Red by Big Red Cloud

io.github.BigRedCloud/red-mcp-serverBigRedCloudstreamable-httpv1.4.0Scanned 23 hours ago

Secure MCP access to Big Red Cloud accounting data, workflows, help and training.

159 tools: 67 can delete or cancel things, 14 change things and 78 only read.

Reads private data · 4
Reads text others write · 4
Can send data out · 3
163 findings

Tools listed without sign-in. Remote posture

Anlyon alternative

81 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

159 tools

Deletes or cancels 67Removes, cancels or revokes something.Claude Code: deny

brc_batch_cash_paymentsProcesses cash payments in supplier-ledger, bank-lodgement or analysed-expense mode.1 finding
Why it is in this group
- The name "brc_batch_cash_payments" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes cash payments in supplier-ledger, bank-lodgement or analysed-expense mode. Results are reported per submitted item and partial success is possible. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Cash Payments
brc_batch_cash_receiptsProcesses a batch of BRC cash receipts.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes a batch of BRC cash receipts. Maximum 100 items per batch request. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Cash Receipts
brc_batch_customersProcesses a batch of customers using explicit identity, VAT classification, and optional contact fields.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes a batch of customers using explicit identity, VAT classification, and optional contact fields. Maximum 100 items per batch request. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Customers
brc_batch_paymentsProcesses supplier or analysed bank payments in a batch.1 finding
Why it is in this group
- The name "brc_batch_payments" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes supplier or analysed bank payments in a batch. Results are reported per submitted item and partial success is possible. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Payments
brc_batch_productsProcesses a batch of products using explicit product type, VAT classification, price, and description fields.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes a batch of products using explicit product type, VAT classification, price, and description fields. Maximum 100 items per batch request. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Products
brc_batch_purchasesProcesses purchases in a batch using structured generated-reference purchase items.1 finding
Why it is in this group
- The name "brc_batch_purchases" says "purchase": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes purchases in a batch using structured generated-reference purchase items. Results are reported per submitted item and partial success is possible. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Purchases
brc_batch_quotesProcesses a batch of quotes using either verified flat creator fields or a complete nested BRC Quote payload.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes a batch of quotes using either verified flat creator fields or a complete nested BRC Quote payload. Maximum 100 items per batch request. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Quotes
brc_batch_sales_credit_notesProcesses sales credit notes in a batch using reconciled product, VAT and Sales-analysis lines.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes sales credit notes in a batch using reconciled product, VAT and Sales-analysis lines. Results are reported per submitted item and partial success is possible. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Sales Credit Notes
brc_batch_sales_entriesProcesses sales entries with positive, zero or negative amounts and multiple VAT lines.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes sales entries with positive, zero or negative amounts and multiple VAT lines. The optional batchSize is a per-request limit. An omitted value uses the sales-entry configuration, then the general batch configuration, then fallback 20. The hard ceiling is 100, with no automatic splitting. Maximum 100 items per batch request. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Sales Entries
brc_batch_sales_invoicesProcesses sales invoices in a batch using reconciled product, VAT and Sales-analysis lines.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes sales invoices in a batch using reconciled product, VAT and Sales-analysis lines. Results are reported per submitted item and partial success is possible. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Sales Invoices
brc_batch_sales_repsProcesses a batch of sales representatives using explicit code and name fields.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes a batch of sales representatives using explicit code and name fields. Maximum 100 items per batch request. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Sales Representatives
brc_batch_suppliersProcesses a batch of suppliers using explicit identity, VAT classification, and optional contact fields.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes a batch of suppliers using explicit identity, VAT classification, and optional contact fields. Maximum 100 items per batch request. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Batch Suppliers
brc_clear_all_company_api_keysClears all connection credentials for all company contexts from MCP server memory.2 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "Clears all connection credentials for all company contexts from MCP serve..."
  What this check looks for
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Clears all connection credentials for all company contexts from MCP server memory.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Clear All Company API Keys
brc_clear_audit_logClear the Red audit log for this MCP server session.2 findings
Why it is in this group
- The name "brc_clear_audit_log" says "log": a word for reading.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
- Warn
  The server marks "brc_clear_audit_log" destructive (destructiveHint: true), and its name says "log", a word for reading.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":true,"openWorldHint":false}; The name "brc_clear_audit_log" says "log": a word for reading.
