Conecto Invoices
chat.conecto/invoicesconecto.chatstreamable-httpv1.0.0Scanned
Quotes and invoices numbered without gaps, sent as PDFs, paid online. Pay per action.
52 tools: 4 can delete or cancel things, 8 do something that can't be undone, 25 change things and 15 only read.
- Reads private data · 9
- Reads text others write · 11
- Can send data out · 10
- 6 findings
Anlyon alternative
37 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
52 tools
Deletes or cancels 4Claude Code: deny
account_erase_personErases one person across every area when they ask (GDPR Art.No findings
Why it is in this group
- The name "account_erase_person" says "erase": a word for removing or ending something.
- The description says "Can't be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Erases one person across every area when they ask (GDPR Art. 17), once you know it is them (they wrote from that address, or confirmed it). Their CRM contact, chat visitor, past meetings and calls are anonymised, so deals stay without them, and a meeting they were only a guest at drops them; their chats, CRM history, form and routing form answers, job applications with the CV, newsletter subscriptions and events are deleted, and the call log's contents that name them are cleared. Kept, each with its reason in the result: accounting records, employment records, signed documents, the audit log, the account's own settings, upcoming meetings, and emails and tickets (outreach emails and replies too) unless correspondence is true. Their address goes on the suppression lists, so it is never mailed again: outreach campaigns stop for them at once. Can't be undone; the owner is emailed. A key of a team other than the company-wide one gets owner_required: pass the request to the owner. Free. Free.
Annotations the server declares
- title: Erase a person's data
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
account_refund_topupRefund a top-up paid in the last 24 hours that none of has been used yet: its credit, with the first top-up's bonus, leaves the balance, and the card gets the credit back with its …No findings
Why it is in this group
- The name "account_refund_topup" says "refund": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Refund a top-up paid in the last 24 hours that none of has been used yet: its credit, with the first top-up's bonus, leaves the balance, and the card gets the credit back with its tax. The service fee is kept. Without topup_id, the newest top-up (GET /v1/topups lists them with their ids). Free. Free.
Annotations the server declares
- title: Refund a top-up
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
invoices_delete_repeatingStop a repeating invoice for good.No findings
Why it is in this group
- The name "invoices_delete_repeating" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Stop a repeating invoice for good. The invoices it made stay as they are. Free.
Annotations the server declares
- title: Stop a repeating invoice
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
invoices_voidVoid a document.No findings
Why it is in this group
- The name "invoices_void" says "void": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Void a document. A sent one keeps its number (numbers stay gapless) but can no longer be paid, accepted or viewed; a draft is simply discarded. Refused while payments are recorded on it, on an invoice with credit notes and on a credit note (correct those with another credit note or a new invoice), and on an invoice that may be in the customer's hands (emailed, opened, or its PDF downloaded through a link): that one is cancelled with a credit note for all of it, as the law asks. An invoice posted to the books is reversed there. Costs $0.01 per call; nothing if it fails.
Annotations the server declares
- title: Void a quote or invoice
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
Can't be undone 8Claude Code: ask
account_emit_eventSend an event you name, custom.<name> (custom.lead_qualified, custom.order_shipped), to every channel subscribed to it (notify_subscribe with "custom.*" or its name: Slack, Teams, …Can send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- outboundThe description's first verb is "send": it sends or publishes something to other people.
Description, as the server wrote it Send an event you name, custom.<name> (custom.lead_qualified, custom.order_shipped), to every channel subscribed to it (notify_subscribe with "custom.*" or its name: Slack, Teams, a webhook to Zapier, Make, n8n or the business's own systems) and to account_events, where another team's bot can pick it up. data is any JSON object (up to 10 KB); sent_by is added with this bot's name and team. $0.005 for each channel it goes to; free when no channel is subscribed. Costs $0.005 per channel it goes to; nothing if none are found.
Annotations the server declares
- title: Send an event of your own
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_create_credit_noteIssue a credit note against a sent invoice: all of it, some of its lines, or an amount.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "invoices_create_credit_note" says "create": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it Issue a credit note against a sent invoice: all of it, some of its lines, or an amount. It takes the next credit note number (gapless, CN-0001...), gets a PDF and a page like an invoice, and is emailed to the customer unless email is false. It lowers what the customer still owes; refunded: true says the money went back to them instead, and the invoice records the refund. In much of the EU a sent invoice is corrected this way, not voided. When the account keeps books, the sale and its tax are reversed there. Costs $0.10 per call; nothing if it fails.
