipts.cmdrvl.com`: 69/100 (this document), [markdown](https://verifymcp.io/servers/com-cmdrvl-receipts/receipts.md), [page](https://verifymcp.io/servers/com-cmdrvl-receipts/receipts)

## Channel facts

- Endpoint: `https://receipts.cmdrvl.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 74/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 62/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2359 tokens (~196/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability check failed: schema churn in the 3 days we've observed: 2 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the CMD+RVL Receipts MCP server?

CMD+RVL Receipts is a hosted endpoint at https://receipts.cmdrvl.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-cmdrvl-receipts 'https://receipts.cmdrvl.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-cmdrvl-receipts": {
      "url": "https://receipts.cmdrvl.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-cmdrvl-receipts": {
      "type": "http",
      "url": "https://receipts.cmdrvl.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-cmdrvl-receipts]
url = "https://receipts.cmdrvl.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-cmdrvl-receipts": {
      "type": "remote",
      "url": "https://receipts.cmdrvl.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-cmdrvl-receipts --url 'https://receipts.cmdrvl.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-cmdrvl-receipts:
    url: "https://receipts.cmdrvl.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-cmdrvl-receipts": {
      "Transport": "http",
      "Url": "https://receipts.cmdrvl.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-cmdrvl-receipts -t streamable-http -u 'https://receipts.cmdrvl.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-cmdrvl-receipts": {
      "type": "http",
      "url": "https://receipts.cmdrvl.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 69, 0)

- [security regression] Stability: 0.03 → fail
- [security regression] A breaking change shipped without a version bump: still 0.1.0
- [security regression] Tool “verify_ending_balance” was removed
- [security regression] Tool “verify_servicer” was removed
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “coverage” rewrote its description, which is the text the model reads
- [security] Tool “covered_deals” rewrote its description, which is the text the model reads
- [security] Tool “find_deals” rewrote its description, which is the text the model reads
- [security] Tool “quickstart” rewrote its description, which is the text the model reads
- [security] Tool “verify_appraised_value” rewrote its description, which is the text the model reads
- [security] Tool “verify_building_size” rewrote its description, which is the text the model reads
- [security] Tool “verify_claims” rewrote its description, which is the text the model reads
- [security] Tool “verify_counterparty” rewrote its description, which is the text the model reads
- [security] Tool “verify_deal_field” rewrote its description, which is the text the model reads
- [security] Tool “verify_loan_field” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 176 → 196
- [functional improvement] Tool coverage: 95% → 100%

### 2026-11-03 (score 69, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “coverage” rewrote its description, which is the text the model reads
- [security] Tool “covered_deals” rewrote its description, which is the text the model reads
- [security] Tool “find_deals” rewrote its description, which is the text the model reads
- [security] Tool “verify_appraised_value” rewrote its description, which is the text the model reads
- [security] Tool “verify_building_size” rewrote its description, which is the text the model reads
- [security] Tool “verify_claims” rewrote its description, which is the text the model reads
- [security] Tool “verify_counterparty” rewrote its description, which is the text the model reads
- [security] Tool “verify_deal_field” rewrote its description, which is the text the model reads
- [security] Tool “verify_ending_balance” rewrote its description, which is the text the model reads
- [security] Tool “verify_fund_holding_coupon” rewrote its description, which is the text the model reads
- [security] Tool “verify_loan_field” rewrote its description, which is the text the model reads
- [security] Tool “verify_loan_status_counts” rewrote its description, which is the text the model reads
- [functional improvement] Schema quality: 310 → 176
- [functional improvement] Stability: unverified → 0.03
- [cosmetic] “verify_deal_field” reworded the description of “field”
- [cosmetic] “verify_loan_field” reworded the description of “field”

### 2026-11-02 (score 68)

First indexed and scored.

## MCP tools (12)

### `quickstart` (~74 tokens)

Quickstart capability manifest

Compact capability manifest for clients: purpose, workflow, routing table, examples, vocabulary guard, scope caveats, next actions, and contact. A short, low-token summary of what this server does and what it returns.

Input parameters:

- `detail` (string): Default summary. Use routing for tool selection guidance, examples for more call examples.

