Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

KiotViet MCP by usefulapi

REMOTE · KIOTVIET.USEFULAPI.IO

Read KiotViet products, customers, invoices, orders and stock; create customers and orders.

−45 this week 18 Trust /100

Last scanned (4 hours ago)

Scores higher than 4% of remote servers

Reachable. Last reached 5 Nov 2026.

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security46
Transport & Reachability0
Schema Quality & AI Usability0
  • Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.Unverified
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
  • Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Tool Safety0
  • Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Capabilities0
  • Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified

Unverified: 5 categories

Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

What we tested

Checks we ran (4)

  • TLS certificate
  • HSTS header
  • DNSSEC
  • Transport

Checks we could not complete (7)

These are gaps on our side, not findings about this hosted endpoint. We only credit what we can confirm, so a category made up entirely of them scores 0.

  • Authorization in Endpoint SecurityAuthorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  • HTTPS in Endpoint SecurityHTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  • Schema quality in Schema Quality & AI Usability (scores 0 for this)Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.
  • Stability in Stability & Change Management (scores 0 for this)Stability not yet verified: not enough scan history yet (needs a 30-day window).
  • Tool coverage in Tool Coverage (scores 0 for this)Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
  • Tool safety in Tool Safety (scores 0 for this)Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
  • Capabilities in Capabilities (scores 0 for this)Capabilities not yet verified: we couldn't read the endpoint's capabilities.

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 1 Nov 26 −49
    • Endpoint reachability: reachable → not serving MCP ▼ security
    • Tool safety: pass → unverified ▼ security
    • Authorization: pass → unverified ▼ security
    • Stability: 0.17 → unverified ▼ security
    • Schema quality: 100 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
  • 31 Oct 26 +3
    • Authorization: partial → pass ▲ security
    • MCP protocol: fail → pass ▲ functional
    • New prompt “add_a_new_customer” functional
    • New prompt “check_stock_by_branch” functional
    • New prompt “look_up_a_customer_and_their_orders” functional
    • New prompt “review_supplier_purchases” functional
    • New prompt “review_the_day_s_sales” functional
    • New prompt “take_a_sales_order” functional
    • MCP protocol version: 2025-06-18 → 2025-11-25 functional
    • Server version: 1.7.0 → 1.9.0 functional
    • Server version: 1.6.0 → 1.7.0 functional
    • Server version: 1.5.2 → 1.6.0 functional
  • 30 Oct 26 +1
    • Server version: 1.5.1 → 1.5.2 functional
    • Server version: 1.5.0 → 1.5.1 functional
  • 29 Oct 26 0
    • Server version: 1.4.0 → 1.5.0 functional
    • Server version: 1.3.0 → 1.4.0 functional
  • 28 Oct 26 +1
    • Server version: 1.1.0 → 1.3.0 functional
  • 27 Oct 26 0
    • Stability: unverified → 0.03 ▲ functional
    • Server version: 1.0.0 → 1.1.0 functional
  • 26 Oct 26 62

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://kiotviet.usefulapi.io/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=usefulapi.io CN=WE1,O=Google Trust Services,C=US 13 Sept 2026 12 Dec 2026 ECDSA 256 ECDSA-SHA256 d9be3287b0fde9630e825ba1f79bff3f
SANs: usefulapi.io, *.usefulapi.io
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of kiotviet.usefulapi.io. — Not signed

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
io. DS published 38690 8 Verified
usefulapi.io. No DS Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Inconclusive

We could not reach the endpoint well enough to judge its authorisation posture.

Result Inconclusive
HTTP status 302

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://kiotviet.usefulapi.io/mcp Redirected 302 https://usefulapi.io/kiotviet/
http (plaintext) http://kiotviet.usefulapi.io/mcp Inconclusive 302 http://kiotviet.usefulapi.io/mcp
MCP tools · 29 exposed · ~3,582 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
kiotviet_create_customer ~195

WRITE: create a new customer in the shop (name required; code is generated by KiotViet if omitted). Always check with the user first, and look the customer up by phone before creating a duplicate. POST /customers.

