Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.theluckystrike/purchase-order

MCPB · BILLING-DOCS.MCPB · 2 COMPONENTS · SCANNED SEP 30

Purchase orders for suppliers: VAT line items, a delivery date, an A4 PDF, mark received.

0 this week 48 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security22
  • No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
  • Known CVEs were checked across the 153 of 153 dependencies we could resolve, so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • 63 of 153 dependencies flagged as unhealthy (2 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability86
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 1787 tokens (~105/item across 17 items; 16 tools + 1 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "credit_note_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

How do I install the io.github.theluckystrike/purchase-order MCP server?

io.github.theluckystrike/purchase-order ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. The MCP registry declares no SHA-256 for this bundle, so there is no published digest to check the download against.

mcpb · billing-docs.mcpb

Download bundle

The MCP registry declares no SHA-256 for this bundle, so there is no published digest to check it against. Open it with an MCPB-capable host such as Claude Desktop.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 23 Sept 26 48

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 30 Sept 2026 · Analysed mcpb/https://github.com/theluckystrike/mcp-servers/releases/download/v0.22.0/billing-docs.mcpb@0.22.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem mcpb
Reason No attestation published

Background: How many MCP packages publish verified provenance →

Dependencies 153 packages
Packages resolved 153
Deprecated 2
Stale 63
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 16 exposed · ~1,766 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
billing_docs_report ~86

Over a date range: what was credited back per currency and against how many invoices, what is still on order per currency, and every open order past its delivery date with days late. Pro; the list tools are free.

NameTypeReqDescription
fromstring–YYYY-MM-DD, earliest document date to count
tostring–YYYY-MM-DD, latest document date to count

No output schema declared.

No examples provided.

credit_note_create ~209

Credit one invoice: the whole invoice, a GROSS amount_minor split over its VAT rates, or named lines. Amounts store negative, reusing the invoice's own rates. Free: 5 a month. Send it with credit_note_text.

NameTypeReqDescription
amount_minorinteger–Credit this GROSS amount, VAT included, in minor units. Split across the invoice's VAT rates in proportion to each rate's share of the total
invoicestringyesThe invoice number to credit, e.g. INV-2026-0001
issue_datestring–YYYY-MM-DD, defaults to today in your business profile's timezone
linesarray–Credit only these invoice lines. Leave out with amount_minor for a full credit note
notesstring–Free text printed under the totals
reasonstringyesWhy the money is being given back, e.g. "returned goods" or "billed twice". Printed on the document

No output schema declared.

No examples provided.

credit_note_delete ~76

Remove one credit note never posted to its invoice and never rendered, freeing that month's slot; the invoice becomes creditable again. One with a dependent is refused: issue a fresh note to reverse a sent one.

NameTypeReqDescription
idstringyesCredit note id such as CN-2026-0001, or an exact client name

No output schema declared.

No examples provided.

credit_note_get ~81

Return one credit note in full by id or exact client name: every negated line, VAT lines, totals, the reason, and the invoice number and date it reverses. Reads only. Use credit_note_list for the ids.

NameTypeReqDescription
idstringyesCredit note id such as CN-2026-0001, or an exact client name

No output schema declared.

No examples provided.

credit_note_list ~109

List credit notes newest first: id, invoice, client, basis, reason, currency and the NEGATIVE total, with the amount credited per currency. Filter by invoice, client or issue date range.

NameTypeReqDescription
clientstring–Only credit notes for clients whose name contains this text
fromstring–YYYY-MM-DD, earliest issue date
invoicestring–Only credit notes issued against this invoice number
tostring–YYYY-MM-DD, latest issue date

No output schema declared.

No examples provided.

credit_note_pdf ~98

Call this tool to write one credit note as an A4 PDF and return the path: the invoice layout titled CREDIT NOTE, with the invoice it reverses and the reason at the foot. Pro; credit_note_text is free.

NameTypeReqDescription
idstringyesCredit note id such as CN-2026-0001
out_pathstring–Where to write the file. Defaults to the billing-docs data directory under pdf/

No output schema declared.

No examples provided.

credit_note_text ~112

Turn a credit note into a plain-text summary to paste into an email: the negated line table, VAT lines, total, reason, and what now comes off the invoice. Free; credit_note_pdf writes the A4 document.

NameTypeReqDescription
greetingstring–Opening line, default "Hello" plus the client name
idstringyesCredit note id such as CN-2026-0001
sign_offstring–Closing line, default your business name from the shared profile

No output schema declared.

No examples provided.

license_activate ~71

Activate a Pro key (MCPL1.xxx.yyy) from checkout: verified offline against a built-in public key, saved to your config file. A wrong, malformed or expired key is refused, unsaved. license_status reads it back.

NameTypeReqDescription
keystringyesLicense key from the checkout confirmation page

No output schema declared.