Output parameters:

- `caveats` (array)
- `compact` (boolean)
- `contact` (string)
- `current_scope` (string)
- `examples` (array): Worked calls: task plus {tool, arguments}.
- `next_actions` (array)
- `purpose` (string)
- `schemas` (object): sf-receipt v0: profile, version, schema_uri, context_uri, human_docs.
- `server` (string)
- `tools` (array): Routing table: name, when_to_use, required_args, returns.
- `vocabulary` (array): term, meaning.
- `workflow` (array)

### `coverage` (~96 tokens)

Coverage — what this server can and cannot verify

What this server covers: deals and loans against the universe, the field inventory with full bound definitions, counterparty roles, current-only scope, and dual-sourced agreement stats (single-source reported separately). An OUT_OF_COVERAGE answer means the deal or field is outside this coverage; UNVERIFIED means it is covered but could not be confirmed. Contact cairn@cmdrvl.com for deeper coverage, history, bonds, entitlements.

Output parameters:

- `bonds`
- `confirmation_breakdown`
- `confirmation_breakdown_note` (string|null)
- `confirmation_statistics`
- `contact`
- `counterparty_roles` (array)
- `coverage_source` (string)
- `deals` (object): covered, named, fully_confirmed_ever, edgar_cmbs_universe.
- `fields` (array): Per field: field, grain, receipts, field_definition (the full bound definition).
- `generated_at` (string|null)
- `limits`
- `loans` (object)
- `securities`
- `temporal`

### `find_deals` (~122 tokens)

Find covered deals

Search covered deals by id, trust name, CIK, alias, shelf, vintage or deal_ref. An EXACT query returns one dominant result. A fuzzy query returns a small ranked set with match reasons, periods and a suggested next call. Returns at most the requested number of matches.

Input parameters:

- `limit` (integer): Maximum ranked candidates to return (default 5; 10 on the builtin fallback; max 25).
- `query` (string, required): Deal name, ticker-style id, CIK, alias, shelf/vintage fragment, or deal_ref to search.

Output parameters:

- `count` (number)
- `limit` (number)
- `matches` (array): Deal id, cik, name, shelf, vintage, aliases, score.
- `message` (string)
- `next_actions` (array)
- `query` (string)
- `search_backend`
- `total_matches` (number)
- `truncated` (boolean)

### `covered_deals` (~38 tokens)

Covered deals

List every deal this server can verify, with CIKs, aliases and filing periods. Returns the full covered set, which can be long.

Output parameters:

- `count` (number)
- `deals` (array)
- `field` (string)

### `verify_loan_field` (~349 tokens)

Verify a loan-grain field

Verify one loan-grain field of a CMBS loan against the SEC 10-D and ABS-EE filings. Values are TRUST-LEVEL (this trust's piece, not the whole loan). Always the CURRENT period; the receipt stamps its as-of. Pass claimed_value: you get CONFIRM / DENY / CONFLICT / UNVERIFIED plus an sf-receipt. No claim: UNVERIFIED. An unknown deal, loan or field: OUT_OF_COVERAGE.

Input parameters:

- `claimed_value` (number|string): Claim to receipt (number, or date string for paid_through_date). Required: no claim = refusal, no value.
- `deal` (string, required): Deal name or alias, e.g. 'WFCM 2020-C58' or 'Wells Fargo 2020-C58'.
- `field` (string, required): The loan-grain field to verify. One of (full definitions: coverage, or the receipt's field_definition): • beginning_balance — trust-level SCHEDULED balance at period start • ending_balance — trust-le…
- `loan_id` (string, required): Loan / entity id within the deal, e.g. '25'.

Output parameters:

- `as_of` (string|null)
- `claim` (object): Adjudication: claimed_value, tolerance_*, within_tolerance, rationale.
- `claim_verdict` (string): Caller-claim verdict; DENY only here.
- `message` (string)
- `receipt` (object): sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json
- `resolved_deal` (object): Deal resolution: matched, id, cik, candidates.

### `verify_deal_field` (~259 tokens)

Verify a deal-grain (pool) field

Verify one pool-level field of a deal: the ABS-EE loan-tape rollup against the 10-D trustee's reported fact. These are COLLATERAL (loan-pool) balances and flows, NOT bond or certificate balances, and SCHEDULED and ACTUAL are different fields. No loan_id. Always the CURRENT period. Pass claimed_value; no claim: UNVERIFIED; an unknown deal or field: OUT_OF_COVERAGE.

Input parameters:

- `claimed_value` (number|string): Claim to receipt. Required: no claim = refusal, no value.
- `deal` (string, required): Deal name or alias, e.g. 'WFCM 2020-C58'.
- `field` (string, required): The deal-grain (pool) field to verify. One of (full definitions: coverage, or the receipt's field_definition): • beginning_scheduled_collateral_balance — pool SCHEDULED collateral balance at period s…

Output parameters:

- `as_of` (string|null)
- `claim` (object): Adjudication: claimed_value, tolerance_*, within_tolerance, rationale.
- `claim_verdict` (string): Caller-claim verdict; DENY only here.
- `message` (string)
- `receipt` (object): sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json
- `resolved_deal` (object): Deal resolution: matched, id, cik, candidates.