NameTypeReqDescription
addressstring–Street address.
birth_datestring–Date 2026-10-01 or date-time 2026-10-01T08:00:00 (shop local time).
codestring–Customer code (optional; KiotViet generates one).
commentsstring–Note on the customer.
contact_numberstring–Phone number.
emailstring–Email address.
group_idsarray–Customer group ids.
namestringyesCustomer name.
organizationstring–Company name.
tax_codestring–Tax code (ma so thue).

No output schema declared.

No examples provided.

kiotviet_create_order ~171

WRITE: create a sales order (an order, not an invoice: no invoice is made and no payment is recorded) with lines of existing products in a branch, for an existing customer or none. Always confirm the products, quantities and prices with the user first. POST /orders.

NameTypeReqDescription
branch_idintegeryesBranch the order is for (see kiotviet_list_branches).
customer_idinteger–Existing customer id (see kiotviet_list_customers).
descriptionstring–Note on the order.
discountnumber–Order discount amount.
itemsarrayyesThe order lines.
sale_channel_idinteger–Sales channel id.
sold_by_idinteger–Salesperson user id (see kiotviet_list_users).

No output schema declared.

No examples provided.

kiotviet_get_category ~43

One product category by id (name, parent, children). GET /categories/{id}.

NameTypeReqDescription
category_idintegeryesKiotViet category id.

No output schema declared.

No examples provided.

kiotviet_get_customer ~50

One customer by id: contact data, debt, total invoiced, reward points, groups. GET /customers/{id}.

NameTypeReqDescription
customer_idintegeryesKiotViet customer id.

No output schema declared.

No examples provided.

kiotviet_get_customer_by_code ~39

One customer by customer code. GET /customers/code/{code}.

NameTypeReqDescription
codestringyesKiotViet customer code.

No output schema declared.

No examples provided.

kiotviet_get_invoice ~44

One invoice by id with its lines, payments and delivery. GET /invoices/{id}.

NameTypeReqDescription
invoice_idintegeryesKiotViet invoice id.

No output schema declared.

No examples provided.

kiotviet_get_invoice_by_code ~46

One invoice by invoice code (for example HD000123). GET /invoices/code/{code}.

NameTypeReqDescription
codestringyesKiotViet invoice code.

No output schema declared.

No examples provided.

kiotviet_get_order ~44

One sales order by id with its lines, payments and delivery. GET /orders/{id}.

NameTypeReqDescription
order_idintegeryesKiotViet order id.

No output schema declared.

No examples provided.

kiotviet_get_order_by_code ~46

One sales order by order code (for example DH000123). GET /orders/code/{code}.

NameTypeReqDescription
codestringyesKiotViet order code.

No output schema declared.

No examples provided.

kiotviet_get_price_book ~99

The product prices of one price book (product id, code, price), paged. GET /pricebooks/{id}.

NameTypeReqDescription
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
page_sizeinteger–Records per page, 1-100 (default 20).
price_book_idintegeryesKiotViet price book id.

No output schema declared.

No examples provided.

kiotviet_get_product ~60

One product by id: code, barcode, name, category, base price, units, attributes, images, stock per branch and price books. GET /products/{id}.

NameTypeReqDescription
product_idintegeryesKiotViet product id.

No output schema declared.

No examples provided.

kiotviet_get_product_by_code ~42

One product by its product code (SKU). GET /products/code/{code}.

NameTypeReqDescription
codestringyesKiotViet product code.

No output schema declared.

No examples provided.

kiotviet_get_purchase_order ~49

One goods receipt (nhap hang) by id with its lines. GET /purchaseorders/{id}.

NameTypeReqDescription
purchase_order_idintegeryesKiotViet goods receipt id.

No output schema declared.

No examples provided.

kiotviet_get_return ~40

One customer return by id with its lines. GET /returns/{id}.

NameTypeReqDescription
return_idintegeryesKiotViet return id.

No output schema declared.

No examples provided.

kiotviet_get_supplier ~37

One supplier by id. GET /suppliers/{id}.

NameTypeReqDescription
supplier_idintegeryesKiotViet supplier id.

No output schema declared.

No examples provided.

kiotviet_list_branches ~86

List the shop's branches (id, name, code, phone, address). Use the ids to filter other tools. GET /branches.

NameTypeReqDescription
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_cashflow ~233

List cash-book entries (receipts and payments: code, branch, method, partner, amount, date, status). Filter by branch, direction or date range. GET /cashflow.