  What this check looks for
Description, as the server wrote it
Clear the Red audit log for this MCP server session. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Clear Audit Log
brc_clear_company_api_keyClears the API key for a named company context from MCP server memory.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Clears the API key for a named company context from MCP server memory.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Clear Company API Key
brc_create_accrualCreates an accrual after returning an unconfirmed payload preview.1 finding
Why it is in this group
- The name "brc_create_accrual" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates an accrual after returning an unconfirmed payload preview. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Accrual
brc_create_cash_paymentCreates a cash payment in supplier-ledger, bank-lodgement or analysed-expense mode.1 finding
Why it is in this group
- The name "brc_create_cash_payment" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a cash payment in supplier-ledger, bank-lodgement or analysed-expense mode. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Cash Payment
brc_create_cash_receiptCreates a BRC cash receipt.1 finding
Why it is in this group
- The name "brc_create_cash_receipt" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a BRC cash receipt. Accepts either a raw payload object or common flat fields. Customer-ledger receipts require both customerId and acCode resolved for the same customer; neither field alone is sufficient. Analysed receipts may instead supply an analysis allocation without a customer. entryDate defaults to today; procDate defaults to entryDate. The preview shows these resolved dates; carry them into the confirmation call to preserve them if confirming on a later day. VAT rate fields are only sent when the company's VAT on Cash Receipt setting is enabled. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Cash Receipt
brc_create_nominal_journal_batchCreates a nominal journal batch after returning an unconfirmed payload preview.1 finding
Why it is in this group
- The name "brc_create_nominal_journal_batch" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a nominal journal batch after returning an unconfirmed payload preview. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Nominal Journal Batch
brc_create_paymentCreates a bank payment in supplier or analysed-account mode.1 finding
Why it is in this group
- The name "brc_create_payment" says "create": a word for a change.
- The name "brc_create_payment" also says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a bank payment in supplier or analysed-account mode. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Payment
brc_create_prepaymentCreates a prepayment after returning an unconfirmed payload preview.1 finding
Why it is in this group
- The name "brc_create_prepayment" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a prepayment after returning an unconfirmed payload preview. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Prepayment
brc_create_purchaseCreates a purchase with a caller-supplied reference when manual purchase references are configured.1 finding
Why it is in this group
- The name "brc_create_purchase" says "create": a word for a change.
- The name "brc_create_purchase" also says "purchase": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a purchase with a caller-supplied reference when manual purchase references are configured. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Purchase
brc_create_purchase_gen_refCreates a purchase using the company's generated-reference configuration.1 finding
Why it is in this group
- The name "brc_create_purchase_gen_ref" says "create": a word for a change.
- The name "brc_create_purchase_gen_ref" also says "purchase": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a purchase using the company's generated-reference configuration. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Purchase with Generated Reference
brc_create_sales_credit_noteCreates a sales credit note with a caller-supplied reference and reconciled negative document amounts.1 finding
Why it is in this group
- The name "brc_create_sales_credit_note" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a sales credit note with a caller-supplied reference and reconciled negative document amounts. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Sales Credit Note
brc_create_sales_credit_note_gen_refCreates a sales credit note using generated references and reconciled negative document amounts.1 finding
Why it is in this group
- The name "brc_create_sales_credit_note_gen_ref" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a sales credit note using generated references and reconciled negative document amounts. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Sales Credit Note with Generated Reference
brc_create_sales_entryCreates one BRC sales entry with positive, zero or negative net values and multiple VAT lines.1 finding
Why it is in this group
- The name "brc_create_sales_entry" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates one BRC sales entry with positive, zero or negative net values and multiple VAT lines. Legacy single-VAT fields remain supported. Zero entries may omit analysis and VAT allocations. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Sales Entry
brc_create_sales_invoiceCreates a sales invoice with a caller-supplied reference and reconciled product, VAT and Sales-analysis lines.1 finding
Why it is in this group
- The name "brc_create_sales_invoice" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a sales invoice with a caller-supplied reference and reconciled product, VAT and Sales-analysis lines. Missing customer contact values remain absent. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Sales Invoice
brc_create_sales_invoice_gen_refCreates a sales invoice using generated references and reconciled product, VAT and Sales-analysis lines.1 finding
Why it is in this group
- The name "brc_create_sales_invoice_gen_ref" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a sales invoice using generated references and reconciled product, VAT and Sales-analysis lines. Missing customer contact values remain absent. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Create Sales Invoice with Generated Reference
brc_delete_accrualDeletes an accrual using its current concurrency timestamp.1 finding
Why it is in this group
- The name "brc_delete_accrual" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes an accrual using its current concurrency timestamp. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Accrual
brc_delete_allocation_resolverReverses or deletes the specified allocation after returning an unconfirmed preview.1 finding
Why it is in this group
- The name "brc_delete_allocation_resolver" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Reverses or deletes the specified allocation after returning an unconfirmed preview. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Allocation Resolver
brc_delete_bank_accountDeletes the specified bank account after explicit confirmation.1 finding
Why it is in this group
- The name "brc_delete_bank_account" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes the specified bank account after explicit confirmation. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Bank Account