Annotations the server declares
- title: Credit an invoice
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
invoices_record_paymentRecord money received against a sent invoice: amount, date, method and reference.No findings
Why it is in this group
- The name "invoices_record_payment" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Record money received against a sent invoice: amount, date, method and reference. It becomes partially_paid, or paid when nothing is left. A payment can't be more than the balance, unless keep_excess keeps the rest as the customer's credit (an overpayment, like Xero's, for invoices_use_credit); a negative amount records a refund. When the account keeps books, it is posted to them. Costs $0.01 per call; nothing if it fails.
Annotations the server declares
- title: Record a payment
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_record_prepaymentRecord money a customer paid before there is an invoice, like a deposit, as Xero's prepayments: it waits as their credit (CR-0001 on) until invoices_use_credit puts it on their inv…No findings
Why it is in this group
- The input carries an amount (input.amount) and a currency, so it moves money.
Description, as the server wrote it Record money a customer paid before there is an invoice, like a deposit, as Xero's prepayments: it waits as their credit (CR-0001 on) until invoices_use_credit puts it on their invoice or pays it back. With tax_rate it carries its VAT, owed when the money came in (as the EU has it for advance payments); using it on the invoice takes that VAT back off, so the sale's VAT counts once. With books kept it is posted at once: the bank against Customer prepayments (2400, made when missing) and the tax owed. Costs $0.01 per call; nothing if it fails.
Annotations the server declares
- title: Record a prepayment
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_remindEmail the customer a reminder about a sent invoice that still has a balance: the amount due, the due date and the links to pay.Reads text others writeCan send data outNo findings
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it Email the customer a reminder about a sent invoice that still has a balance: the amount due, the due date and the links to pay. At most once a day per invoice. Costs $0.02 per call; nothing if it fails.
Annotations the server declares
- title: Remind about an unpaid invoice
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
invoices_reportaged_receivables: what each customer owes on as_of (default today), by how long past due: current (not due yet), 1-30, 31-60, 61-90 and over 90 days, per currency.Can send data out1 finding
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "invoices_report" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
Description, as the server wrote it aged_receivables: what each customer owes on as_of (default today), by how long past due: current (not due yet), 1-30, 31-60, 61-90 and over 90 days, per currency. sales: what was invoiced from-to (by issue date; default this month) per customer, less the credit notes issued in it: net, tax and total, and what was paid in it. To show a person, put it in a view (view_show). Free. Free.
Annotations the server declares
- title: Run a receivables report
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_sendSend a draft: it takes the next number (gapless), its PDF is made and kept in the file store, and the customer is emailed a link to its page (to view, pay or accept it) and to the …Reads text others writeCan send data outNo findings
Why it is in this group
- The name "invoices_send" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "invoices_send" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it Send a draft: it takes the next number (gapless), its PDF is made and kept in the file store, and the customer is emailed a link to its page (to view, pay or accept it) and to the PDF. On a document already sent it emails it again (to `to`, if given). email: false sends it without emailing anyone, to hand the link over yourself. When the account keeps books (books_setup), a sent invoice is posted to them. Before an invoice or credit note takes its number it is checked against the law of the business's country (in the EU, the UK and Switzerland: the business's address and VAT ID, the customer's VAT ID and address where needed, why a line has no tax, the VAT in the national currency); what is missing is refused for free, warnings come back. With e_invoice set it also goes out as an EN 16931 e-invoice (Factur-X inside the PDF, or an XRechnung XML beside it), validated against the official schema first. Costs $0.10 per call; nothing if it fails.
Annotations the server declares
- title: Send a quote or invoice
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
invoices_statementA customer statement, like Xero's.Reads text others writeCan send data outNo findings
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it A customer statement, like Xero's. outstanding (the default) lists every invoice the customer still owed on as_of (default today) with what was paid or credited, how late each is and the money owed by how late; activity starts from what they owed before from, lists each invoice, payment and credit note up to to (default this month so far) with the running balance, and ends with what they owed. One currency (default the one they are billed in most). It is a PDF in the file store in the business's look and document language; email: true also emails the customer a link to it in the business's name, under the rules every bot email follows and at most once a day per customer. $0.05. Costs $0.05 per call; nothing if it fails.
Annotations the server declares
- title: Make a customer statement
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Changes things 25Claude Code: ask
account_add_approval_ruleMake a tool wait for a person: every call of it, those whose argument is over a number (like invoices_create_credit_note when amount is over 500), or those whose argument is one of…No findings
Why it is in this group
- The name "account_add_approval_rule" says "add": a word for a change.