NameTypeReqDescription
branch_idsarray–Only these branches (see kiotviet_list_branches).
codestring–Voucher code.
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
end_datestring–Date 2026-10-01 or date-time 2026-10-01T08:00:00 (shop local time).
is_receiptboolean–true = receipts (money in), false = payments (money out).
page_sizeinteger–Records per page, 1-100 (default 20).
partner_namestring–Customer, supplier or other partner name.
start_datestring–Date 2026-10-01 or date-time 2026-10-01T08:00:00 (shop local time).

No output schema declared.

No examples provided.

kiotviet_list_categories ~143

List product categories (id, name, parent, whether it has children). Set hierarchical to get the category tree. GET /categories.

NameTypeReqDescription
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
hierarchicalboolean–Return the nested tree (ignores last_modified_from).
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
order_bystring–Sort field.
order_directionstring–Sort direction.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_customers ~229

List customers (code, name, phone, email, address, debt, total invoiced, reward points, groups). Contains personal data of the shop's customers. Filter by code, name, phone, group or last change. GET /customers.

NameTypeReqDescription
codestring–Customer code.
contact_numberstring–Filter by phone number.
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
group_idinteger–Only customers in this customer group.
include_customer_groupboolean–Include each customer's groups.
include_totalboolean–Include financial totals (debt, total invoiced, points).
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
namestring–Filter by customer name.
order_bystring–Sort field.
order_directionstring–Sort direction.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_invoices ~309

List sales invoices (code, date, branch, customer, total, amount paid, status, lines). Filter by branch, customer, status, order, purchase-date range or last change. GET /invoices.

NameTypeReqDescription
branch_idsarray–Only these branches (see kiotviet_list_branches).
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
customer_codestring–Only invoices of the customer with this code.
customer_idsarray–Only invoices of these customers.
from_purchase_datestring–Date 2026-10-01 or date-time 2026-10-01T08:00:00 (shop local time).
include_paymentboolean–Include the payments.
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
order_bystring–Sort field.
order_directionstring–Sort direction.
order_idinteger–Only the invoice created from this sales order.
page_sizeinteger–Records per page, 1-100 (default 20).
statusarray–KiotViet status code(s) to include.
to_purchase_datestring–Date 2026-10-01 or date-time 2026-10-01T08:00:00 (shop local time).

No output schema declared.

No examples provided.

kiotviet_list_orders ~306

List sales orders (code, date, branch, customer, total, status, lines, delivery). Filter by branch, customer, status, creation date (from) or last change (from/to). GET /orders.

NameTypeReqDescription
branch_idsarray–Only these branches (see kiotviet_list_branches).
created_datestring–Only orders created at or after this date.
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
customer_codestring–Only orders of the customer with this code.
customer_idsarray–Only orders of these customers.
include_order_deliveryboolean–Include the delivery details.
include_paymentboolean–Include the payments.
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
last_modified_tostring–Only orders last changed up to this date-time (KiotViet toDate is a bound on the modification time, not the creation time). Use with last_modified_from.
order_bystring–Sort field.
order_directionstring–Sort direction.
page_sizeinteger–Records per page, 1-100 (default 20).
sale_channel_idinteger–Only orders from this sales channel.
statusarray–KiotViet status code(s) to include.

No output schema declared.

No examples provided.

kiotviet_list_price_books ~118

List price books (bang gia: name, active flag, validity dates, branches, customer groups). GET /pricebooks.

NameTypeReqDescription
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
include_branchesboolean–Include the branches each price book applies to.
include_customer_groupsboolean–Include the customer groups each price book applies to.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_products ~248

List products (code, barcode, name, category, base price, units, attributes). Optionally include stock per branch (include_inventory) and price-book prices. Filter by name, category, branch, active flag or last change. GET /products.

NameTypeReqDescription
branch_idsarray–Only these branches (see kiotviet_list_branches).
category_idinteger–Only products in this category (see kiotviet_list_categories).
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
include_inventoryboolean–Include the stock on hand per branch.
include_pricebookboolean–Include the price-book prices.
is_activeboolean–Only active (true) or inactive (false) products.
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
namestring–Filter by product name.
order_bystring–Sort field.
order_directionstring–Sort direction.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_purchase_orders ~216

List goods receipts from suppliers (nhap hang: code, date, branch, supplier, total, lines). Filter by branch, status or purchase-date range. GET /purchaseorders.