No examples provided.

license_status ~54

Report this server's licence state: product, tier free or pro, licence id, expiry, the key source and the upgrade URL. No arguments, no network. Explains a free-tier refusal; license_activate installs a key.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

purchase_order_create ~271

Raise a purchase order to a supplier from items and return its PO number and totals. unit_price is in MAJOR units; currency, VAT and the buyer block come from the shared profile. Free: 5 documents a calendar month.

NameTypeReqDescription
currencystring–Defaults to your business default currency
discount_percentnumber–Discount applied to every line, in percent
expected_delivery_datestring–YYYY-MM-DD, when the goods or work are due
issue_datestring–YYYY-MM-DD, defaults to today in your business profile's timezone
itemsarrayyesWhat is being ordered
notesstring–Free text printed under the totals, e.g. delivery address or terms
supplierstringyesSupplier name or client id. A name the invoice server already knows brings its address, email and VAT id onto the order
supplier_addressstring–Postal address for the SUPPLIER block, newlines allowed
supplier_emailstring–Only if the user gave it; otherwise the stored client's email is used
supplier_vat_idstring–Supplier VAT / tax registration id
tax_ratenumber–VAT percent for lines with no rate of their own. Defaults to the business default

No output schema declared.

No examples provided.

purchase_order_delete ~74

Remove one purchase order with nothing received and never rendered, freeing that month's slot. One with a receipt is refused, naming it. The PO number is never reissued. purchase_order_receive logs arrivals.

NameTypeReqDescription
idstringyesPurchase order id such as PO-2026-0001, or an exact supplier name

No output schema declared.

No examples provided.

purchase_order_get ~76

Return one purchase order in full by id or exact supplier name: buyer and supplier blocks, every line with unit price and VAT, totals, the delivery date, status and every receipt with its date and note.

NameTypeReqDescription
idstringyesPurchase order id such as PO-2026-0001, or an exact supplier name

No output schema declared.

No examples provided.

purchase_order_list ~103

List purchase orders newest first: id, supplier, order and expected delivery dates, status open, partially_received or received, currency, total and received date. Filter by status, supplier or date range.

NameTypeReqDescription
fromstring–YYYY-MM-DD, earliest order date
statusstring–Default "all"
supplierstring–Only orders to suppliers whose name contains this text
tostring–YYYY-MM-DD, latest order date

No output schema declared.

No examples provided.

purchase_order_pdf ~94

Call this tool to write one purchase order as an A4 PDF and return the path: the invoice layout titled PURCHASE ORDER, with the buyer, supplier and delivery date. Pro; purchase_order_text is free.

NameTypeReqDescription
idstringyesPurchase order id such as PO-2026-0001
out_pathstring–Where to write the file. Defaults to the billing-docs data directory under pdf/

No output schema declared.

No examples provided.

purchase_order_receive ~141

Record that an order arrived. partial keeps it open and can be repeated, each receipt kept with its date and note; a full receipt closes it. An order already received, or a date before the order date, is refused.

NameTypeReqDescription
datestring–YYYY-MM-DD, defaults to today
idstringyesPurchase order id such as PO-2026-0001
notestring–What arrived, e.g. "8 of 10 units, 2 back-ordered"
partialboolean–True when only some of the order arrived. The order stays open and can be received again. Default false

No output schema declared.

No examples provided.

purchase_order_text ~111

Turn a purchase order into a plain-text order to paste into an email: the line table, VAT lines, total, and a line asking the supplier to deliver by the date and quote the PO number. Free on every tier.

NameTypeReqDescription
greetingstring–Opening line, default "Hello" plus the supplier name
idstringyesPurchase order id such as PO-2026-0001
sign_offstring–Closing line, default your business name from the shared profile

No output schema declared.

No examples provided.

Common questions

What is the io.github.theluckystrike/purchase-order MCP server?

io.github.theluckystrike/purchase-order is an MCP server listed in the public MCP registry as io.github.theluckystrike/purchase-order. Purchase orders for suppliers: VAT line items, a delivery date, an A4 PDF, mark received. This page covers its MCPB bundle (https://github.com/theluckystrike/mcp-servers/releases/download/v0.22.0/billing-docs.mcpb).

Is the io.github.theluckystrike/purchase-order MCP server safe to use?

io.github.theluckystrike/purchase-order scores 48 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.theluckystrike/purchase-order MCP server expose?

io.github.theluckystrike/purchase-order exposes 16 tools: credit_note_create, credit_note_list, credit_note_get, credit_note_pdf, credit_note_text, and 11 more. Their descriptions and schemas cost roughly 1,766 tokens of context every time the server is loaded.

What licence is the io.github.theluckystrike/purchase-order MCP server under?

io.github.theluckystrike/purchase-order declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.