brc_delete_cash_paymentDeletes a BRC cash payment by id.1 finding
Why it is in this group
- The name "brc_delete_cash_payment" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC cash payment by id. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Cash Payment
brc_delete_cash_receiptDeletes a BRC cash receipt by id.1 finding
Why it is in this group
- The name "brc_delete_cash_receipt" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC cash receipt by id. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Cash Receipt
brc_delete_customerDeletes a BRC customer by id.1 finding
Why it is in this group
- The name "brc_delete_customer" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC customer by id. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Customer
brc_delete_nominal_journal_batchDeletes a nominal journal batch using its current concurrency timestamp.1 finding
Why it is in this group
- The name "brc_delete_nominal_journal_batch" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a nominal journal batch using its current concurrency timestamp. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Nominal Journal Batch
brc_delete_paymentDeletes a BRC payment by id.1 finding
Why it is in this group
- The name "brc_delete_payment" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC payment by id. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Payment
brc_delete_prepaymentDeletes a prepayment using its current concurrency timestamp.1 finding
Why it is in this group
- The name "brc_delete_prepayment" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a prepayment using its current concurrency timestamp. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Prepayment
brc_delete_productDeletes a BRC product by id.1 finding
Why it is in this group
- The name "brc_delete_product" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC product by id. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Product
brc_delete_purchaseDeletes a BRC purchase by id using timestamp confirmation.1 finding
Why it is in this group
- The name "brc_delete_purchase" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC purchase by id using timestamp confirmation. Historical purchases are not automatically blocked because they belong to an earlier financial year. The BRC endpoint determines whether the historical deletion is supported. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Purchase
brc_delete_quoteDeletes a BRC quote by id using timestamp confirmation.1 finding
Why it is in this group
- The name "brc_delete_quote" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC quote by id using timestamp confirmation. Loads the quote once to obtain its timestamp and to preview id, reference, customer, total, open or closed state, any linked sales invoice, and timestamp before asking for confirmation. A successful delete is the result; if a later lookup by quote id returns an unexpected error, treat that check as inconclusive rather than as a failed delete. Confirm remaining quotes from the quote list by quote id — quote references are not necessarily unique. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Quote
brc_delete_sales_credit_noteDeletes a BRC sales credit note by id using timestamp confirmation.1 finding
Why it is in this group
- The name "brc_delete_sales_credit_note" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC sales credit note by id using timestamp confirmation. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Sales Credit Note
brc_delete_sales_entryDeletes a BRC sales entry by id using timestamp confirmation.1 finding
Why it is in this group
- The name "brc_delete_sales_entry" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC sales entry by id using timestamp confirmation. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Sales Entry
brc_delete_sales_invoiceDeletes a BRC sales invoice by id using timestamp confirmation.1 finding
Why it is in this group
- The name "brc_delete_sales_invoice" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC sales invoice by id using timestamp confirmation. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Sales Invoice
brc_delete_sales_repDeletes a BRC sales rep by id using timestamp confirmation.1 finding
Why it is in this group
- The name "brc_delete_sales_rep" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC sales rep by id using timestamp confirmation. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Sales Representative
brc_delete_supplierDeletes a BRC supplier by id.1 finding
Why it is in this group
- The name "brc_delete_supplier" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Deletes a BRC supplier by id. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Delete Supplier
brc_generate_sales_invoice_from_quoteGenerates a sales invoice from a BRC quote.1 finding
Why it is in this group
- The name "brc_generate_sales_invoice_from_quote" says "generate": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Generates a sales invoice from a BRC quote. Preview-before-posting shows the exact POST /v1/quotes/generateSaleInvoice body (quoteId and optional entryDate/procDate only). Nothing is written until you confirm. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Generate Sales Invoice from Quote
brc_process_vat_category_ratesProcesses VAT rates for VAT categories via POST /v1/vatCategories/vatRates.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Processes VAT rates for VAT categories via POST /v1/vatCategories/vatRates. Requires a full vatCategoryRates array and confirmProcess=true. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Process VAT Category Rates
brc_send_email_statementSends a customer-statement email to the customer address or an explicit recipient override.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "brc_send_email_statement" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "brc_send_email_statement" says "send": it sends or publishes something to other people.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Sends a customer-statement email to the customer address or an explicit recipient override. An unconfirmed call returns an email preview; confirmSend applies the send. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: true
- title: Send Account Statement Email
brc_send_quote_emailSends a quote email to the customer address or an explicit recipient override.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "brc_send_quote_email" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "brc_send_quote_email" says "send": it sends or publishes something to other people.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Sends a quote email to the customer address or an explicit recipient override. An unconfirmed call returns an email preview; confirmSend applies the send. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: true
- title: Send Quote Email
brc_send_sales_invoice_emailSends a sales-invoice email to the customer address or an explicit recipient override.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "brc_send_sales_invoice_email" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "brc_send_sales_invoice_email" says "send": it sends or publishes something to other people.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Sends a sales-invoice email to the customer address or an explicit recipient override. An unconfirmed call returns an email preview; confirmSend applies the send. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: true
