CashCtrl MCP by usefulapi
REMOTE · CASHCTRL.USEFULAPI.IO
Read CashCtrl accounts, journal, orders, people, articles, salaries and reports; book and create.
Available components
Last scanned (22 hours ago)
Scores higher than 46% of remote servers
Reachable. Last reached 16 Oct 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security78
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3556 tokens (~127/item across 28 items; 28 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 +2
- The server rewrote its instructions, which are the text every model session reads security
- Stability: unverified → 0.03 ▲ functional
- The server now declares the “prompts” capability functional
- First check of Schema quality: 100 functional
- New prompt “getting_started” functional
- Server version: 1.0.0 → 1.1.0 functional
- 12 Oct 26 60
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 16 Oct 2026 · Probed https://cashctrl.usefulapi.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=usefulapi.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | d9be3287b0fde9630e825ba1f79bff3f |
| SANs: usefulapi.io, *.usefulapi.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of cashctrl.usefulapi.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| usefulapi.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 302 |
WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://cashctrl.usefulapi.io/.well-known/oauth-protected-resource/mcp"
Bearer realm="OAuth", resource_metadata="https://cashctrl.usefulapi.io/.well-known/oauth-protected-resource/mcp"Protected resource metadata
| Document | https://cashctrl.usefulapi.io/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://cashctrl.usefulapi.io/mcp |
| Authorisation server | https://cashctrl.usefulapi.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://cashctrl.usefulapi.io/mcp | Redirected | 302 | https://usefulapi.io/cashctrl/ |
| http (plaintext) | http://cashctrl.usefulapi.io/mcp | Inconclusive | 302 | http://cashctrl.usefulapi.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cashctrl_create_journal_entry Create a journal entry ~282
WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Creates a manual book entry in the journal. Either a simple entry (debit_account_id, credit_account_id, amount) or a collective entry (items, whose debit and credit sums must match). POST /journal/create.json.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | number | – | Amount of a simple entry, for example 125.50. |
| associate_id | integer | – | The person this entry belongs to (cashctrl_list_persons). |
| credit_account_id | integer | – | Credit account id (cashctrl_list_accounts). For a simple entry. |
| date | string | – | Booking date, yyyy-mm-dd (CashCtrl uses today when omitted). |
| debit_account_id | integer | – | Debit account id (cashctrl_list_accounts). For a simple entry. |
| items | array | – | Lines of a collective entry. Use it instead of debit_account_id, credit_account_id and amount. |
| reference | string | – | Receipt or reference text (max 100). |
| sequence_number_id | integer | – | Sequence number that generates the reference (cashctrl_list_sequence_numbers). |
| tax_id | integer | – | Tax code id of a simple entry (cashctrl_list_tax_codes). |
| title | string | yes | Description of the entry (max 250 characters). |
No output schema declared.
No examples provided.
cashctrl_create_order Create an order ~315
WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Creates ONE order document for ONE customer or vendor: a quote, invoice, credit note, purchase bill and so on, depending on category_id. Without status_id the first status of the category is used; a booking status (for example Open) also creates journal entries, so use a draft status unless the user asks otherwise. No e-mail is sent. POST /order/create.json.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | – | Debtors or creditors account id; default from the category. |
| associate_id | integer | yes | The customer or vendor (cashctrl_list_persons). |
| category_id | integer | yes | Order category id (cashctrl_list_order_categories), for example the Invoice category. |
| date | string | yes | Document date, yyyy-mm-dd. |
| description | string | – | Description of the document (max 200). |
| discount_percentage | number | – | Discount of the whole order in percent. |
| due_days | integer | – | Days until payment is due. |
| items | array | yes | 1-200 order items. |
| language | string | – | Language of the document. |
| nr | string | – | Order number. Leave empty to use the sequence number of the category. |
| sequence_number_id | integer | – | Sequence number for the order number (cashctrl_list_sequence_numbers). |
| status_id | integer | – | Status id (cashctrl_list_order_categories). Default: the first status of the category. |
No output schema declared.
