# CashCtrl MCP by usefulapi (remote · cashctrl.usefulapi.io)

Read CashCtrl accounts, journal, orders, people, articles, salaries and reports; book and create.

- Trust score: 64/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-16

## Components

- remote · `cashctrl.usefulapi.io`: 64/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-cashctrl/cashctrl.md), [page](https://verifymcp.io/servers/io-usefulapi-cashctrl/cashctrl)

## Channel facts

- Endpoint: `https://cashctrl.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-16.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 80/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3556 tokens (~127/item across 28 items; 28 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 13/100
  - Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the CashCtrl MCP by usefulapi server?

CashCtrl MCP by usefulapi is a hosted endpoint at https://cashctrl.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-cashctrl 'https://cashctrl.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-cashctrl": {
      "url": "https://cashctrl.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-cashctrl": {
      "type": "http",
      "url": "https://cashctrl.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-cashctrl]
url = "https://cashctrl.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-cashctrl": {
      "type": "remote",
      "url": "https://cashctrl.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-cashctrl --url 'https://cashctrl.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-cashctrl:
    url: "https://cashctrl.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-cashctrl": {
      "Transport": "http",
      "Url": "https://cashctrl.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-cashctrl -t streamable-http -u 'https://cashctrl.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-cashctrl": {
      "type": "http",
      "url": "https://cashctrl.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-16 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-14 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-13 (score 62, +2)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional improvement] Stability: unverified → 0.03
- [functional] The server now declares the “prompts” capability
- [functional] First check of Schema quality: 100
- [functional] New prompt “getting_started”
- [functional] Server version: 1.0.0 → 1.1.0

### 2026-10-12 (score 60)

First indexed and scored.

## MCP tools (28)

### `cashctrl_list_accounts` (~161 tokens)

List accounts

The chart of accounts: number, name, category and the balance for the fiscal period. Not paged. GET /account/list.json.

Input parameters:

- `category_id` (integer): Only accounts of this category (cashctrl_list_account_categories).
- `dir` (string): Sort direction (each list has its own default).
- `filter` (array): Column filters, all must match (AND).
- `fiscal_period_id` (integer): Fiscal period id (cashctrl_list_fiscal_periods); default is the current period.
- `only_active` (boolean): Only active accounts.
- `query` (string): Full-text search.
- `sort` (string): Column to sort by (a column name of the list reply; each list has its own default).

### `cashctrl_get_account` (~47 tokens)

Get an account

One account of the chart of accounts by id. GET /account/read.json.

Input parameters:

- `id` (integer, required): The account id (from cashctrl_list_accounts; not the account number).

### `cashctrl_get_account_balance` (~74 tokens)

Get an account balance

The balance of one account at the end of a day (default: the last day of the current fiscal period). GET /account/balance.

Input parameters:

- `date` (string): Balance at the end of this day, yyyy-mm-dd.
- `id` (integer, required): The account id (from cashctrl_list_accounts).

### `cashctrl_list_account_categories` (~39 tokens)

List account categories

The categories of the chart of accounts (assets, liabilities, expenses, revenue and their sub-categories). GET /account/category/list.json.

### `cashctrl_list_bank_accounts` (~37 tokens)

List bank accounts

The bank accounts set up in CashCtrl (name, IBAN, linked ledger account). GET /account/bank/list.json.

### `cashctrl_list_journal` (~304 tokens)

List journal entries

Book entries of the journal (date, title, debit and credit account, amount, reference), newest first, for the current fiscal period unless fiscal_period_id is set. GET /journal/list.json.

Input parameters:

- `account_id` (integer): Only entries of this account (cashctrl_list_accounts).
- `associate_id` (integer): Only entries of this person (cashctrl_list_persons).
- `dir` (string): Sort direction (each list has its own default).
- `filter` (array): Column filters, all must match (AND).
- `fiscal_period_id` (integer): Fiscal period id (cashctrl_list_fiscal_periods); default is the current period.
- `limit` (integer): Rows to return, 1-500 (default 100).
- `only_collective` (boolean): Only collective entries.
- `only_imported` (boolean): Only imported (bank) entries.
- `only_manual` (boolean): Only manual entries.
- `only_purchase` (boolean): Only entries created by purchase orders.
- `only_salary` (boolean): Only entries created by salary statements.
- `only_sales` (boolean): Only entries created by sales orders.
- `query` (string): Full-text search.
- `sort` (string): Column to sort by (a column name of the list reply; each list has its own default).
- `start` (integer): Index of the first row (default 0). Use next_start from the previous reply.