Description, as the server wrote it Make a tool wait for a person: every call of it, those whose argument is over a number (like invoices_create_credit_note when amount is over 500), or those whose argument is one of some values (like connect_call when method is POST, PUT, PATCH or DELETE). A held call answers approval_required with an approval_id and asks the approver; when they approve, call again with the same arguments, once (a call no person answers for adds the approval: header X-Conecto-Approval, or _meta.approvalId over MCP). The approver is an email, a saved channel, or a team (its managers, or everyone in it); each approver gets a link of their own, and the person whose call it is never approves it. With two_people_over, calls whose argument is over it need two people. Bills like Xero's bill approval: purchasing_create_bill with argument total holds bills over an amount, tax included; a rule on purchasing_pay_bill also holds batches with such a payment. Removing a rule is the owner's, on their account page, when the account has an owner email. $0.001. Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Hold a tool for approval
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
account_assign_teamMove a form, a meeting type, a job, an inbox, a phone number, a newsletter, the website chat, a rental, a pipeline, a table or a website to a team.No findings
Why it is in this group
- The name "account_assign_team" says "assign": a word for a change.
Description, as the server wrote it Move a form, a meeting type, a job, an inbox, a phone number, a newsletter, the website chat, a rental, a pipeline, a table or a website to a team. What happens through it is charged to that team from now on (a form's responses, a number's calls, an inbox's tickets), and its rental moves with it. Something a bot makes already belongs to the bot's team. Only a key of the company-wide team without limits moves things between teams. $0.001. Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Give something to a team
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_balanceThe account balance, how much of it is credit bought (AI visibility and the phone run only on that) and how much free and bonus credit, what running calls are holding, this key's d…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it The account balance, how much of it is credit bought (AI visibility and the phone run only on that) and how much free and bonus credit, what running calls are holding, this key's daily budget, the auto-reload state, and how much of this month's free reads and downloads is used. Free.
Annotations the server declares
- title: Check balance
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_dashboard_linkA one-time link to a page showing one area as it is when the page opens, for when the person you work for asks to see it themselves: a recruiter looks at the applicants, a bookkeep…1 finding
Why it is in this group
- The name "account_dashboard_link" says "link": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "account_dashboard_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "account_dashboard_link" says "link": a word for a change.
Description, as the server wrote it A one-time link to a page showing one area as it is when the page opens, for when the person you work for asks to see it themselves: a recruiter looks at the applicants, a bookkeeper at what is due. Do the work and answer with the area's own tools first; a link never replaces that. When an answer would be a long list they would rather look through, offer a link and make it once they say yes. The page is made from the area's own reads as this key, so it shows only what this key may see. It opens once and keeps for an hour; an unopened link ends after 7 days. Free.
Annotations the server declares
- title: Get a link to an area at a glance
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_data_locationsWhere each area's data is stored and processed: the company that runs each place, the country or region, and what it holds.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Where each area's data is stored and processed: the company that runs each place, the country or region, and what it holds. Every area keeps its records in the database and runs on Conecto's servers; some also use a service named here (email, phone, PDFs, search). For the business's records of processing and its transfer assessments (GDPR Art. 30 and 44). Free.
Annotations the server declares
- title: See where the data is
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_eventsWhat happened in this account that someone outside the bot did, oldest first: applications, bookings, form responses, signatures, replies, emails received, goals reached on the web…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it What happened in this account that someone outside the bot did, oldest first: applications, bookings, form responses, signatures, replies, emails received, goals reached on the website; and the custom events bots sent with account_emit_event. Kept 30 days. Poll with after = the last event_id you saw. Free.
Annotations the server declares
- title: Read recent events
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_export_allEverything this account holds, in ZIP files of up to 24 MB saved to its file store: every record of every area as JSON Lines, and the stored files themselves, with a README saying …1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
The description mentions "Credentials".
What this check looks forMatched text
description: "...es, with a README saying what is where. Credentials are left out. Runs in the background: p..."
Description, as the server wrote it Everything this account holds, in ZIP files of up to 24 MB saved to its file store: every record of every area as JSON Lines, and the stored files themselves, with a README saying what is where. Credentials are left out. Runs in the background: poll the call with account_get_call; the result has a download link for each part. The parts open only for this key and for the owner's and admins' own keys that neither only read nor only draft. A key of a team other than the company-wide one gets owner_required. Free (EU Data Act). One at a time, three a day; the owner is emailed when an export is made. Free. Runs in the background: the reply has a call_id; poll it with the account_get_call tool or GET /v1/calls/<id>.
Annotations the server declares
- title: Export everything
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
account_export_personEverything account_find_person finds about one person in one ZIP in the file store: their records as JSON Lines (credentials left out) and the files those records point to, like a …Can send data out1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...ile store: their records as JSON Lines (credentials left out) and the files those records p..."
Description, as the server wrote it Everything account_find_person finds about one person in one ZIP in the file store: their records as JSON Lines (credentials left out) and the files those records point to, like a CV. Give the person the download link when they ask for a copy of their data (GDPR Art. 15 and 20), once you know it is them. The ZIP opens only for this key and for the owner's and admins' own keys that neither only read nor only draft. A key of a team other than the company-wide one gets owner_required: pass the request to the owner. Free; 20 a day. Free.