- title: Send Sales Invoice Email
brc_update_accrualUpdates an accrual using its current concurrency timestamp.1 finding
Why it is in this group
- The name "brc_update_accrual" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates an accrual using its current concurrency timestamp. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Accrual
brc_update_allocationsUpdates transaction allocations using eligible receiver transactions and an unconfirmed payload preview.1 finding
Why it is in this group
- The name "brc_update_allocations" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates transaction allocations using eligible receiver transactions and an unconfirmed payload preview. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Allocations
brc_update_bank_accountUpdates a BRC bank account using merged fields.1 finding
Why it is in this group
- The name "brc_update_bank_account" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC bank account using merged fields. An unconfirmed call returns a plain-English change preview. Explicit confirmation is required before the update is applied. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Bank Account
brc_update_cash_paymentUpdates an existing Cash Payment by merging supplied fields onto the current record.1 finding
Why it is in this group
- The name "brc_update_cash_payment" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates an existing Cash Payment by merging supplied fields onto the current record. Fields that can be merged include total, entryDate, procDate, supplierId, acCode, note, ledger, discount, bankAccountId, bankAccountCode, lodgement, analysisCategoryId, accountCode, and description. This update flow is a verified action on the existing record. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Cash Payment
brc_update_cash_receiptUpdates a BRC cash receipt using merged fields.1 finding
Why it is in this group
- The name "brc_update_cash_receipt" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC cash receipt using merged fields. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Cash Receipt
brc_update_customerUpdates a BRC customer using merged fields.1 finding
Why it is in this group
- The name "brc_update_customer" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC customer using merged fields. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Customer
brc_update_nominal_journal_batchUpdates a nominal journal batch using its current concurrency timestamps.1 finding
Why it is in this group
- The name "brc_update_nominal_journal_batch" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a nominal journal batch using its current concurrency timestamps. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Nominal Journal Batch
brc_update_paymentUpdates a BRC payment using merged fields.1 finding
Why it is in this group
- The name "brc_update_payment" says "update": a word for a change.
- The name "brc_update_payment" also says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC payment using merged fields. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Payment
brc_update_prepaymentUpdates a prepayment using its current concurrency timestamp.1 finding
Why it is in this group
- The name "brc_update_prepayment" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a prepayment using its current concurrency timestamp. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Prepayment
brc_update_productUpdates a BRC product using merged fields.1 finding
Why it is in this group
- The name "brc_update_product" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC product using merged fields. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Product
brc_update_purchaseUpdates a BRC purchase using structured MCP fields.1 finding
Why it is in this group
- The name "brc_update_purchase" says "update": a word for a change.
- The name "brc_update_purchase" also says "purchase": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC purchase using structured MCP fields. Historical transaction dates are not automatically blocked. Existing historical purchases may support text, monetary, date and delete operations; the BRC endpoint is the source of truth. When changing monetary values, preserve the existing unpaid/unallocated state and allow BRC to recalculate allocation fields where required. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Purchase
brc_update_quoteUpdates a BRC quote's manual reference only.1 finding
Why it is in this group
- The name "brc_update_quote" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC quote's manual reference only. Quote.note is not persisted by this update and is not accepted here. Loads the current quote, preserves all other fields (including timestamp, product lines, analysis entries, totals, customer, sales rep, dates, comments, and closed state), applies the new reference, then PUTs the full record. Manual quote references must be 6 characters or fewer because Big Red Cloud truncates longer references. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Quote
brc_update_sales_credit_noteUpdates a sales credit note while preserving the existing BRC unpaid value.1 finding
Why it is in this group
- The name "brc_update_sales_credit_note" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a sales credit note while preserving the existing BRC unpaid value. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Sales Credit Note
brc_update_sales_entryUpdates a sales entry while preserving the existing BRC unpaid value.1 finding
Why it is in this group
- The name "brc_update_sales_entry" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a sales entry while preserving the existing BRC unpaid value. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Sales Entry
brc_update_sales_invoiceUpdates a sales invoice.1 finding
Why it is in this group
- The name "brc_update_sales_invoice" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a sales invoice. Supplied monetary changes must be explicit and reconciled. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Sales Invoice
brc_update_sales_repUpdates a BRC sales rep using structured MCP fields.1 finding
Why it is in this group
- The name "brc_update_sales_rep" says "update": a word for a change.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC sales rep using structured MCP fields. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Sales Representative
brc_update_supplierUpdates a BRC supplier using merged fields.1 finding
Why it is in this group
- The name "brc_update_supplier" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Updates a BRC supplier using merged fields. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: true
- title: Update Supplier

Changes things 14Creates or changes something that can be changed back.Claude Code: ask

brc_close_quoteCloses a BRC quote.1 finding
Why it is in this group
- The name "brc_close_quote" says "close": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Closes a BRC quote. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Close Quote
brc_confirm_company_connectionConfirms a short-lived company-connection code and returns the connected companies plus a reusable opaque connection reference.2 findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...opaque connection reference. Connection credentials are not returned."
