# com.synder/gl-importer-mcp (npm · @cloudbusiness/gl-importer-mcp)

Import CSV/XLSX accounting data into QuickBooks Online or Xero via the Synder Importer API.

- Trust score: 81/100 (high trust)
- Change this week: +35
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@cloudbusiness/gl-importer-mcp`: 81/100 (this document), [markdown](https://verifymcp.io/servers/com-synder-gl-importer-mcp/cloudbusiness-gl-importer-mcp.md), [page](https://verifymcp.io/servers/com-synder-gl-importer-mcp/cloudbusiness-gl-importer-mcp)

## Channel facts

- Registry: `npm`
- Package: `@cloudbusiness/gl-importer-mcp`
- Version: `0.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to SynderAccounting/gl-importer-plugin).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 43 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1855 tokens (~97/item across 19 items; 19 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add com-synder-gl-importer-mcp -- npx -y @cloudbusiness/gl-importer-mcp
```

### Codex

```bash
codex mcp add com-synder-gl-importer-mcp -- npx -y @cloudbusiness/gl-importer-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-synder-gl-importer-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@cloudbusiness/gl-importer-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-synder-gl-importer-mcp --command npx --arg -y --arg @cloudbusiness/gl-importer-mcp
```

### Hermes

```yaml
mcp_servers:
  com-synder-gl-importer-mcp:
    command: "npx"
    args: ["-y", "@cloudbusiness/gl-importer-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "com-synder-gl-importer-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@cloudbusiness/gl-importer-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 80, +60)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] The attested source repository moved: SynderAccounting/gl-importer-plugin
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 20, −30)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 50, +25)

- [security regression] Malware scan: pass → unverified
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security] The attested source repository moved: SynderAccounting/gl-importer-plugin
- [functional regression] Security disclosure: unverified → fail
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-07-29 (score 25, −21)

- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (19)

### `account_get` (~43 tokens)

Returns the current Synder Importer account: email, name, status, subscription, and connected-company count. Call this first to verify the IMPORTER_API_TOKEN is valid.

### `companies_list` (~47 tokens)

Lists all accounting companies connected to the Importer account (QuickBooks Online via 'intuit', Xero via 'xero'). Use the returned 'id' as companyId for downstream tools.

### `settings_get` (~56 tokens)

Returns per-company import settings (dateFormat, document-number behavior, product/account auto-creation, duplicate-skip). Check dateFormat before importing — CSV date columns must match.

Input parameters:

- `companyId` (string, required): Company id from companies_list.

### `settings_update` (~120 tokens)

Updates per-company import settings. Pass only the fields you want to change inside 'settings' (e.g. { dateFormat: 'dd/MM/yyyy' }). Fetch current values with settings_get first so you don't clobber unrelated fields. Returns the updated settings.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `settings` (object, required): Settings patch. Common fields: dateFormat ('MM/dd/yyyy' | 'dd/MM/yyyy' | 'yyyy-MM-dd'), incrementDocNumber, createMissingProducts, createMissingAccounts, skipDuplicates.

### `entities_list` (~59 tokens)

Lists importable entity types for a company (Invoice, Bill, JournalEntry, Customer, Vendor, etc.). Use the returned 'name' as entityName for fields_get and import tools.

Input parameters:

- `companyId` (string, required): Company id from companies_list.

### `fields_get` (~82 tokens)

Returns the field schema for an entity in a company: every field with its type, required flag, alternativeTitles, and predefinedValues. Use to build or verify a mapping before running an import.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `entityName` (string, required): Entity name from entities_list (e.g., 'Invoice', 'Bill').

### `mappings_list` (~41 tokens)

Lists field mappings saved for a company. Each mapping is reusable across imports of the same entity type.

Input parameters:

- `companyId` (string, required): Company id from companies_list.

### `mapping_create` (~122 tokens)

Creates a new field mapping for an entity (e.g. 'Journal Entry', 'Bill', 'Invoice'). Look up valid target fields with fields_get first. Returns the created mapping including its id.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `entityName` (string, required): Entity this mapping targets — must match entities_list output (e.g. 'Journal Entry').
- `fields` (array, required): Field mappings. Each entry maps a CSV column or a constant to an Importer target field.
- `title` (string, required): Human-readable mapping name.

### `mapping_update` (~112 tokens)

Replaces an existing mapping in full. Fetch the current mapping with mappings_list first and send the whole desired shape — this is a PUT, not a patch. Returns the updated mapping.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `entityName` (string, required): Entity this mapping targets — must match entities_list output.
- `fields` (array, required): Field mappings (full replacement).
- `mappingId` (string, required): Mapping id from mappings_list.
- `title` (string, required): Human-readable mapping name.

### `mapping_delete` (~61 tokens)

Deletes a saved mapping. Irreversible. Imports that referenced this mapping keep their historical record but new imports can no longer pick it.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `mappingId` (string, required): Mapping id from mappings_list.

### `imports_list` (~47 tokens)

Lists recent imports for a company with status and timestamps. Use to find an importId for status / results / revert / cancel.