Annotations the server declares
- title: Export a person's data
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
account_owner_linkA link that signs the business owner into their Conecto page, with no password: the balance, adding credit, auto-reload, limits, what the bots did, people, rentals and keys.1 finding
Why it is in this group
- The name "account_owner_link" says "link": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "account_owner_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "account_owner_link" says "link": a word for a change.
Description, as the server wrote it A link that signs the business owner into their Conecto page, with no password: the balance, adding credit, auto-reload, limits, what the bots did, people, rentals and keys. page opens it where the owner is needed, like people for a role only the owner gives, or settings for joining by email domain. It works once, within 30 minutes; hand it to the owner. Free.
Annotations the server declares
- title: Get a sign-in link for the owner
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_pause_teamStops every key of a team at once, this one too if it is the team's: their calls are refused until the owner starts the team again on their account page.No findings
Why it is in this group
- The description's first verb is "stop": a word for a change.
Description, as the server wrote it Stops every key of a team at once, this one too if it is the team's: their calls are refused until the owner starts the team again on their account page. For a bot that misbehaves or a team that spends too fast. Free. Free.
Annotations the server declares
- title: Pause a team
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
account_request_limitAsk Conecto to raise one of the business's limits: which one (or other, saying which), the number it needs, and why, in 40 to 2,000 characters.No findings
Why it is in this group
- The name "account_request_limit" says "request": a word for a change.
Description, as the server wrote it Ask Conecto to raise one of the business's limits: which one (or other, saying which), the number it needs, and why, in 40 to 2,000 characters. Conecto reviews it and approves (maybe with less) or declines; the answer comes as the account.limit_request_answered event and by email to the owner, who is also told now. For an account that has topped up; one request per limit at a time, five in 30 days. Free. Free.
Annotations the server declares
- title: Ask for a higher limit
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
account_save_teamA department, location or project group of the account, like Support, Finance or the Hamburg shop.No findings
Why it is in this group
- The name "account_save_team" says "save": a word for a change.
Description, as the server wrote it A department, location or project group of the account, like Support, Finance or the Hamburg shop. Its keys (POST /v1/keys with "team") can only work in its areas, only read when read_only is on, and spend against its budget (monthly_budget_usd per budget_period: a month, a fiscal quarter or year, or a project total): a hard budget refuses the call that would pass it, a soft one only warns. At alert_percent you get the event account.budget_alert and the owner an email, once a period. erp_code is the team's cost center in the company's ERP, for statements. drafts_only makes every write of its keys wait for one of its managers (or the owner), for a new bot that should only draft. mailboxes are the Microsoft 365 or Google mailboxes its keys may act as. You may make a team and narrow one; widening its areas, letting it write, ending drafts only, switching a hard budget to soft, and raising or removing a budget are the owner's, on their account page, when the account has an owner email. The company-wide team holds every key no other team does and is never limited to areas. $0.001. Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Create or change a team
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_set_brandThe business's name as the sender, its logo (a PNG, JPEG, WebP or GIF from the file store), its colour and a footer line (an address, a legal line), on every email to its customers…No findings
Why it is in this group
- The name "account_set_brand" says "set": a word for a change.
Description, as the server wrote it The business's name as the sender, its logo (a PNG, JPEG, WebP or GIF from the file store), its colour and a footer line (an address, a legal line), on every email to its customers (bookings, applications, tests, signatures, invoices, newsletters, replies) and on its published pages (forms, booking, careers, newsletters, status, views). Only what you pass changes; an empty string clears it. Mail from Conecto to you keeps Conecto's look. Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Set the business's look
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_set_email_templateChange an email's subject, headline or opening words in the business's own voice, with {variables} from account_list_email_templates (like {name} or {when}).Can send data outNo findings
Why it is in this group
- The name "account_set_email_template" says "set": a word for a change.
What it can reach
- outboundThe name "account_set_email_template" says "set" and "email": it writes something other people read.
Description, as the server wrote it Change an email's subject, headline or opening words in the business's own voice, with {variables} from account_list_email_templates (like {name} or {when}). The facts under them (times, places, amounts, links and buttons) stay as they are. Only what you pass changes; an empty string brings back the original words. Plain text; a blank line starts a new paragraph. Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Rewrite one of the business's emails
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_set_owner_emailWhen the account was made without the owner's email: send that person a link to confirm they own it.Can send data outNo findings
Why it is in this group
- The name "account_set_owner_email" says "set": a word for a change.
What it can reach
- outboundThe name "account_set_owner_email" says "set" and "email": it writes something other people read.