No examples provided.
cashctrl_create_person Create a person or company ~211
WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Creates a customer, vendor or other contact. Give company, first_name or last_name (at least one). Search first with cashctrl_list_persons so no duplicate is created. POST /person/create.json.
| Name | Type | Req | Description |
|---|---|---|---|
| addresses | array | – | Addresses. |
| category_id | integer | – | Person category id. |
| company | string | – | Company name. |
| contacts | array | – | E-mail addresses, phone numbers and websites. |
| first_name | string | – | First name. |
| is_customer | boolean | – | Mark as customer. |
| is_vendor | boolean | – | Mark as vendor. |
| language | string | – | Language of documents for this person. |
| last_name | string | – | Last name. |
| nr | string | – | Person number, for example the customer number. |
| vat_uid | string | – | VAT number (UID), for example CHE-123.456.789 MWST. |
No output schema declared.
No examples provided.
cashctrl_delete_journal_entries Delete journal entries ~92
WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. DELETES manual journal entries by id (entries created by orders or salary statements cannot be deleted this way). Deleted entries are gone from the books; confirm the ids with the user first. POST /journal/delete.json.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | 1-20 journal entry ids. |
No output schema declared.
No examples provided.
cashctrl_delete_orders Delete orders ~87
WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. DELETES orders (invoices, quotes, purchase documents) by id, with the journal entries they created. Deleted documents are gone; confirm the ids with the user first. POST /order/delete.json.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | 1-20 order ids. |
No output schema declared.
No examples provided.
cashctrl_get_account Get an account ~47
One account of the chart of accounts by id. GET /account/read.json.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | The account id (from cashctrl_list_accounts; not the account number). |
No output schema declared.
No examples provided.
cashctrl_get_account_balance Get an account balance ~74
The balance of one account at the end of a day (default: the last day of the current fiscal period). GET /account/balance.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Balance at the end of this day, yyyy-mm-dd. |
| id | integer | yes | The account id (from cashctrl_list_accounts). |
No output schema declared.
No examples provided.
cashctrl_get_article Get an inventory article ~39
One inventory article by id. GET /inventory/article/read.json.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | The article id (from cashctrl_list_articles). |
No output schema declared.
No examples provided.
cashctrl_get_journal_entry Get a journal entry ~50
One book entry by id, with its items for a collective entry. GET /journal/read.json.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | The journal entry id (from cashctrl_list_journal). |
No output schema declared.
No examples provided.
cashctrl_get_order Get an order ~53
One order (invoice, quote, purchase document) by id, with its items, totals and status. GET /order/read.json.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | The order id (from cashctrl_list_orders). |
No output schema declared.
No examples provided.
cashctrl_get_person Get a person ~49
One person or company by id, with addresses, contact data and bank accounts. GET /person/read.json.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | The person id (from cashctrl_list_persons). |
No output schema declared.
No examples provided.
cashctrl_get_report_data Get report data ~124
The data of one report element (for example the balance sheet or the income statement) for a fiscal period or a date range. GET /report/element/data.json.
| Name | Type | Req | Description |
|---|---|---|---|
| element_id | integer | yes | The report element id (from cashctrl_get_report_tree). |
| end_date | string | – | End of the period, yyyy-mm-dd. |
| fiscal_period_id | integer | – | Fiscal period id (cashctrl_list_fiscal_periods). It replaces start_date and end_date. |
| start_date | string | – | Start of the period, yyyy-mm-dd. |
No output schema declared.
No examples provided.
cashctrl_get_report_tree Get the report tree ~56
The reports set up in CashCtrl (balance sheet, income statement, and so on) as a tree of collections and elements. The element id is the input of cashctrl_get_report_data. GET /report/tree.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cashctrl_get_salary_statement Get a salary statement ~52
One payroll statement by id, with its salary items. Sensitive personal data. GET /salary/statement/read.json.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | The statement id (from cashctrl_list_salary_statements). |
No output schema declared.
No examples provided.
cashctrl_list_account_categories List account categories ~39
The categories of the chart of accounts (assets, liabilities, expenses, revenue and their sub-categories). GET /account/category/list.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cashctrl_list_accounts List accounts ~161
The chart of accounts: number, name, category and the balance for the fiscal period. Not paged. GET /account/list.json.