  What this check looks for
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Confirms a short-lived company-connection code and returns the connected companies plus a reusable opaque connection reference. Connection credentials are not returned.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Confirm Company Connection
brc_create_bank_accountCreates a bank account after an unconfirmed preview.1 finding
Why it is in this group
- The name "brc_create_bank_account" says "create": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a bank account after an unconfirmed preview. confirmCreate applies the previewed creation. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Create Bank Account
brc_create_customerCreates a BRC customer from explicit code and name fields.1 finding
Why it is in this group
- The name "brc_create_customer" says "create": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a BRC customer from explicit code and name fields. Optional address, contact, credit and VAT fields are omitted when absent. Opening-balance fields are not posted. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Create Customer
brc_create_productCreates a BRC product using a raw BRC payload.1 finding
Why it is in this group
- The name "brc_create_product" says "create": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a BRC product using a raw BRC payload. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Create Product
brc_create_quoteCreates a quote with a caller-supplied reference and reconciled product, VAT and Sales-analysis lines.1 finding
Why it is in this group
- The name "brc_create_quote" says "create": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a quote with a caller-supplied reference and reconciled product, VAT and Sales-analysis lines. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Create Quote
brc_create_quote_gen_refCreates a quote using generated references and reconciled product, VAT and Sales-analysis lines.1 finding
Why it is in this group
- The name "brc_create_quote_gen_ref" says "create": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a quote using generated references and reconciled product, VAT and Sales-analysis lines. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation. Requires confirmCounterpartyExplicit: true; confirmation is scoped to the counterparty selected for the current preview.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Create Quote with Generated Reference
brc_create_sales_repCreates a BRC sales rep using structured MCP fields.1 finding
Why it is in this group
- The name "brc_create_sales_rep" says "create": a word for a change.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a BRC sales rep using structured MCP fields. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Create Sales Representative
brc_create_supplierCreates a BRC supplier using a raw BRC payload.1 finding
Why it is in this group
- The name "brc_create_supplier" says "create": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Creates a BRC supplier using a raw BRC payload. Does not create or update opening balance transactions. Opening-balance fields are not posted by this tool; supplier opening balances are entered directly in Big Red Cloud. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Create Supplier
brc_generate_support_reportReturns a downloadable support diagnostic and a concise summary for the current session.2 findings
Why it is in this group
- The name "brc_generate_support_report" says "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
- Warn
  The server marks "brc_generate_support_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "brc_generate_support_report" says "generate": a word for a change.
  What this check looks for
Description, as the server wrote it
Returns a downloadable support diagnostic and a concise summary for the current session.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Generate Support Report
brc_open_edu_adminReturns the protected education-administration URL.Reads text others write1 finding
Why it is in this group
- The name "brc_open_edu_admin" says "open": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe description's first sentence says "return" and "url": it reads web pages, which anyone can write.
Findings
- Warn
  The server marks "brc_open_edu_admin" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "brc_open_edu_admin" says "open": a word for a change.
  What this check looks for
Description, as the server wrote it
Returns the protected education-administration URL. Access requires Microsoft Entra sign-in and does not bypass authentication. The response contains no upload secret or bypass parameter.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Open Education Administration
brc_reopen_quoteReopens a BRC quote.1 finding
Why it is in this group
- The name "brc_reopen_quote" says "reopen": a word for a change.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Reopens a BRC quote. Requires a valid routeToken issued for the matching action workflow. The token remains valid through lookup, preview and the permitted transaction. Placeholder tokens are invalid. A routeToken does not bypass preview or explicit-confirmation requirements. A call without confirmWrite: true returns confirmation_required and a payload preview. confirmWrite: true applies the previewed change after explicit confirmation. Passing preflight is not confirmation.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Reopen Quote
brc_route_requestClassifies a supplied request as help, action, correction or unsupported.2 findings
Why it is in this group
- The name "brc_route_request" says "request": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
- Warn
  The server marks "brc_route_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "brc_route_request" says "request": a word for a change.
