# FatturaPA / SDI (pypi · fatturapa-mcp-server)

Italian e-invoicing (FatturaPA/SDI): parse invoices, detect anomalies, VAT checks via VIES, reports.

- Trust score: 69/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-04

## Components

- pypi · `fatturapa-mcp-server`: 69/100 (this document), [markdown](https://verifymcp.io/servers/mauriziolisanti-fatturapa-mcp-server/fatturapa-mcp-server.md), [page](https://verifymcp.io/servers/mauriziolisanti-fatturapa-mcp-server/fatturapa-mcp-server)

## Channel facts

- Registry: `pypi`
- Package: `fatturapa-mcp-server`
- Version: `0.3.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-04.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 0 of 29 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 80/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1711 tokens (~213/item across 8 items; 7 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 71/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the FatturaPA / SDI MCP server?

FatturaPA / SDI runs locally as a PyPI package, launched with uvx fatturapa-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add mauriziolisanti-fatturapa-mcp-server -- uvx fatturapa-mcp-server
```

### Cursor

```json
{
  "mcpServers": {
    "mauriziolisanti-fatturapa-mcp-server": {
      "command": "uvx",
      "args": [
        "fatturapa-mcp-server"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "mauriziolisanti-fatturapa-mcp-server": {
      "command": "uvx",
      "args": [
        "fatturapa-mcp-server"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add mauriziolisanti-fatturapa-mcp-server -- uvx fatturapa-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mauriziolisanti-fatturapa-mcp-server": {
      "type": "local",
      "command": [
        "uvx",
        "fatturapa-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mauriziolisanti-fatturapa-mcp-server --command uvx --arg fatturapa-mcp-server
```

### Hermes

```yaml
mcp_servers:
  mauriziolisanti-fatturapa-mcp-server:
    command: "uvx"
    args: ["fatturapa-mcp-server"]
```

### Netclaw

```json
{
  "McpServers": {
    "mauriziolisanti-fatturapa-mcp-server": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "fatturapa-mcp-server"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add mauriziolisanti-fatturapa-mcp-server -t stdio -c uvx -a fatturapa-mcp-server
```

### Other

```json
{
  "mcpServers": {
    "mauriziolisanti-fatturapa-mcp-server": {
      "command": "uvx",
      "args": [
        "fatturapa-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-04 (score 69, 0)

- [functional regression] Security disclosure: unverified → fail

### 2026-10-03 (score 69, 0)

- [functional regression] Security disclosure: fail → unverified

### 2026-10-01 (score 69)

First indexed and scored.

## MCP tools (7)

### `validate_invoice` (~266 tokens)

Validate a FatturaPA XML document against the appropriate XSD schema.

Auto-detects schema version (v1.2 or v1.3) from the XML namespace.
Returns a structured result without logging any XML content.

When *file_path* is given the document is read from disk; the path is
checked against the roots configured in ``FATTURAPA_ALLOWED_ROOTS`` before
any read is attempted.  Pass *xml_content* directly to skip file I/O.

Args:
    xml_content: Raw XML string of the FatturaPA document.
    ctx: Optional MCP context for structured log emission.
    file_path: Optional filesystem path to read the document from.
        Checked against allowed roots before reading.

Returns:
    A ValidateResult with keys:
        valid (bool): Whether the document passed XSD validation.
        version (str): Detected schema version ("1.2", "1.3", or "unknown").
        errors (list[str]): Validation error messages, empty if valid.

Raises:
    PermissionError: If *file_path* is outside the configured allowed roots.
    ValueError: If neither *xml_content* nor *file_path* is provided.

Input parameters:

- `file_path`
- `xml_content` (string)

Output parameters:

- `errors` (array)
- `valid` (boolean)
- `version` (string)

### `extract_invoice_data` (~260 tokens)

Extract key fields from a validated FatturaPA XML document.

Parses the header and first body section to return structured invoice
metadata. Never logs or persists XML content — only derived values are
returned. Missing fields yield None rather than raising KeyError.

