FatturaPA / SDI
PYPI · FATTURAPA-MCP-SERVER · SCANNED OCT 4
Italian e-invoicing (FatturaPA/SDI): parse invoices, detect anomalies, VAT checks via VIES, reports.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 0 of 29 dependencies flagged as unhealthy. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 2 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1711 tokens (~213/item across 8 items; 7 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
How do I install the FatturaPA / SDI MCP server?
FatturaPA / SDI runs locally as a PyPI package, launched with uvx fatturapa-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · fatturapa-mcp-server
claude mcp add mauriziolisanti-fatturapa-mcp-server -- uvx fatturapa-mcp-server
{
"mcpServers": {
"mauriziolisanti-fatturapa-mcp-server": {
"command": "uvx",
"args": [
"fatturapa-mcp-server"
]
}
}
} {
"servers": {
"mauriziolisanti-fatturapa-mcp-server": {
"command": "uvx",
"args": [
"fatturapa-mcp-server"
]
}
}
} codex mcp add mauriziolisanti-fatturapa-mcp-server -- uvx fatturapa-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mauriziolisanti-fatturapa-mcp-server": {
"type": "local",
"command": [
"uvx",
"fatturapa-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add mauriziolisanti-fatturapa-mcp-server --command uvx --arg fatturapa-mcp-server
mcp_servers:
mauriziolisanti-fatturapa-mcp-server:
command: "uvx"
args: ["fatturapa-mcp-server"] {
"McpServers": {
"mauriziolisanti-fatturapa-mcp-server": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"fatturapa-mcp-server"
]
}
}
} assistant mcp add mauriziolisanti-fatturapa-mcp-server -t stdio -c uvx -a fatturapa-mcp-server
{
"mcpServers": {
"mauriziolisanti-fatturapa-mcp-server": {
"command": "uvx",
"args": [
"fatturapa-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 3 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- 1 Oct 26 69
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Analysed pypi/fatturapa-mcp-server@0.3.2
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 29 packages
| Packages resolved | 29 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_piva ~156
Validate an Italian VAT number using the official MEF checksum algorithm. Performs format validation and the Ministry of Economy checksum algorithm. No network call — fully local computation. Args: piva: Italian VAT number string. May include or omit the "IT" prefix. Expected: 11 digits after stripping prefix and whitespace. ctx: Optional MCP context for structured log emission. Returns: A CheckPivaResult with keys: valid (bool): Whether the P.IVA passes format and checksum checks. piva (str): Normalised P.IVA (11 digits, no prefix). reason (str | None): Failure reason if valid is False, else None.
| Name | Type | Req | Description |
|---|---|---|---|
| piva | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| piva | string | yes | – |
| reason | – | yes | – |
| valid | boolean | yes | – |
No examples provided.
extract_invoice_data ~260
Extract key fields from a validated FatturaPA XML document. Parses the header and first body section to return structured invoice metadata. Never logs or persists XML content — only derived values are returned. Missing fields yield None rather than raising KeyError. When *file_path* is given the document is read from disk; the path is checked against the roots configured in ``FATTURAPA_ALLOWED_ROOTS`` before any read is attempted. Pass *xml_content* directly to skip file I/O. Args: xml_content: Raw XML string of a validated FatturaPA document. ctx: Optional MCP context for structured log emission. file_path: Optional filesystem path to read the document from. Checked against allowed roots before reading. Returns: An ExtractResult TypedDict with supplier, customer, invoice header fields, and aggregated line_items from all body sections. Raises: PermissionError: If *file_path* is outside the configured allowed roots. ValueError: If neither *xml_content* nor *file_path* is provided. lxml.etree.XMLSyntaxError: If the XML is not well-formed.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | – | – | – |
| xml_content | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| currency | – | yes | – |
| customer_name | – | yes | – |
| customer_piva | – | yes | – |
| customer_tax_code | – | yes | – |
| document_type | – | yes | – |
| invoice_date | – | yes | – |
| invoice_number | – | yes | – |
| line_items | array | yes | – |
| supplier_name | – | yes | – |
| supplier_piva | – | yes | – |
| supplier_tax_code | – | yes | – |
| total_amount | – | yes | – |
No examples provided.
find_invoice_anomalies ~320
Detect inconsistencies and anomalies in a FatturaPA XML document. Checks eight anomaly categories: document total mismatch, VAT calculation error, future invoice date, invalid Italian P.IVA checksum, missing or suspicious destination code, incomplete line items, unjustified negative amount, and missing payment data. Never logs or persists XML content. When *file_path* is given the document is read from disk; the path is checked against the roots configured in ``FATTURAPA_ALLOWED_ROOTS`` before any read is attempted. Pass *xml_content* directly to skip file I/O. Args: xml_content: Raw XML string of the FatturaPA document. ctx: Optional MCP context for structured log emission. file_path: Optional filesystem path to read the document from. Checked against allowed roots before reading. Returns: A FindAnomaliesResult with keys: anomalies_found (int): Total number of anomalies detected. anomalies (list): All anomaly records. warnings (list): Only warning-severity anomalies. errors (list): Only error-severity anomalies. is_clean (bool): True when no anomalies are found. Raises: PermissionError: If *file_path* is outside the configured allowed roots. ValueError: If neither *xml_content* nor *file_path* is provided. lxml.etree.XMLSyntaxError: If the XML is not well-formed.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | – | – | – |
| xml_content | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| anomalies | array | yes | – |
| anomalies_found | integer | yes | – |
| errors | array | yes | – |
| is_clean | boolean | yes | – |
| warnings | array | yes | – |
No examples provided.