  What this check looks for
Description, as the server wrote it
Classifies a supplied request as help, action, correction or unsupported. Classification covers read, create, update, delete, correct, undo, reverse, email and batch actions, including creating a sales invoice or add a customer, plus help wording such as how do I. Compatible mode supports existing unsigned clients without claiming verified authorship. Strict mode requires host-signed original-message metadata and binds the routeToken to that request, company and workflow; missing or mismatched provenance returns no write permission in strict mode. Help and correction results do not issue transactional route tokens.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Route Request
brc_start_company_connectionStarts the secure Red / Big Red Cloud connection flow and returns a one-time connection page URL and confirmation code.2 findings
Why it is in this group
- The name "brc_start_company_connection" says "start": a word for a change.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...es, including CSV upload, and keeps API credentials outside chat. Available without an exis..."
  What this check looks for
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Starts the secure Red / Big Red Cloud connection flow and returns a one-time connection page URL and confirmation code. The secure page supports one or multiple companies, including CSV upload, and keeps API credentials outside chat. Available without an existing company connection.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false
- title: Start Company Connection

Only reads 78Looks things up and changes nothing.Show 78 read-only tools

brc_check_transaction_settingsReturns processing-setting warnings for one specified transaction workflow.1 finding
Why it is in this group
- The description's first verb is "return": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns processing-setting warnings for one specified transaction workflow. It does not provide an overall company-readiness score.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Check Transaction Settings
brc_company_readiness_checkReturns overall company readiness across connection, financial year, reference data, VAT, analysis categories and settings.1 finding
Why it is in this group
- The description's first verb is "return": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns overall company readiness across connection, financial year, reference data, VAT, analysis categories and settings.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Check Company Readiness
brc_find_help_resourcesSearches Big Red Cloud customer help across Freshdesk support articles, customer documentation, recorded webinar videos and upcoming webinars.No findings
Why it is in this group
- The name "brc_find_help_resources" says "find": a word for reading.
Description, as the server wrote it
Searches Big Red Cloud customer help across Freshdesk support articles, customer documentation, recorded webinar videos and upcoming webinars. Returns a synthesized answer, ordered guidance and public source metadata. Read-only and available without a connected company.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Find Help Resources
brc_get_accrualReturns information about a single parent Accrual by id.1 finding
Why it is in this group
- The name "brc_get_accrual" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns information about a single parent Accrual by id. Child accruals are not exposed by the public API.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Accrual
brc_get_bank_accountGets one BRC bank account by id.1 finding
Why it is in this group
- The name "brc_get_bank_account" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC bank account by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Bank Account
brc_get_cash_paymentGets one BRC cash payment by id.1 finding
Why it is in this group
- The name "brc_get_cash_payment" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC cash payment by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Cash Payment
brc_get_cash_receiptGets one BRC cash receipt by id.1 finding
Why it is in this group
- The name "brc_get_cash_receipt" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC cash receipt by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Cash Receipt
brc_get_company_api_key_statusReturns company connection-status metadata without returning API keys or other credentials.Reads private data2 findings
Why it is in this group
- The name "brc_get_company_api_key_status" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "credential": it reads secrets.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...ata without returning API keys or other credentials."
  What this check looks for
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns company connection-status metadata without returning API keys or other credentials.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Company API Key Status
brc_get_company_logoGets the company logo from BRC.1 finding
Why it is in this group
- The name "brc_get_company_logo" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets the company logo from BRC.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Company Logo
brc_get_company_processing_settingsReturns company processing settings that affect VAT-sensitive accounting workflows.1 finding
Why it is in this group
- The name "brc_get_company_processing_settings" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns company processing settings that affect VAT-sensitive accounting workflows.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Company Processing Settings
brc_get_company_reference_settingsReturns quote and transaction reference settings.1 finding
Why it is in this group
- The name "brc_get_company_reference_settings" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns quote and transaction reference settings. An Unknown quote-reference setting does not establish automatic reference generation.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Company Reference Settings
brc_get_company_setup_configGets full BRC company setup configuration, including general details, financial year, reference settings, and processing options.1 finding
Why it is in this group
- The name "brc_get_company_setup_config" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets full BRC company setup configuration, including general details, financial year, reference settings, and processing options.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Company Setup Configuration
brc_get_customerGets one BRC customer by id.1 finding
Why it is in this group
- The name "brc_get_customer" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC customer by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Customer
brc_get_customer_opening_balanceGets a customer's opening balance.1 finding
Why it is in this group
- The name "brc_get_customer_opening_balance" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets a customer's opening balance.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Customer Opening Balance
brc_get_deployment_policyReturns the deployment capability and permission summary, including enabled action groups and development-mode status.No findings
Why it is in this group
- The name "brc_get_deployment_policy" says "get": a word for reading.