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | integer | – | Only accounts of this category (cashctrl_list_account_categories). |
| dir | string | – | Sort direction (each list has its own default). |
| filter | array | – | Column filters, all must match (AND). |
| fiscal_period_id | integer | – | Fiscal period id (cashctrl_list_fiscal_periods); default is the current period. |
| only_active | boolean | – | Only active accounts. |
| query | string | – | Full-text search. |
| sort | string | – | Column to sort by (a column name of the list reply; each list has its own default). |
No output schema declared.
No examples provided.
cashctrl_list_articles List inventory articles ~183
Inventory articles (products and services) with number, name, price, stock and accounts. GET /inventory/article/list.json.
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | integer | – | Only this article category. |
| dir | string | – | Sort direction (each list has its own default). |
| filter | array | – | Column filters, all must match (AND). |
| limit | integer | – | Rows to return, 1-500 (default 100). |
| only_active | boolean | – | Only active articles. |
| only_restock | boolean | – | Only articles that need restocking. |
| query | string | – | Full-text search. |
| sort | string | – | Column to sort by (a column name of the list reply; each list has its own default). |
| start | integer | – | Index of the first row (default 0). Use next_start from the previous reply. |
No output schema declared.
No examples provided.
cashctrl_list_bank_accounts List bank accounts ~37
The bank accounts set up in CashCtrl (name, IBAN, linked ledger account). GET /account/bank/list.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cashctrl_list_currencies List currencies ~29
The currencies set up in CashCtrl with their exchange rates. GET /currency/list.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cashctrl_list_fiscal_periods List fiscal periods ~48
All fiscal periods (id, name, start, end, current flag). The id is the fiscal_period_id of the other tools. GET /fiscalperiod/list.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cashctrl_list_journal List journal entries ~304
Book entries of the journal (date, title, debit and credit account, amount, reference), newest first, for the current fiscal period unless fiscal_period_id is set. GET /journal/list.json.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | – | Only entries of this account (cashctrl_list_accounts). |
| associate_id | integer | – | Only entries of this person (cashctrl_list_persons). |
| dir | string | – | Sort direction (each list has its own default). |
| filter | array | – | Column filters, all must match (AND). |
| fiscal_period_id | integer | – | Fiscal period id (cashctrl_list_fiscal_periods); default is the current period. |
| limit | integer | – | Rows to return, 1-500 (default 100). |
| only_collective | boolean | – | Only collective entries. |
| only_imported | boolean | – | Only imported (bank) entries. |
| only_manual | boolean | – | Only manual entries. |
| only_purchase | boolean | – | Only entries created by purchase orders. |
| only_salary | boolean | – | Only entries created by salary statements. |
| only_sales | boolean | – | Only entries created by sales orders. |
| query | string | – | Full-text search. |
| sort | string | – | Column to sort by (a column name of the list reply; each list has its own default). |
| start | integer | – | Index of the first row (default 0). Use next_start from the previous reply. |
No output schema declared.
No examples provided.
cashctrl_list_order_categories List order categories ~109
The order categories (Quote, Invoice, Credit note, Purchase invoice and so on) with their statuses (Draft, Open, Paid) and the default accounts and sequence numbers. Use it to find category_id and status_id (type PURCHASE for purchase documents). GET /order/category/list.json.
| Name | Type | Req | Description |
|---|---|---|---|
| fiscal_period_id | integer | – | Fiscal period id (cashctrl_list_fiscal_periods); default is the current period. |
| type | string | – | SALES (default) or PURCHASE categories. |
No output schema declared.
No examples provided.
cashctrl_list_orders List orders ~297
Sales or purchase documents (quotes, order confirmations, invoices, delivery notes, credit notes, vendor bills) with number, date, customer, status and total. Newest first. GET /order/list.json.
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | integer | – | Only this order category (cashctrl_list_order_categories), for example Invoice. |
| dir | string | – | Sort direction (each list has its own default). |
| filter | array | – | Column filters, all must match (AND). |
| fiscal_period_id | integer | – | Fiscal period id (cashctrl_list_fiscal_periods); default is the current period. |
| limit | integer | – | Rows to return, 1-500 (default 100). |
| only_open | boolean | – | Only open (not completed) orders, for example unpaid invoices. |
| only_overdue | boolean | – | Only orders past their due date. |
| person_id | integer | – | Only orders of this person (cashctrl_list_persons). |
| query | string | – | Full-text search. |
| sort | string | – | Column to sort by (a column name of the list reply; each list has its own default). |
| start | integer | – | Index of the first row (default 0). Use next_start from the previous reply. |
| status_id | integer | – | Only this status (the status ids are in cashctrl_list_order_categories). |
| type | string | – | SALES or PURCHASE documents. |
No output schema declared.