When *file_path* is given the document is read from disk; the path is
checked against the roots configured in ``FATTURAPA_ALLOWED_ROOTS`` before
any read is attempted.  Pass *xml_content* directly to skip file I/O.

Args:
    xml_content: Raw XML string of a validated FatturaPA document.
    ctx: Optional MCP context for structured log emission.
    file_path: Optional filesystem path to read the document from.
        Checked against allowed roots before reading.

Returns:
    An ExtractResult TypedDict with supplier, customer, invoice header
    fields, and aggregated line_items from all body sections.

Raises:
    PermissionError: If *file_path* is outside the configured allowed roots.
    ValueError: If neither *xml_content* nor *file_path* is provided.
    lxml.etree.XMLSyntaxError: If the XML is not well-formed.

Input parameters:

- `file_path`
- `xml_content` (string)

Output parameters:

- `currency`
- `customer_name`
- `customer_piva`
- `customer_tax_code`
- `document_type`
- `invoice_date`
- `invoice_number`
- `line_items` (array)
- `supplier_name`
- `supplier_piva`
- `supplier_tax_code`
- `total_amount`

### `lookup_sdi_error` (~162 tokens)

Look up an SDI error code and return its human-readable description.

Uses a local static table of official AdE error codes.
No network call required.

Args:
    error_code: SDI error code string (e.g., "00001", "00002").
    ctx: Optional MCP context for structured log emission.

Returns:
    A LookupResult with keys:
        code (str): The queried error code.
        description (str): Official Italian description.
        category (str): Error category (e.g., "STRUTTURA", "CONTENUTO").
        resolution (str): Suggested resolution hint.

Raises:
    ValueError: If *error_code* is not found in the known error table.

Input parameters:

- `error_code` (string, required)

Output parameters:

- `category` (string)
- `code` (string)
- `description` (string)
- `resolution` (string)

### `check_piva` (~156 tokens)

Validate an Italian VAT number using the official MEF checksum algorithm.

Performs format validation and the Ministry of Economy checksum algorithm.
No network call — fully local computation.

Args:
    piva: Italian VAT number string. May include or omit the "IT" prefix.
          Expected: 11 digits after stripping prefix and whitespace.
    ctx: Optional MCP context for structured log emission.

Returns:
    A CheckPivaResult with keys:
        valid (bool): Whether the P.IVA passes format and checksum checks.
        piva (str): Normalised P.IVA (11 digits, no prefix).
        reason (str | None): Failure reason if valid is False, else None.

Input parameters:

- `piva` (string, required)

Output parameters:

- `piva` (string)
- `reason`
- `valid` (boolean)

### `verify_piva_vies` (~223 tokens)

Verify a VAT number against the EU VIES (VAT Information Exchange System).

Calls the official EU VIES REST endpoint with a configurable timeout.
On timeout or service unavailability, returns a degraded response with
source="unavailable" rather than raising — the caller must handle this case.

Args:
    country_code: Two-letter ISO 3166-1 alpha-2 country code (e.g., "IT").
    vat_number: VAT number without the country prefix (e.g., "12345678901").
    ctx: Optional MCP context for structured log emission.

Returns:
    A VerifyPivaViesResult with keys:
        valid (bool): Whether VIES confirmed the VAT number as active.
        name (str | None): Registered business name, if disclosed by VIES.
        address (str | None): Registered address, if disclosed by VIES.
        source (str): "vies" if live response, "unavailable" if service down.

Input parameters:

- `country_code` (string, required)
- `vat_number` (string, required)

Output parameters:

- `address`
- `name`
- `source` (string)
- `valid` (boolean)

### `find_invoice_anomalies` (~320 tokens)

Detect inconsistencies and anomalies in a FatturaPA XML document.

Checks eight anomaly categories: document total mismatch, VAT calculation
error, future invoice date, invalid Italian P.IVA checksum, missing or
suspicious destination code, incomplete line items, unjustified negative
amount, and missing payment data.  Never logs or persists XML content.