Description, as the server wrote it When the account was made without the owner's email: send that person a link to confirm they own it. Once they confirm, the owner gets the account's warnings and approval requests, and only the owner raises limits. Nothing changes until they open the link. Free. Free.
Annotations the server declares
- title: Name the business's owner
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_connect_stripeConnect the business's own Stripe account with a restricted key (a person makes it in Stripe: Developers, API keys, Create restricted key), so invoices can carry a Pay button (invo…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Connect the business's own Stripe account with a restricted key (a person makes it in Stripe: Developers, API keys, Create restricted key), so invoices can carry a Pay button (invoices_set_profile pay_online). A restricted key with write access to Checkout Sessions and Webhook Endpoints. Conecto registers a webhook on that account to learn when an invoice is paid. The money goes straight to the business; Conecto never holds it. Called without stripe_key, it answers with a link for the owner, who types the key on a Conecto page, so it never passes through the chat (from_a_terminal does the same from a terminal); account.credential_added says when it is connected, and the link costs nothing. The key is kept encrypted and never shown again. Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Connect Stripe for invoices
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_convert_quoteTurn an accepted quote into a draft invoice with the same customer and lines, ready for invoices_send.No findings
Why it is in this group
- The name "invoices_convert_quote" says "convert": a word for a change.
Description, as the server wrote it Turn an accepted quote into a draft invoice with the same customer and lines, ready for invoices_send. If the customer accepted some other way (email, phone), pass mark_accepted: true to record it. Costs $0.01 per call; nothing if it fails.
Annotations the server declares
- title: Turn a quote into an invoice
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_createCreate a quote or an invoice as a draft: the customer (a CRM contact or company, or a name and email), line items, currency and dates.No findings
Why it is in this group
- The name "invoices_create" says "create": a word for a change.
Description, as the server wrote it Create a quote or an invoice as a draft: the customer (a CRM contact or company, or a name and email), line items, currency and dates. Nothing is numbered or sent yet; change drafts with invoices_update and send them with invoices_send. Amounts are the business's money in the document's currency, rounded half-up line by line. Costs $0.01 per call; nothing if it fails.
Annotations the server declares
- title: Create a quote or invoice
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_remind_overdueEmail a reminder about every sent invoice at least days_overdue days past its due date that still has a balance, the longest overdue first, up to limit invoices: one call, or one w…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Email a reminder about every sent invoice at least days_overdue days past its due date that still has a balance, the longest overdue first, up to limit invoices: one call, or one weekly schedule (schedules_create), chases them all. Each invoice is reminded at most once a day; the ones that can't be (no customer email, emailed in the last 24 hours, the address bounced) are listed with why. $0.02 per reminder sent. Costs $0.02 per reminder sent; nothing if none are found.
Annotations the server declares
- title: Remind everyone who is overdue
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
invoices_save_repeatingAn invoice made again every so many weeks, months or years, like Xero's repeating invoices: the customer and lines as for invoices_create, every and unit, the start date, and an en…No findings
Why it is in this group
- The name "invoices_save_repeating" says "save": a word for a change.
Description, as the server wrote it An invoice made again every so many weeks, months or years, like Xero's repeating invoices: the customer and lines as for invoices_create, every and unit, the start date, and an end_date or a number of times. action draft leaves each one for you to check and send; send emails it to the customer on its day. Descriptions and notes may hold [Month], [Year], [Quarter] or [Week], with an offset like [Month+1], filled in from each invoice's date. Each invoice is made by Conecto's worker as this key and costs what invoices_create and invoices_send cost. Change one by repeating_id: only what you pass changes; status paused stops it, active resumes it (dates it missed are skipped). Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Repeat an invoice
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
invoices_set_expected_dateThe day a customer said they would pay an invoice that is sent and not paid yet, like Xero's expected date: the cash flow forecast (books_report cash_forecast) counts the invoice o…No findings
Why it is in this group
- The name "invoices_set_expected_date" says "set": a word for a change.
Description, as the server wrote it The day a customer said they would pay an invoice that is sent and not paid yet, like Xero's expected date: the cash flow forecast (books_report cash_forecast) counts the invoice on that day, even one already overdue, which it otherwise leaves out. null clears it. Free.
Annotations the server declares
- title: Set when a customer will pay
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_set_profileSet the business details printed on quotes and invoices: legal name, country, address, tax ID, email, phone, logo, default currency, payment terms, tax rate, number prefixes and ne…Can send data outNo findings
Why it is in this group
- The name "invoices_set_profile" says "set": a word for a change.
What it can reach
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it Set the business details printed on quotes and invoices: legal name, country, address, tax ID, email, phone, logo, default currency, payment terms, tax rate, number prefixes and next numbers, payment instructions, an optional payment link and legal notes. Only the fields given change. Sending needs legal_name and country; in the EU, the UK and Switzerland an invoice also needs the address and tax ID, checked when it is sent. Costs $0.001 per call; nothing if it fails.