generate_invoice_report ~204
Aggregate a batch of FatturaPA XML documents into a structured report. Processes each invoice through extract_invoice_data and find_invoice_anomalies, then aggregates the results into totals, supplier/customer breakdowns, and an anomaly summary. Documents that cannot be parsed are counted separately in the *errors* list; they do not affect the monetary totals. Never logs or persists XML content. Progress notifications: one step per invoice (1..N), then a final step (N+1) for the aggregation phase. Args: xml_contents: List of raw FatturaPA XML strings to process. title: Optional report title; defaults to ``"Invoice Report"``. ctx: Optional MCP context for structured log emission. Returns: An InvoiceReportResult TypedDict with aggregated statistics, party breakdowns (suppliers/customers), and an anomaly summary.
| Name | Type | Req | Description |
|---|---|---|---|
| title | – | – | – |
| xml_contents | array | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| anomalies_summary | – | yes | – |
| currency | string | yes | – |
| customers | array | yes | – |
| errors | array | yes | – |
| generated_at | string | yes | – |
| invalid_invoices | integer | yes | – |
| suppliers | array | yes | – |
| title | string | yes | – |
| total_amount | number | yes | – |
| total_invoices | integer | yes | – |
| total_vat | number | yes | – |
| valid_invoices | integer | yes | – |
No examples provided.
lookup_sdi_error ~162
Look up an SDI error code and return its human-readable description. Uses a local static table of official AdE error codes. No network call required. Args: error_code: SDI error code string (e.g., "00001", "00002"). ctx: Optional MCP context for structured log emission. Returns: A LookupResult with keys: code (str): The queried error code. description (str): Official Italian description. category (str): Error category (e.g., "STRUTTURA", "CONTENUTO"). resolution (str): Suggested resolution hint. Raises: ValueError: If *error_code* is not found in the known error table.
| Name | Type | Req | Description |
|---|---|---|---|
| error_code | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | yes | – |
| code | string | yes | – |
| description | string | yes | – |
| resolution | string | yes | – |
No examples provided.
validate_invoice ~266
Validate a FatturaPA XML document against the appropriate XSD schema. Auto-detects schema version (v1.2 or v1.3) from the XML namespace. Returns a structured result without logging any XML content. When *file_path* is given the document is read from disk; the path is checked against the roots configured in ``FATTURAPA_ALLOWED_ROOTS`` before any read is attempted. Pass *xml_content* directly to skip file I/O. Args: xml_content: Raw XML string of the FatturaPA document. ctx: Optional MCP context for structured log emission. file_path: Optional filesystem path to read the document from. Checked against allowed roots before reading. Returns: A ValidateResult with keys: valid (bool): Whether the document passed XSD validation. version (str): Detected schema version ("1.2", "1.3", or "unknown"). errors (list[str]): Validation error messages, empty if valid. Raises: PermissionError: If *file_path* is outside the configured allowed roots. ValueError: If neither *xml_content* nor *file_path* is provided.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | – | – | – |
| xml_content | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| errors | array | yes | – |
| valid | boolean | yes | – |
| version | string | yes | – |
No examples provided.
verify_piva_vies ~223
Verify a VAT number against the EU VIES (VAT Information Exchange System). Calls the official EU VIES REST endpoint with a configurable timeout. On timeout or service unavailability, returns a degraded response with source="unavailable" rather than raising — the caller must handle this case. Args: country_code: Two-letter ISO 3166-1 alpha-2 country code (e.g., "IT"). vat_number: VAT number without the country prefix (e.g., "12345678901"). ctx: Optional MCP context for structured log emission. Returns: A VerifyPivaViesResult with keys: valid (bool): Whether VIES confirmed the VAT number as active. name (str | None): Registered business name, if disclosed by VIES. address (str | None): Registered address, if disclosed by VIES. source (str): "vies" if live response, "unavailable" if service down.
| Name | Type | Req | Description |
|---|---|---|---|
| country_code | string | yes | – |
| vat_number | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| address | – | yes | – |
| name | – | yes | – |
| source | string | yes | – |
| valid | boolean | yes | – |
No examples provided.
What is the FatturaPA / SDI MCP server?
FatturaPA / SDI is an MCP server listed in the public MCP registry as io.github.MaurizioLisanti/fatturapa-mcp-server. Italian e-invoicing (FatturaPA/SDI): parse invoices, detect anomalies, VAT checks via VIES, reports. This page covers its PyPI package (fatturapa-mcp-server).
Is the FatturaPA / SDI MCP server safe to use?
FatturaPA / SDI scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 October 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the FatturaPA / SDI MCP server expose?
FatturaPA / SDI exposes 7 tools: validate_invoice, extract_invoice_data, lookup_sdi_error, check_piva, verify_piva_vies, and 2 more. Their descriptions and schemas cost roughly 1,591 tokens of context every time the server is loaded.
Is the FatturaPA / SDI MCP server still maintained?
FatturaPA / SDI is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the FatturaPA / SDI MCP server under?
FatturaPA / SDI declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.