NameTypeReqDescription
branch_idsarray–Only these branches (see kiotviet_list_branches).
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
from_purchase_datestring–Date 2026-10-01 or date-time 2026-10-01T08:00:00 (shop local time).
include_paymentboolean–Include the payments.
page_sizeinteger–Records per page, 1-100 (default 20).
statusarray–KiotViet status code(s) to include.
to_purchase_datestring–Date 2026-10-01 or date-time 2026-10-01T08:00:00 (shop local time).

No output schema declared.

No examples provided.

kiotviet_list_returns ~133

List customer returns (code, date, branch, customer, invoice, return total, lines). GET /returns.

NameTypeReqDescription
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
include_paymentboolean–Include the payments.
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
order_bystring–Sort field.
order_directionstring–Sort direction.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_stock ~142

Stock on hand and reserved quantity per product and branch. Filter by branch or last change. GET /productOnHands.

NameTypeReqDescription
branch_idsarray–Only these branches (see kiotviet_list_branches).
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
order_bystring–Sort field.
order_directionstring–Sort direction.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_supplier_orders ~161

List orders placed with suppliers (dat hang nhap: code, date, branch, supplier, status, lines, amount paid). Filter by branch, status, supplier or product text. GET /ordersuppliers.

NameTypeReqDescription
branch_idinteger–Only this branch.
code_keystring–Order code.
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
page_sizeinteger–Records per page, 1-100 (default 20).
product_keystring–Product code or name.
statusinteger–KiotViet status code.
supplier_keystring–Supplier code, name or phone.

No output schema declared.

No examples provided.

kiotviet_list_suppliers ~175

List suppliers (code, name, phone, email, address, debt, total invoiced). Filter by code, name, phone or last change. GET /suppliers.

NameTypeReqDescription
codestring–Supplier code.
contact_numberstring–Filter by phone number.
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
include_totalboolean–Include financial totals (debt, total invoiced).
last_modified_fromstring–Only records changed at or after this date-time (shop local time).
namestring–Filter by supplier name.
order_directionstring–Sort direction.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

kiotviet_list_users ~78

List the shop's staff users (id, username, name, phone, email). GET /users.

NameTypeReqDescription
current_iteminteger–Record offset to start from (0 = first record). Pass the previous reply's next_item.
page_sizeinteger–Records per page, 1-100 (default 20).

No output schema declared.

No examples provided.

Install

How do I install the KiotViet MCP by usefulapi server?

KiotViet MCP by usefulapi is a hosted endpoint at https://kiotviet.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · kiotviet.usefulapi.io

# add to Claude Code
claude mcp add --transport http io-usefulapi-kiotviet 'https://kiotviet.usefulapi.io/mcp'
Common questions

What is the KiotViet MCP by usefulapi server?

KiotViet MCP by usefulapi is listed in the public MCP registry as io.usefulapi/kiotviet. Read KiotViet products, customers, invoices, orders and stock; create customers and orders. This page covers its hosted endpoint (https://kiotviet.usefulapi.io/mcp).

Is the KiotViet MCP by usefulapi server safe to use?

KiotViet MCP by usefulapi scores 18 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the KiotViet MCP by usefulapi server expose?

KiotViet MCP by usefulapi exposes 29 tools: kiotviet_list_products, kiotviet_get_product, kiotviet_get_product_by_code, kiotviet_list_categories, kiotviet_get_category, and 24 more. Their descriptions and schemas cost roughly 3,582 tokens of context every time the server is loaded.

Does the KiotViet MCP by usefulapi server require authentication?

Its publisher declares no required credentials for KiotViet MCP by usefulapi. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

Is the KiotViet MCP by usefulapi server still maintained?

KiotViet MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the KiotViet MCP by usefulapi server?

VerifyMCP ran 4 checks on KiotViet MCP by usefulapi, covering TLS certificate, HSTS header, DNSSEC and Transport. 7 items could not be completed, a gap on our side rather than a finding about KiotViet MCP by usefulapi: Authorization, HTTPS, Schema quality, Stability and 3 more. 5 categories score 0 for that reason, because we only credit what we can confirm. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.