Annotations the server declares
- title: Set the business details
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_summaryWhat customers owe, per currency: outstanding, overdue and paid this month, plus quotes still open.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it What customers owe, per currency: outstanding, overdue and paid this month, plus quotes still open. Free.
Annotations the server declares
- title: What customers owe
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_updateChange a draft quote or invoice: give only what changes; customer and items replace the old ones.No findings
Why it is in this group
- The name "invoices_update" says "update": a word for a change.
Description, as the server wrote it Change a draft quote or invoice: give only what changes; customer and items replace the old ones. A sent document can't change: void it with invoices_void and create a new one. Costs $0.01 per call; nothing if it fails.
Annotations the server declares
- title: Change a draft
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_use_creditPut a customer's credit (a prepayment or an overpayment) on one of their sent invoices, like Xero's allocate credit: invoice_id, and amount (default all it can: what is left on the…No findings
Why it is in this group
- The description's first verb is "put": a word for a change.
Description, as the server wrote it Put a customer's credit (a prepayment or an overpayment) on one of their sent invoices, like Xero's allocate credit: invoice_id, and amount (default all it can: what is left on the credit or the invoice, the smaller); the invoice records it as a payment with method credit, and its share of the credit's VAT comes back off. Or refund: true pays what is left (or amount) back to the customer, with date and method; or void: true takes back a prepayment recorded by mistake while none of it is used. Same customer and currency only. Costs $0.01 per call; nothing if it fails.
Annotations the server declares
- title: Use or pay back a credit
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
Only reads 15Show 15 read-only tools
account_audit_logThe account's admin and security actions, newest first: keys made and revoked, limits and auto-reload, the owner's sign-ins, connectors, exports, vault reads and writes, credential…Reads private data1 finding
Why it is in this group
- The name "account_audit_log" says "log": a word for reading.
What it can reach
- private-dataThe description's first sentence says "vault": it reads secrets.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...ctors, exports, vault reads and writes, credentials set and everything deleted. Ordinary wo..."
Description, as the server wrote it The account's admin and security actions, newest first: keys made and revoked, limits and auto-reload, the owner's sign-ins, connectors, exports, vault reads and writes, credentials set and everything deleted. Ordinary work is in the call log (account_list_calls). verify: true also checks the hash chain, which breaks where an entry was changed or removed. Free.
Annotations the server declares
- title: Read the audit log
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_find_personEvery record this account holds about one person, by their email address or phone number, across every area: CRM, chats, emails, tickets, forms, bookings, calls, applications, invo…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "account_find_person" says "find": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it Every record this account holds about one person, by their email address or phone number, across every area: CRM, chats, emails, tickets, forms, bookings, calls, applications, invoices, orders, newsletters, HR and the call log, with their chats and CRM history. For a person who asks what the business keeps about them (GDPR Art. 15). Shows each kind with its count and ids; account_export_person gives them a copy, account_erase_person erases what may go. Free.
Annotations the server declares
- title: Find a person's data
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_get_brandThe name, logo, colour and footer line the business's emails and published pages carry.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "account_get_brand" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it The name, logo, colour and footer line the business's emails and published pages carry. Free.
Annotations the server declares
- title: See the business's look
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_get_callOne call by id: its status (queued, running, succeeded, failed), cost and result.No findings
Why it is in this group
- The name "account_get_call" says "get": a word for reading.
Description, as the server wrote it One call by id: its status (queued, running, succeeded, failed), cost and result. Use it to poll a background call until it finishes. Free.
Annotations the server declares
- title: Get a call
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_get_limitsThe limits a business can ask Conecto to raise (calls a minute, new email addresses a day, phone numbers and more): each one's standard and current value and the most that can be a…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "account_get_limits" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it The limits a business can ask Conecto to raise (calls a minute, new email addresses a day, phone numbers and more): each one's standard and current value and the most that can be asked for, and the business's requests with their answers. Free.
Annotations the server declares
- title: Read the limits
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_list_approval_rulesThe tools that wait for a person's approval, with their thresholds and approvers.No findings
Why it is in this group
- The name "account_list_approval_rules" says "list": a word for reading.
Description, as the server wrote it The tools that wait for a person's approval, with their thresholds and approvers. Free.
Annotations the server declares
- title: List approval rules
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_list_callsRecent calls on this account, newest first, optionally only failed or succeeded ones, or one area's.No findings
Why it is in this group
- The name "account_list_calls" says "list": a word for reading.
Description, as the server wrote it Recent calls on this account, newest first, optionally only failed or succeeded ones, or one area's. Free.