### `cashctrl_get_journal_entry` (~50 tokens)

Get a journal entry

One book entry by id, with its items for a collective entry. GET /journal/read.json.

Input parameters:

- `id` (integer, required): The journal entry id (from cashctrl_list_journal).

### `cashctrl_list_orders` (~297 tokens)

List orders

Sales or purchase documents (quotes, order confirmations, invoices, delivery notes, credit notes, vendor bills) with number, date, customer, status and total. Newest first. GET /order/list.json.

Input parameters:

- `category_id` (integer): Only this order category (cashctrl_list_order_categories), for example Invoice.
- `dir` (string): Sort direction (each list has its own default).
- `filter` (array): Column filters, all must match (AND).
- `fiscal_period_id` (integer): Fiscal period id (cashctrl_list_fiscal_periods); default is the current period.
- `limit` (integer): Rows to return, 1-500 (default 100).
- `only_open` (boolean): Only open (not completed) orders, for example unpaid invoices.
- `only_overdue` (boolean): Only orders past their due date.
- `person_id` (integer): Only orders of this person (cashctrl_list_persons).
- `query` (string): Full-text search.
- `sort` (string): Column to sort by (a column name of the list reply; each list has its own default).
- `start` (integer): Index of the first row (default 0). Use next_start from the previous reply.
- `status_id` (integer): Only this status (the status ids are in cashctrl_list_order_categories).
- `type` (string): SALES or PURCHASE documents.

### `cashctrl_get_order` (~53 tokens)

Get an order

One order (invoice, quote, purchase document) by id, with its items, totals and status. GET /order/read.json.

Input parameters:

- `id` (integer, required): The order id (from cashctrl_list_orders).

### `cashctrl_list_order_categories` (~109 tokens)

List order categories

The order categories (Quote, Invoice, Credit note, Purchase invoice and so on) with their statuses (Draft, Open, Paid) and the default accounts and sequence numbers. Use it to find category_id and status_id (type PURCHASE for purchase documents). GET /order/category/list.json.

Input parameters:

- `fiscal_period_id` (integer): Fiscal period id (cashctrl_list_fiscal_periods); default is the current period.
- `type` (string): SALES (default) or PURCHASE categories.

### `cashctrl_list_persons` (~202 tokens)

List people

Customers, vendors, employees and other contacts (name, company, number, roles, addresses). GET /person/list.json.

Input parameters:

- `category_id` (integer): Only this person category.
- `dir` (string): Sort direction (each list has its own default).
- `filter` (array): Column filters, all must match (AND).
- `limit` (integer): Rows to return, 1-500 (default 100).
- `only_active` (boolean): Only active people.
- `only_customers` (boolean): Only customers.
- `only_employees` (boolean): Only employees.
- `only_vendors` (boolean): Only vendors.
- `query` (string): Full-text search.
- `sort` (string): Column to sort by (a column name of the list reply; each list has its own default).
- `start` (integer): Index of the first row (default 0). Use next_start from the previous reply.

### `cashctrl_get_person` (~49 tokens)

Get a person

One person or company by id, with addresses, contact data and bank accounts. GET /person/read.json.

Input parameters:

- `id` (integer, required): The person id (from cashctrl_list_persons).

### `cashctrl_list_articles` (~183 tokens)

List inventory articles

Inventory articles (products and services) with number, name, price, stock and accounts. GET /inventory/article/list.json.

Input parameters:

- `category_id` (integer): Only this article category.
- `dir` (string): Sort direction (each list has its own default).
- `filter` (array): Column filters, all must match (AND).
- `limit` (integer): Rows to return, 1-500 (default 100).
- `only_active` (boolean): Only active articles.
- `only_restock` (boolean): Only articles that need restocking.
- `query` (string): Full-text search.
- `sort` (string): Column to sort by (a column name of the list reply; each list has its own default).
- `start` (integer): Index of the first row (default 0). Use next_start from the previous reply.