### `verify_fund_holding_coupon` (~221 tokens)

Verify NPORT cross-filer fund-holding coupon

Verify the NPORT cross-filer annualized coupon rate (annualized_rate) for one security identifier. Security-grain, N-source receipt: citations are peer NPORT-P filings by registrant CIK, dissenters included. CURRENT-ONLY (latest NPORT period exported). Ticker matches are not unique: set require_hard_identifier=true when a claim needs ISIN, CUSIP or other hard identity.

Input parameters:

- `as_of` (string): Optional NPORT period guard (YYYY-MM). The public corpus is latest-period-per-security, not historical.
- `claimed_value` (number|string): Claim to receipt. Required: no claim = refusal, no value.
- `identifier` (string, required): Security identifier to look up: ISIN, CUSIP, other identifier, or ticker.
- `require_hard_identifier` (boolean): When true, exclude ticker-sourced matches because tickers are not unique hard identifiers.
- `security_id_source` (string): Optional source filter. Default any. Use ticker only for ticker-sourced matches.

Output parameters:

- `as_of` (string|null)
- `claim` (object)
- `claim_verdict` (string): Caller-claim verdict; DENY only here.
- `message` (string)
- `receipt` (object): sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json
- `resolved_security` (object): Security resolution: matched, security_id, hard_identifier, candidates.

### `verify_building_size` (~138 tokens)

Verify issuance building size

Verify issuance building size (Annex A vs ABS-EE). Units matter: mismatched units return receipt status UNITS_INCOMMENSURATE, not CONFLICT/DENY. A deal or loan outside coverage returns OUT_OF_COVERAGE.

Input parameters:

- `claimed_unit` (string): Optional unit, e.g. square_feet or units.
- `claimed_value` (number|string): Claim to receipt. Required.
- `deal` (string, required): Deal name or alias, e.g. 'WFCM 2020-C58'.
- `loan_id` (string, required): Loan / entity id within the deal, e.g. '25'.

Output parameters:

- `as_of` (string|null)
- `claim` (object): Adjudication: claimed_value, tolerance_*, within_tolerance, rationale.
- `claim_verdict` (string): Caller-claim verdict; DENY only here.
- `message` (string)
- `receipt` (object): sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json
- `resolved_deal` (object): Deal resolution: matched, id, cik, candidates.

### `verify_appraised_value` (~146 tokens)

Verify issuance appraised value

Verify issuance appraised value (Annex A vs ABS-EE). Date/basis mismatches return DATE_INCOMMENSURATE or BASIS_INCOMMENSURATE, not CONFLICT/DENY. A deal or loan outside coverage returns OUT_OF_COVERAGE.

Input parameters:

- `claimed_basis` (string): Optional valuation basis.
- `claimed_value` (number|string): Claim to receipt. Required.
- `claimed_value_date` (string): Optional valuation date.
- `deal` (string, required): Deal name or alias, e.g. 'WFCM 2020-C58'.
- `loan_id` (string, required): Loan / entity id within the deal, e.g. '25'.

Output parameters:

- `as_of` (string|null)
- `claim` (object): Adjudication: claimed_value, tolerance_*, within_tolerance, rationale.
- `claim_verdict` (string): Caller-claim verdict; DENY only here.
- `message` (string)
- `receipt` (object): sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json
- `resolved_deal` (object): Deal resolution: matched, id, cik, candidates.

### `verify_counterparty` (~169 tokens)

Verify a deal counterparty (roster)

Adjudicate 'who is the <role> on deal X' against the SEC 10-D counterparty roster (today: master and special servicer). A SINGLE-SOURCE roster fact. Master is the roster party, NOT the ABS-EE tape's primary servicer. Pass claimed_name: CONFIRM/DENY under the ledger's name normalization, never fuzzy. Says WHO the party is, not that a loan is in special servicing. Unknown deal or role: OUT_OF_COVERAGE.

Input parameters:

- `claimed_name` (string): Name to adjudicate (normalized comparison).
- `deal` (string, required): Deal name or alias, e.g. 'WFCM 2020-C58'.
- `role` (string): Default special_servicer. Full definitions ride each receipt's field_definition.