Annotations the server declares
- title: List calls
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_list_email_templatesEvery email Conecto sends to the business's customers (bookings, applications, interviews, tests, signatures, invoices and quotes, newsletter sign-ups), with when it goes out and i…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "account_list_email_templates" says "list": a word for reading.
What it can reach
- private-dataThe name "account_list_email_templates" says "list" and "email": it reads mail.
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe name "account_list_email_templates" says "list" and "email": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it Every email Conecto sends to the business's customers (bookings, applications, interviews, tests, signatures, invoices and quotes, newsletter sign-ups), with when it goes out and its subject, headline and opening words as they are now, and the {variables} each can use. Free.
Annotations the server declares
- title: See what the business's emails say
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_list_teamsThe account's teams, the company-wide one first: each with its areas, whether it only reads, its budget (hard or soft, and its period) and alert line, this period's spend, its ERP …No findings
Why it is in this group
- The name "account_list_teams" says "list": a word for reading.
Description, as the server wrote it The account's teams, the company-wide one first: each with its areas, whether it only reads, its budget (hard or soft, and its period) and alert line, this period's spend, its ERP code, whether it is paused, its keys, and its people with who manages it. A person's own assistant works within their teams. Free.
Annotations the server declares
- title: List teams
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
account_searchOne search over what this account holds: what its files say (PDFs, Word, Excel, PowerPoint, text), table rows, help center articles, CRM contacts, companies and deals, emails, tick…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "account_search" says "search": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it One search over what this account holds: what its files say (PDFs, Word, Excel, PowerPoint, text), table rows, help center articles, CRM contacts, companies and deals, emails, tickets, quotes and invoices, book entries, stock items and project tasks. Every word must appear (any case); titles rank first, then the newest. Each result says which tool opens it. Narrow it with areas. Free.
Annotations the server declares
- title: Search everything
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_getOne quote, invoice or credit note in full: lines with their amounts, totals and taxes, payments, credit notes, history, its public page and a fresh PDF link.Reads private dataNo findings
Why it is in this group
- The name "invoices_get" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "note": it reads notes.
Description, as the server wrote it One quote, invoice or credit note in full: lines with their amounts, totals and taxes, payments, credit notes, history, its public page and a fresh PDF link. Find it by invoice_id, or by number (with kind if documents of two kinds share it). Free.
Annotations the server declares
- title: Get a quote or invoice
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_get_profileThe business details used on quotes and invoices, the next numbers, and what is still missing before documents can be sent.Reads private dataNo findings
Why it is in this group
- The name "invoices_get_profile" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "document": it reads documents.
Description, as the server wrote it The business details used on quotes and invoices, the next numbers, and what is still missing before documents can be sent. Free.
Annotations the server declares
- title: Get the business details
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_listQuotes, invoices and credit notes, newest first, filtered by kind, status (also overdue, unpaid and expired), customer and issue date.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "invoices_list" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "note": it reads notes.
- untrusted-inputThe description's first sentence says "issue": it reads issues, which other people can write.
Description, as the server wrote it Quotes, invoices and credit notes, newest first, filtered by kind, status (also overdue, unpaid and expired), customer and issue date. Totals and balances come with each one. Free.
Annotations the server declares
- title: List quotes and invoices
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_list_creditsCustomers' credits, prepayments and overpayments, newest first: what each was, what is left, its VAT and how it was used or paid back.No findings
Why it is in this group
- The name "invoices_list_credits" says "list": a word for reading.
Description, as the server wrote it Customers' credits, prepayments and overpayments, newest first: what each was, what is left, its VAT and how it was used or paid back. Filter by customer, or status (open, used, refunded, void, all; default open). Free.
Annotations the server declares
- title: List customer credits
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invoices_list_repeatingThe repeating invoices: who each is for, its lines, how often, the next dates, whether it is drafted or sent, how many were made and the last one, and why one is paused.No findings
Why it is in this group
- The name "invoices_list_repeating" says "list": a word for reading.
Description, as the server wrote it The repeating invoices: who each is for, its lines, how often, the next dates, whether it is drafted or sent, how many were made and the last one, and why one is paused. Free.
Annotations the server declares
- title: List repeating invoices
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
990 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 9 private-data tools breaks every one.
- Reads private data9
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write11
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out10
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__invoices__account_audit_log",
"mcp__invoices__account_find_person",
"mcp__invoices__account_get_brand",
"mcp__invoices__account_get_limits",
"mcp__invoices__account_list_email_templates",
"mcp__invoices__account_search",
"mcp__invoices__invoices_get",
"mcp__invoices__invoices_get_profile",
"mcp__invoices__invoices_list"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Warninvoices_report
The server marks "invoices_report" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
The server marks "account_owner_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "account_owner_link" says "link": a word for a change.