Input parameters:

- `companyId` (string, required): Company id from companies_list.

### `import_status` (~90 tokens)

Returns a single import's current status and summary (total / succeeded / failed / warnings). Status lifecycle: SCHEDULED → IN_PROGRESS → FINISHED | FINISHED_WITH_WARNINGS | FAILED | CANCELED. FINISHED can transition to REVERTING → REVERTED.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `importId` (string, required): Import id from imports_list.

### `import_results` (~125 tokens)

Returns per-row results for a finished import. Filter by 'type' (INFO / WARNING / ERROR) to surface only failures. Paginated — defaults to 20 rows per page, max 100.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `importId` (string, required): Import id from imports_list.
- `page` (integer): Page number (1-indexed). Default 1.
- `perPage` (integer): Rows per page. Default 20, max 100.
- `type` (string): Optional: filter rows by result type.

### `import_execute` (~162 tokens)

Uploads a CSV/XLSX file and starts an import using an existing mapping. The MCP server reads the file from disk — pass an absolute path. Returns the created import object including importId. Status starts as SCHEDULED — poll import_status or use import_wait. Limits: .csv/.xlsx/.xls only, 50MB max.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `entityName` (string, required): Entity to import as — must match entities_list (e.g. 'Journal Entry').
- `filePath` (string, required): Absolute path to a .csv, .xlsx, or .xls file on the machine running the MCP server.
- `mappingId` (string, required): Mapping id from mappings_list to apply to the file.

### `import_auto` (~149 tokens)

Uploads a file and asks the server to auto-map columns to the target entity. Set dryRun=true to get the proposed mapping back without creating an import — useful for showing the user what will happen and asking 'does this look right?' before committing. Set dryRun=false (default) to auto-map and import in one call.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `dryRun` (boolean): If true, returns proposed mapping without starting an import. Default false.
- `entityName` (string, required): Entity to import as — must match entities_list output.
- `filePath` (string, required): Absolute path to a .csv, .xlsx, or .xls file.

### `import_cancel` (~67 tokens)

Cancels a SCHEDULED or IN_PROGRESS import. Already-imported rows are NOT rolled back — use import_revert for that. Returns the updated import status.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `importId` (string, required): Import id from imports_list.

### `import_revert` (~90 tokens)

Reverts a FINISHED or FINISHED_WITH_WARNINGS import — deletes the QuickBooks/Xero entries the import created, using their live SyncTokens. Status transitions FINISHED → REVERTING → REVERTED. Confirm with the user before calling — irreversible from their perspective.

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `importId` (string, required): Import id from imports_list.

### `import_wait` (~164 tokens)

Polls import_status until the import reaches a terminal state (FINISHED, FINISHED_WITH_WARNINGS, FAILED, CANCELED, REVERTED). Exponential backoff (2s → 1.5× → cap 30s). Default timeout 600s — if exceeded, returns { status: 'POLLING', importId, lastSeen } so the LLM can re-call. Includes a per-type result count summary on terminal states (INFO / WARNING / ERROR; null if the server didn't return totals).

Input parameters:

- `companyId` (string, required): Company id from companies_list.
- `importId` (string, required): Import id from imports_list or import_execute.
- `timeoutSeconds` (integer): Max seconds to wait before returning POLLING. Default 600.

### `import_csv` (~218 tokens)

Happy-path CSV/XLSX importer. Two-step: first call (without confirmed) auto-resolves the company, uploads the file, and returns the server's proposed mapping plus any missingRequired fields — show this to the user. Re-call with confirmed=true (and the same filePath) to run the real import and poll until it terminates. Returns { stage: 'DRY_RUN' | 'DONE', importId?, status, summary?, proposedMapping?, missingRequired? }.

Input parameters:

- `companyId` (string): Optional. If omitted and exactly one ACTIVE company exists, it's picked automatically.
- `confirmed` (boolean): Set true on the second call to commit the import. Default false (dry-run only).
- `entityName` (string, required): Entity to import as — match entities_list (e.g. 'Journal Entry').
- `filePath` (string, required): Absolute path to a .csv, .xlsx, or .xls file.
- `timeoutSeconds` (integer): Forwarded to import_wait on the confirmed call. Default 600.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/com-synder-gl-importer-mcp/cloudbusiness-gl-importer-mcp#diagnostics

## Score history

- 2026-08-03: 81
- 2026-08-02: 80
- 2026-08-01: 20
- 2026-07-31: 50
- 2026-07-29: 25
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@cloudbusiness/gl-importer-mcp
- Socket report: https://socket.dev/npm/package/@cloudbusiness/gl-importer-mcp
- Repository: https://github.com/SynderAccounting/gl-importer-plugin
- Changelog RSS feed: https://verifymcp.io/servers/com-synder-gl-importer-mcp/cloudbusiness-gl-importer-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-synder-gl-importer-mcp/cloudbusiness-gl-importer-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-synder-gl-importer-mcp/cloudbusiness-gl-importer-mcp