Output parameters:

- `as_of` (string|null)
- `claim` (object): Adjudication: claimed_value, tolerance_*, within_tolerance, rationale.
- `claim_verdict` (string): Caller-claim verdict; DENY only here.
- `message` (string)
- `receipt` (object): sf-receipt 0.3; schema https://cmdrvl.com/schemas/sf-receipt/v0/schema.json; context https://cmdrvl.com/contexts/obs-receipt/v0/context.json
- `resolved_deal` (object): Deal resolution: matched, id, cik, candidates.

### `verify_loan_status_counts` (~214 tokens)

Verify a deal's loan-status counts (derived)

Verify count claims over loan status ('N in special servicing / paid off / defeased') for a deal. Counts are DERIVED from the ABS-EE tape, not reported by any filing. Three grains, never mixed: activity (active, resolved_paid_off, defeased); servicing: in_special_servicing = loans CURRENTLY with the special servicer (the count for 'N in special servicing'; it OVERLAPS active, never sum); resolution reason (resolved_via_special_servicing and other payoff reasons) = loans that already LEFT the pool, NOT current counts. Pass `claimed` for exact per-status adjudication. Uncovered deal: UNVERIFIED.

Input parameters:

- `claimed` (object): Optional claimed per-status counts, e.g. {"in_special_servicing": 10, "defeased": 2}. Each is adjudicated by EXACT match against the derived count.
- `deal` (string, required): Deal name or alias, e.g. 'WFCM 2020-C58'.

Output parameters:

- `as_of` (string|null)
- `claim_verdict` (string)
- `message` (string)
- `resolved_deal` (object)
- `statuses` (array): Per status: status, grain, count, claimed, claim_verdict, receipt.

### `verify_claims` (~247 tokens)

Verify every checkable claim in a text (bulk)

Bulk verifier: paste text, get per-claim statuses. ASSERTIONS ONLY: a QUESTION ('is it $9.4M?') binds nothing and returns total 0; single-value questions are not claims and are not checked here. Deterministic grammar, four families: loan fields, pool fields, servicer identity, loan-status counts. Unparsed text is listed in unchecked_spans, never dropped. EXACT deal references (id, alias, CIK) work best; matching is never fuzzy. Statuses (verified / contradicted / insufficient_evidence / out_of_scope) are answers, not errors. Each claim has a claim_id, citations and a confidence.

Input parameters:

- `deal_hint` (string): Fallback deal context when a sentence names no deal (exact resolution only).
- `period_hint` (string): YYYY-MM annotation only — latest-only server; a mismatch is noted and drops confidence one tier.
- `risk_tolerance` (string): Default normal = max(ledger tolerance, stated precision); strict = ledger only; lenient = 2x stated precision. Counts and names are always exact.
- `text` (string, required): The paragraph / memo excerpt to check.

Output parameters:

- `claims` (array): Per claim: normalized_claim, citations, notes, recommended_language.
- `material_issues` (array)
- `search_backend`
- `summary` (object): Counts: total, verified, contradicted, insufficient_evidence, out_of_scope.
- `tool_version` (string)
- `unchecked_spans` (array): Text no grammar rule could check, with reason and hint.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-cmdrvl-receipts/receipts#diagnostics

## Score history

- 2026-11-05: 69
- 2026-11-04: 69
- 2026-11-03: 69
- 2026-11-02: 68

## Common questions

### What is the CMD+RVL Receipts MCP server?

CMD+RVL Receipts is an MCP server listed in the public MCP registry as com.cmdrvl/receipts. Check claims against current public CMBS filings and NPORT-P coupons, with citations. This page covers its hosted endpoint (https://receipts.cmdrvl.com/mcp).

### Is the CMD+RVL Receipts MCP server safe to use?

CMD+RVL Receipts scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the CMD+RVL Receipts MCP server expose?

CMD+RVL Receipts exposes 12 tools: quickstart, coverage, find_deals, covered_deals, verify_loan_field, and 7 more. Their descriptions and schemas cost roughly 2,073 tokens of context every time the server is loaded.

### Does the CMD+RVL Receipts MCP server require authentication?

No. We connected to CMD+RVL Receipts without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the CMD+RVL Receipts MCP server still maintained?

CMD+RVL Receipts is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://receipts.cmdrvl.com/mcp
- Repository: https://github.com/cmdrvl/mcp-servers
- Website: https://cmdrvl.com/portfolio/receipts-mcp/
- Changelog RSS feed: https://verifymcp.io/servers/com-cmdrvl-receipts/receipts.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-cmdrvl-receipts/receipts.json
- HTML version of this page: https://verifymcp.io/servers/com-cmdrvl-receipts/receipts