The server marks "account_dashboard_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "account_dashboard_link" says "link": a word for a change.
The description mentions "Credentials".
What this check looks forMatched text
description: "...es, with a README saying what is where. Credentials are left out. Runs in the background: p..."
The description mentions "credentials".
What this check looks forMatched text
description: "...ctors, exports, vault reads and writes, credentials set and everything deleted. Ordinary wo..."
The description mentions "credentials".
What this check looks forMatched text
description: "...ile store: their records as JSON Lines (credentials left out) and the files those records p..."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http invoices https://api.conecto.chat/mcp/invoices --header 'Authorization: <your-authorization>'claude mcp add --transport http invoices https://api.conecto.chat/mcp/invoices --header 'Authorization: <your-authorization>'Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__invoices__invoices_get_profile",
"mcp__invoices__invoices_get",
"mcp__invoices__invoices_list",
"mcp__invoices__invoices_list_credits",
"mcp__invoices__invoices_list_repeating",
"mcp__invoices__account_get_call",
"mcp__invoices__account_list_calls",
"mcp__invoices__account_get_limits",
"mcp__invoices__account_search",
"mcp__invoices__account_get_brand",
"mcp__invoices__account_list_email_templates",
"mcp__invoices__account_audit_log",
"mcp__invoices__account_list_teams",
"mcp__invoices__account_list_approval_rules",
"mcp__invoices__account_find_person"
],
"ask": [
"mcp__invoices__invoices_connect_stripe",
"mcp__invoices__invoices_set_profile",
"mcp__invoices__invoices_create",
"mcp__invoices__invoices_set_expected_date",
"mcp__invoices__invoices_update",
"mcp__invoices__invoices_send",
"mcp__invoices__invoices_convert_quote",
"mcp__invoices__invoices_record_payment",
"mcp__invoices__invoices_record_prepayment",
"mcp__invoices__invoices_use_credit",
"mcp__invoices__invoices_create_credit_note",
"mcp__invoices__invoices_remind",
"mcp__invoices__invoices_remind_overdue",
"mcp__invoices__invoices_save_repeating",
"mcp__invoices__invoices_statement",
"mcp__invoices__invoices_report",
"mcp__invoices__invoices_summary",
"mcp__invoices__account_balance",
"mcp__invoices__account_set_owner_email",
"mcp__invoices__account_owner_link",
"mcp__invoices__account_dashboard_link",
"mcp__invoices__account_request_limit",
"mcp__invoices__account_events",
"mcp__invoices__account_emit_event",
"mcp__invoices__account_set_brand",
"mcp__invoices__account_set_email_template",
"mcp__invoices__account_export_all",
"mcp__invoices__account_save_team",
"mcp__invoices__account_pause_team",
"mcp__invoices__account_assign_team",
"mcp__invoices__account_add_approval_rule",
"mcp__invoices__account_export_person",
"mcp__invoices__account_data_locations"
],
"deny": [
"mcp__invoices__invoices_void",
"mcp__invoices__invoices_delete_repeating",
"mcp__invoices__account_refund_topup",
"mcp__invoices__account_erase_person"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as invoices. Review it before you use it.
Capability tags behind 20 rules
- mcp__invoices__invoices_set_profile outbound
- mcp__invoices__invoices_get_profile private-data
- mcp__invoices__invoices_get private-data
- mcp__invoices__invoices_list private-data, untrusted-input
- mcp__invoices__invoices_send untrusted-input, outbound
- mcp__invoices__invoices_create_credit_note untrusted-input, outbound
- mcp__invoices__invoices_remind untrusted-input, outbound
- mcp__invoices__invoices_remind_overdue untrusted-input
- mcp__invoices__invoices_statement untrusted-input, outbound
- mcp__invoices__invoices_report outbound
- mcp__invoices__account_set_owner_email outbound
- mcp__invoices__account_get_limits private-data, untrusted-input
- mcp__invoices__account_emit_event outbound
- mcp__invoices__account_search private-data, untrusted-input
- mcp__invoices__account_get_brand private-data, untrusted-input
- mcp__invoices__account_list_email_templates private-data, untrusted-input
- mcp__invoices__account_set_email_template outbound
- mcp__invoices__account_audit_log private-data
- mcp__invoices__account_find_person private-data, untrusted-input
- mcp__invoices__account_export_person outbound
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/chat.conecto/invoices/verify?hash=189f210453f7d0384d8e31d7f44dc47c055f0793b09f5a375348c3441361aba9" | jq -e '.changed == false'Pinned hash 189f210453f7, from Nov 2, 2026, 21:17 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/chat.conecto/invoices/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/chat.conecto/invoices)Source: MCP Registry. Synced Nov 2, 2026, 22:17 UTC.