### `cashctrl_get_article` (~39 tokens)

Get an inventory article

One inventory article by id. GET /inventory/article/read.json.

Input parameters:

- `id` (integer, required): The article id (from cashctrl_list_articles).

### `cashctrl_list_salary_statements` (~212 tokens)

List salary statements

Payroll statements (employee, date, status, gross and net amounts), newest first. Sensitive personal data. GET /salary/statement/list.json.

Input parameters:

- `dir` (string): Sort direction (each list has its own default).
- `fiscal_period_id` (integer): Fiscal period id (cashctrl_list_fiscal_periods); default is the current period.
- `limit` (integer): Rows to return, 1-500 (default 100).
- `only_open` (boolean): Only open (not yet paid) statements.
- `only_overdue` (boolean): Only statements past their payment date.
- `person_id` (integer): Only statements of this employee (cashctrl_list_persons).
- `query` (string): Full-text search.
- `sort` (string): Column to sort by (a column name of the list reply; each list has its own default).
- `start` (integer): Index of the first row (default 0). Use next_start from the previous reply.

### `cashctrl_get_salary_statement` (~52 tokens)

Get a salary statement

One payroll statement by id, with its salary items. Sensitive personal data. GET /salary/statement/read.json.

Input parameters:

- `id` (integer, required): The statement id (from cashctrl_list_salary_statements).

### `cashctrl_list_fiscal_periods` (~48 tokens)

List fiscal periods

All fiscal periods (id, name, start, end, current flag). The id is the fiscal_period_id of the other tools. GET /fiscalperiod/list.json.

### `cashctrl_list_tax_codes` (~41 tokens)

List tax codes

The VAT tax codes (id, code, name, rates). The id is the tax_id of the write tools. GET /tax/list.json.

### `cashctrl_list_sequence_numbers` (~46 tokens)

List sequence numbers

The number sequences (for journal references, order numbers, customer numbers). The id is the sequence_number_id of the write tools. GET /sequencenumber/list.json.

### `cashctrl_list_currencies` (~29 tokens)

List currencies

The currencies set up in CashCtrl with their exchange rates. GET /currency/list.json.

### `cashctrl_get_report_tree` (~56 tokens)

Get the report tree

The reports set up in CashCtrl (balance sheet, income statement, and so on) as a tree of collections and elements. The element id is the input of cashctrl_get_report_data. GET /report/tree.json.

### `cashctrl_get_report_data` (~124 tokens)

Get report data

The data of one report element (for example the balance sheet or the income statement) for a fiscal period or a date range. GET /report/element/data.json.

Input parameters:

- `element_id` (integer, required): The report element id (from cashctrl_get_report_tree).
- `end_date` (string): End of the period, yyyy-mm-dd.
- `fiscal_period_id` (integer): Fiscal period id (cashctrl_list_fiscal_periods). It replaces start_date and end_date.
- `start_date` (string): Start of the period, yyyy-mm-dd.

### `cashctrl_create_journal_entry` (~282 tokens)

Create a journal entry

WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Creates a manual book entry in the journal. Either a simple entry (debit_account_id, credit_account_id, amount) or a collective entry (items, whose debit and credit sums must match). POST /journal/create.json.

Input parameters:

- `amount` (number): Amount of a simple entry, for example 125.50.
- `associate_id` (integer): The person this entry belongs to (cashctrl_list_persons).
- `credit_account_id` (integer): Credit account id (cashctrl_list_accounts). For a simple entry.
- `date` (string): Booking date, yyyy-mm-dd (CashCtrl uses today when omitted).
- `debit_account_id` (integer): Debit account id (cashctrl_list_accounts). For a simple entry.
- `items` (array): Lines of a collective entry. Use it instead of debit_account_id, credit_account_id and amount.
- `reference` (string): Receipt or reference text (max 100).
- `sequence_number_id` (integer): Sequence number that generates the reference (cashctrl_list_sequence_numbers).
- `tax_id` (integer): Tax code id of a simple entry (cashctrl_list_tax_codes).
- `title` (string, required): Description of the entry (max 250 characters).

### `cashctrl_delete_journal_entries` (~92 tokens)

Delete journal entries

WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. DELETES manual journal entries by id (entries created by orders or salary statements cannot be deleted this way). Deleted entries are gone from the books; confirm the ids with the user first. POST /journal/delete.json.