When *file_path* is given the document is read from disk; the path is
checked against the roots configured in ``FATTURAPA_ALLOWED_ROOTS`` before
any read is attempted.  Pass *xml_content* directly to skip file I/O.

Args:
    xml_content: Raw XML string of the FatturaPA document.
    ctx: Optional MCP context for structured log emission.
    file_path: Optional filesystem path to read the document from.
        Checked against allowed roots before reading.

Returns:
    A FindAnomaliesResult with keys:
        anomalies_found (int): Total number of anomalies detected.
        anomalies (list): All anomaly records.
        warnings (list): Only warning-severity anomalies.
        errors (list): Only error-severity anomalies.
        is_clean (bool): True when no anomalies are found.

Raises:
    PermissionError: If *file_path* is outside the configured allowed roots.
    ValueError: If neither *xml_content* nor *file_path* is provided.
    lxml.etree.XMLSyntaxError: If the XML is not well-formed.

Input parameters:

- `file_path`
- `xml_content` (string)

Output parameters:

- `anomalies` (array)
- `anomalies_found` (integer)
- `errors` (array)
- `is_clean` (boolean)
- `warnings` (array)

### `generate_invoice_report` (~204 tokens)

Aggregate a batch of FatturaPA XML documents into a structured report.

Processes each invoice through extract_invoice_data and
find_invoice_anomalies, then aggregates the results into totals,
supplier/customer breakdowns, and an anomaly summary.  Documents that
cannot be parsed are counted separately in the *errors* list; they do not
affect the monetary totals.  Never logs or persists XML content.

Progress notifications: one step per invoice (1..N), then a final step
(N+1) for the aggregation phase.

Args:
    xml_contents: List of raw FatturaPA XML strings to process.
    title: Optional report title; defaults to ``"Invoice Report"``.
    ctx: Optional MCP context for structured log emission.

Returns:
    An InvoiceReportResult TypedDict with aggregated statistics, party
    breakdowns (suppliers/customers), and an anomaly summary.

Input parameters:

- `title`
- `xml_contents` (array, required)

Output parameters:

- `anomalies_summary`
- `currency` (string)
- `customers` (array)
- `errors` (array)
- `generated_at` (string)
- `invalid_invoices` (integer)
- `suppliers` (array)
- `title` (string)
- `total_amount` (number)
- `total_invoices` (integer)
- `total_vat` (number)
- `valid_invoices` (integer)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/mauriziolisanti-fatturapa-mcp-server/fatturapa-mcp-server#diagnostics

## Score history

- 2026-10-04: 69
- 2026-10-03: 69
- 2026-10-02: 69
- 2026-10-01: 69

## Common questions

### What is the FatturaPA / SDI MCP server?

FatturaPA / SDI is an MCP server listed in the public MCP registry as io.github.MaurizioLisanti/fatturapa-mcp-server. Italian e-invoicing (FatturaPA/SDI): parse invoices, detect anomalies, VAT checks via VIES, reports. This page covers its PyPI package (fatturapa-mcp-server).

### Is the FatturaPA / SDI MCP server safe to use?

FatturaPA / SDI scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 4 October 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the FatturaPA / SDI MCP server expose?

FatturaPA / SDI exposes 7 tools: validate_invoice, extract_invoice_data, lookup_sdi_error, check_piva, verify_piva_vies, and 2 more. Their descriptions and schemas cost roughly 1,591 tokens of context every time the server is loaded.

### Is the FatturaPA / SDI MCP server still maintained?

FatturaPA / SDI is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the FatturaPA / SDI MCP server under?

FatturaPA / SDI declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/fatturapa-mcp-server/
- Socket report: https://socket.dev/pypi/package/fatturapa-mcp-server
- Repository: https://github.com/MaurizioLisanti/fatturapa-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/mauriziolisanti-fatturapa-mcp-server/fatturapa-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/mauriziolisanti-fatturapa-mcp-server/fatturapa-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/mauriziolisanti-fatturapa-mcp-server/fatturapa-mcp-server