No examples provided.
cashctrl_list_persons List people ~202
Customers, vendors, employees and other contacts (name, company, number, roles, addresses). GET /person/list.json.
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | integer | – | Only this person category. |
| dir | string | – | Sort direction (each list has its own default). |
| filter | array | – | Column filters, all must match (AND). |
| limit | integer | – | Rows to return, 1-500 (default 100). |
| only_active | boolean | – | Only active people. |
| only_customers | boolean | – | Only customers. |
| only_employees | boolean | – | Only employees. |
| only_vendors | boolean | – | Only vendors. |
| query | string | – | Full-text search. |
| sort | string | – | Column to sort by (a column name of the list reply; each list has its own default). |
| start | integer | – | Index of the first row (default 0). Use next_start from the previous reply. |
No output schema declared.
No examples provided.
cashctrl_list_salary_statements List salary statements ~212
Payroll statements (employee, date, status, gross and net amounts), newest first. Sensitive personal data. GET /salary/statement/list.json.
| Name | Type | Req | Description |
|---|---|---|---|
| dir | string | – | Sort direction (each list has its own default). |
| fiscal_period_id | integer | – | Fiscal period id (cashctrl_list_fiscal_periods); default is the current period. |
| limit | integer | – | Rows to return, 1-500 (default 100). |
| only_open | boolean | – | Only open (not yet paid) statements. |
| only_overdue | boolean | – | Only statements past their payment date. |
| person_id | integer | – | Only statements of this employee (cashctrl_list_persons). |
| query | string | – | Full-text search. |
| sort | string | – | Column to sort by (a column name of the list reply; each list has its own default). |
| start | integer | – | Index of the first row (default 0). Use next_start from the previous reply. |
No output schema declared.
No examples provided.
cashctrl_list_sequence_numbers List sequence numbers ~46
The number sequences (for journal references, order numbers, customer numbers). The id is the sequence_number_id of the write tools. GET /sequencenumber/list.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cashctrl_list_tax_codes List tax codes ~41
The VAT tax codes (id, code, name, rates). The id is the tax_id of the write tools. GET /tax/list.json.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cashctrl_update_order_status Change the status of orders ~115
WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Sets the status of 1-20 orders (for example Draft to Open, or Open to Paid). A status can book journal entries or move stock, so the books change. POST /order/update_status.json.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | 1-20 order ids. |
| status_id | integer | yes | The new status id (from the statuses of the order category, cashctrl_list_order_categories). |
No output schema declared.
No examples provided.
How do I install the CashCtrl MCP by usefulapi server?
CashCtrl MCP by usefulapi is a hosted endpoint at https://cashctrl.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · cashctrl.usefulapi.io
claude mcp add --transport http io-usefulapi-cashctrl 'https://cashctrl.usefulapi.io/mcp'
What is the CashCtrl MCP by usefulapi server?
CashCtrl MCP by usefulapi is listed in the public MCP registry as io.usefulapi/cashctrl. Read CashCtrl accounts, journal, orders, people, articles, salaries and reports; book and create. This page covers its hosted endpoint (https://cashctrl.usefulapi.io/mcp).
Is the CashCtrl MCP by usefulapi server safe to use?
CashCtrl MCP by usefulapi scores 64 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CashCtrl MCP by usefulapi server expose?
CashCtrl MCP by usefulapi exposes 28 tools: cashctrl_list_accounts, cashctrl_get_account, cashctrl_get_account_balance, cashctrl_list_account_categories, cashctrl_list_bank_accounts, and 23 more. Their descriptions and schemas cost roughly 3,354 tokens of context every time the server is loaded.
Does the CashCtrl MCP by usefulapi server require authentication?
Yes. CashCtrl MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the CashCtrl MCP by usefulapi server still maintained?
CashCtrl MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.