Description, as the server wrote it
Returns the deployment capability and permission summary, including enabled action groups and development-mode status.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Deployment Policy
brc_get_financial_yearGets BRC company financial year.1 finding
Why it is in this group
- The name "brc_get_financial_year" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets BRC company financial year.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Financial Year
brc_get_help_resource_detailsReturns detailed public help-resource content, ordered instruction blocks, signed screenshot links, source metadata and optional image content.No findings
Why it is in this group
- The name "brc_get_help_resource_details" says "get": a word for reading.
Description, as the server wrote it
Returns detailed public help-resource content, ordered instruction blocks, signed screenshot links, source metadata and optional image content. Read-only and available without a connected company.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Help Resource Details
brc_get_nom_ac_ledger_by_idsReturns nominal-account ledgers for supplied account IDs.1 finding
Why it is in this group
- The name "brc_get_nom_ac_ledger_by_ids" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns nominal-account ledgers for supplied account IDs. Monthly values represent movements rather than monthly balances.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Nominal Account Ledgers by IDs
brc_get_nominal_account_ledger_by_idReturns one nominal account ledger and its period movements.1 finding
Why it is in this group
- The name "brc_get_nominal_account_ledger_by_id" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns one nominal account ledger and its period movements. Monthly values represent movements rather than monthly balances.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Nominal Account Ledger by ID
brc_get_nominal_journal_batchReturns information about a single Nominal Journal Batch by id.1 finding
Why it is in this group
- The name "brc_get_nominal_journal_batch" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns information about a single Nominal Journal Batch by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Nominal Journal Batch
brc_get_paymentGets one BRC payment by id.1 finding
Why it is in this group
- The name "brc_get_payment" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC payment by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Payment
brc_get_prepaymentReturns information about a single parent Prepayment by id.1 finding
Why it is in this group
- The name "brc_get_prepayment" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns information about a single parent Prepayment by id. Child prepayments are not exposed by the public API.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Prepayment
brc_get_productGets one BRC product by id.1 finding
Why it is in this group
- The name "brc_get_product" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC product by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Product
brc_get_purchaseGets one BRC purchase by id.1 finding
Why it is in this group
- The name "brc_get_purchase" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC purchase by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Purchase
brc_get_quoteGets one BRC quote by id.1 finding
Why it is in this group
- The name "brc_get_quote" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC quote by id. List and get may not return the same fields (for example note or analysis account codes); treat those as representation differences, not as create or update failures.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Quote
brc_get_sales_credit_noteGets one BRC sales credit note by id.Reads private data1 finding
Why it is in this group
- The name "brc_get_sales_credit_note" says "get": a word for reading.
What it can reach
- private-dataThe name "brc_get_sales_credit_note" says "get" and "note": it reads notes.