Input parameters:

- `ids` (array, required): 1-20 journal entry ids.

### `cashctrl_create_order` (~315 tokens)

Create an order

WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Creates ONE order document for ONE customer or vendor: a quote, invoice, credit note, purchase bill and so on, depending on category_id. Without status_id the first status of the category is used; a booking status (for example Open) also creates journal entries, so use a draft status unless the user asks otherwise. No e-mail is sent. POST /order/create.json.

Input parameters:

- `account_id` (integer): Debtors or creditors account id; default from the category.
- `associate_id` (integer, required): The customer or vendor (cashctrl_list_persons).
- `category_id` (integer, required): Order category id (cashctrl_list_order_categories), for example the Invoice category.
- `date` (string, required): Document date, yyyy-mm-dd.
- `description` (string): Description of the document (max 200).
- `discount_percentage` (number): Discount of the whole order in percent.
- `due_days` (integer): Days until payment is due.
- `items` (array, required): 1-200 order items.
- `language` (string): Language of the document.
- `nr` (string): Order number. Leave empty to use the sequence number of the category.
- `sequence_number_id` (integer): Sequence number for the order number (cashctrl_list_sequence_numbers).
- `status_id` (integer): Status id (cashctrl_list_order_categories). Default: the first status of the category.

### `cashctrl_update_order_status` (~115 tokens)

Change the status of orders

WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Sets the status of 1-20 orders (for example Draft to Open, or Open to Paid). A status can book journal entries or move stock, so the books change. POST /order/update_status.json.

Input parameters:

- `ids` (array, required): 1-20 order ids.
- `status_id` (integer, required): The new status id (from the statuses of the order category, cashctrl_list_order_categories).

### `cashctrl_delete_orders` (~87 tokens)

Delete orders

WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. DELETES orders (invoices, quotes, purchase documents) by id, with the journal entries they created. Deleted documents are gone; confirm the ids with the user first. POST /order/delete.json.

Input parameters:

- `ids` (array, required): 1-20 order ids.

### `cashctrl_create_person` (~211 tokens)

Create a person or company

WRITE: changes the accounting records. Makes one request that is never repeated; check the result before trying again. Creates a customer, vendor or other contact. Give company, first_name or last_name (at least one). Search first with cashctrl_list_persons so no duplicate is created. POST /person/create.json.

Input parameters:

- `addresses` (array): Addresses.
- `category_id` (integer): Person category id.
- `company` (string): Company name.
- `contacts` (array): E-mail addresses, phone numbers and websites.
- `first_name` (string): First name.
- `is_customer` (boolean): Mark as customer.
- `is_vendor` (boolean): Mark as vendor.
- `language` (string): Language of documents for this person.
- `last_name` (string): Last name.
- `nr` (string): Person number, for example the customer number.
- `vat_uid` (string): VAT number (UID), for example CHE-123.456.789 MWST.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-cashctrl/cashctrl#diagnostics

## Score history

- 2026-10-16: 64
- 2026-10-15: 63
- 2026-10-14: 63
- 2026-10-13: 62
- 2026-10-12: 60

## Common questions

### What is the CashCtrl MCP by usefulapi server?

CashCtrl MCP by usefulapi is listed in the public MCP registry as io.usefulapi/cashctrl. Read CashCtrl accounts, journal, orders, people, articles, salaries and reports; book and create. This page covers its hosted endpoint (https://cashctrl.usefulapi.io/mcp).

### Is the CashCtrl MCP by usefulapi server safe to use?

CashCtrl MCP by usefulapi scores 64 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the CashCtrl MCP by usefulapi server expose?

CashCtrl MCP by usefulapi exposes 28 tools: cashctrl_list_accounts, cashctrl_get_account, cashctrl_get_account_balance, cashctrl_list_account_categories, cashctrl_list_bank_accounts, and 23 more. Their descriptions and schemas cost roughly 3,354 tokens of context every time the server is loaded.

### Does the CashCtrl MCP by usefulapi server require authentication?

Yes. CashCtrl MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the CashCtrl MCP by usefulapi server still maintained?

CashCtrl MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://cashctrl.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/cashctrl/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-cashctrl/cashctrl.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-cashctrl/cashctrl.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-cashctrl/cashctrl