Receipts & invoices to spreadsheet
co.byondr/receiptsbyondr.costreamable-httpv0.1.0Scanned
Receipts and invoices to checked spreadsheet rows. Doubtful numbers are flagged.
2 tools: 1 change things and 1 only read.
- Reads private data · 1
- Reads text others write · 1
- Can send data out · 0
- 1 finding
Anlyon alternative
1 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
2 tools
Changes things 1Claude Code: ask
create_uploadGet a one-hour signed upload URL for a document or a zip that is too large to send inline (over 2 MB; up to 100 MB here) or that already sits on disk.No findings
Why it is in this group
- The name "create_upload" says "create": a word for a change.
Description, as the server wrote it Get a one-hour signed upload URL for a document or a zip that is too large to send inline (over 2 MB; up to 100 MB here) or that already sits on disk. PUT the raw bytes to upload_url with a Content-Length header, then pass file_id to extract_documents. Free.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- title: Create upload URL
- idempotentHint: false
Only reads 1Show 1 read-only tool
extract_documentsRead receipts and invoices (JPG, PNG, WebP, HEIC, PDF, or a zip of them; one document per file or PDF; up to 25 documents per call, 10 MB each, PDFs up to 10 pages) into checked nu…Reads private dataReads text others write1 finding
Why it is in this group
- The description's first verb is "read": a word for reading.
What it can reach
- private-dataThe name "extract_documents" says "document": it reads documents.
- private-dataThe description's first sentence says "read" and "document": it reads documents.
- private-dataThe input names a file (input.files), and the tool reads: it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "read" and "web": it reads web pages, which anyone can write.
Findings
- Info
The description is 2,263 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...payments are enabled: $0.01 per document. Use a client timeout of at least 240 s."
Description, as the server wrote it Read receipts and invoices (JPG, PNG, WebP, HEIC, PDF, or a zip of them; one document per file or PDF; up to 25 documents per call, 10 MB each, PDFs up to 10 pages) into checked numbers. Give each file as file_id (from create_upload), url (public https) or data_base64 (up to 2 MB inline). MCP requests are capped near 4 MB by the SDK, so keep all inline base64 in one call under about 2 MB and use create_upload for more. Returns one entry per document with vendor, date, currency, line items, subtotal, tax, total and payment method, each field marked ok, check or missing, the checks that ran, a status of ready or needs_review with review_reasons, and duplicate_of for a repeated receipt. Money is a decimal string, never a float. Each document also carries printed: its dates and currency as printed, the paths of fields whose text could not be read (printed.unreadable), the paths of fields a second read changed after a failed check (printed.second_look), and the paths of amounts printed with a dotted thousands separator on a rupiah-style receipt ("31.000") that were read as the whole number (printed.thousands; the value is already converted and the field is marked check), and the paths of amounts the model returned as JSON numbers, whose printed digits are lost (printed.number_typed; the field is marked check). Also returns 24-hour download links for the exports you ask for: csv (default), line_items_csv, quickbooks_csv (one currency; set quickbooks_currency and quickbooks_date_format, MM/DD/YYYY or DD/MM/YYYY) and file_pack (a zip of the originals renamed by date, vendor and total, plus documents.csv). Each link lists the documents left out of that file: quickbooks_csv leaves out every document with status needs_review (and ones missing a date or total), with the reason; csv, line_items_csv and file_pack keep every document. Hints: country (ISO 3166-1 alpha-2) and currency (ISO 4217) help with unclear receipts, date_order (DMY or MDY) settles dates like 03/04/2026. Show documents with status needs_review and their review_reasons to the user before using their numbers. Free for now within a daily quota counted in documents (see start.md); price when payments are enabled: $0.01 per document. Use a client timeout of at least 240 s.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
- title: Extract receipts and invoices
- idempotentHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
The description is 2,263 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...payments are enabled: $0.01 per document. Use a client timeout of at least 240 s."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http receipts https://byondr.co/receipts/mcpclaude mcp add --transport http receipts https://byondr.co/receipts/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__receipts__extract_documents"
],
"ask": [
"mcp__receipts__create_upload"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as receipts. Review it before you use it.
Capability tags behind 1 rule
- mcp__receipts__extract_documents private-data, untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/co.byondr/receipts/verify?hash=4abda7f2756a0ca743aee507cc268ac9cbf727d53f240d626fc020719229e5b4" | jq -e '.changed == false'Pinned hash 4abda7f2756a, from Oct 27, 2026, 10:17 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/co.byondr/receipts/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/co.byondr/receipts)Source: MCP Registry. Synced Oct 27, 2026, 10:17 UTC.