- private-dataThe description's first sentence says "get" and "note": it reads notes.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC sales credit note by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Sales Credit Note
brc_get_sales_entryGets one BRC sales entry by id.1 finding
Why it is in this group
- The name "brc_get_sales_entry" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC sales entry by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Sales Entry
brc_get_sales_invoiceGets one BRC sales invoice by id.1 finding
Why it is in this group
- The name "brc_get_sales_invoice" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC sales invoice by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Sales Invoice
brc_get_sales_repGets one BRC sales rep by id.1 finding
Why it is in this group
- The name "brc_get_sales_rep" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC sales rep by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Sales Representative
brc_get_supplierGets one BRC supplier by id.1 finding
Why it is in this group
- The name "brc_get_supplier" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets one BRC supplier by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Supplier
brc_get_supplier_opening_balanceGets a supplier's opening balance.1 finding
Why it is in this group
- The name "brc_get_supplier_opening_balance" says "get": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets a supplier's opening balance.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Supplier Opening Balance
brc_grouped_nominal_accounts_reportReturns a grouped nominal-account report with period movements rather than monthly balances.1 finding
Why it is in this group
- The description's first verb is "return": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns a grouped nominal-account report with period movements rather than monthly balances.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Grouped Nominal Accounts Report
brc_list_accountsLists BRC accounts.1 finding
Why it is in this group
- The name "brc_list_accounts" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC accounts.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Accounts
brc_list_accrualsReturns a list of the company's Accruals.1 finding
Why it is in this group
- The name "brc_list_accruals" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns a list of the company's Accruals. Supports optional OData filtering by entryDate. Supports optional ordering by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Accruals
brc_list_allocated_transactionsReturns existing transaction allocations and their identifiers.1 finding
Why it is in this group
- The name "brc_list_allocated_transactions" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns existing transaction allocations and their identifiers.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Allocated Transactions
brc_list_allocation_resolversReturns receiver transactions eligible for allocation updates.1 finding
Why it is in this group
- The name "brc_list_allocation_resolvers" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns receiver transactions eligible for allocation updates.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Allocation Resolvers
brc_list_analysis_categoriesReturns company analysis categories and their book context.1 finding
Why it is in this group
- The name "brc_list_analysis_categories" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns company analysis categories and their book context. Customer-control categories are distinct from Sales analysis categories.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Analysis Categories
brc_list_audit_logReturns current-session audit entries scoped to currently connected companies.1 finding
Why it is in this group
- The name "brc_list_audit_log" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns current-session audit entries scoped to currently connected companies. Entries from other sessions, connections or companies are excluded.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Audit Log
brc_list_bank_accountsLists BRC bank accounts.1 finding
Why it is in this group
- The name "brc_list_bank_accounts" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC bank accounts.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Bank Accounts
brc_list_book_tran_typesLists BRC book transaction types.1 finding
Why it is in this group
- The name "brc_list_book_tran_types" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC book transaction types.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Book Transaction Types
brc_list_cash_paymentsLists BRC cash payments.1 finding
Why it is in this group
- The name "brc_list_cash_payments" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC cash payments.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Cash Payments
brc_list_cash_receiptsLists BRC cash receipts.1 finding
Why it is in this group
- The name "brc_list_cash_receipts" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC cash receipts. entryDate is the accounting period date; procDate is the transaction/processing date. Customer and procDate filters use a complete bounded local scan (10,000 records), not upstream OData; narrow entryDate when needed.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Cash Receipts
brc_list_category_typesLists BRC category types.1 finding
Why it is in this group
- The name "brc_list_category_types" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC category types.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Category Types
brc_list_company_contextsReturns connected-company contexts and connection-expiry metadata, including duration, remaining time and timezone details.2 findings
Why it is in this group
- The name "brc_list_company_contexts" says "list": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...g time and timezone details. Connection credentials are not returned."
  What this check looks for
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns connected-company contexts and connection-expiry metadata, including duration, remaining time and timezone details. Connection credentials are not returned.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Company Contexts
brc_list_company_settingsLists BRC company settings.1 finding
Why it is in this group
- The name "brc_list_company_settings" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC company settings.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Company Settings
brc_list_customer_account_transReturns customer account transactions.1 finding
Why it is in this group
- The name "brc_list_customer_account_trans" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns customer account transactions. Transaction IDs and types are endpoint- and company-specific.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Customer Account Transactions
brc_list_customer_op_bal_transGets a customer's opening balance transaction list.1 finding
Why it is in this group
- The name "brc_list_customer_op_bal_trans" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets a customer's opening balance transaction list.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Customer Opening Balance Transactions
brc_list_customer_quotesGets quotes for a specific customer.1 finding
Why it is in this group
- The name "brc_list_customer_quotes" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets quotes for a specific customer.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Customer Quotes
brc_list_customersLists BRC customers.1 finding
Why it is in this group
- The name "brc_list_customers" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC customers. customerCode uses exact case-sensitive bounded local lookup (10,000 records); BRC forbids customer OData filters.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Customers
brc_list_customers_without_dormantLists BRC customers without dormant records.1 finding
Why it is in this group
- The name "brc_list_customers_without_dormant" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC customers without dormant records.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Active Customers
brc_list_nominal_accountsReturns nominal accounts and period movements.1 finding
Why it is in this group
- The name "brc_list_nominal_accounts" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns nominal accounts and period movements. Monthly values represent movements rather than monthly balances.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Nominal Accounts
brc_list_nominal_journal_batchesReturns nominal journal batches with identifiers and concurrency timestamps.1 finding
Why it is in this group
- The name "brc_list_nominal_journal_batches" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns nominal journal batches with identifiers and concurrency timestamps.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Nominal Journal Batches
brc_list_owner_type_groupsLists BRC owner type groups.1 finding
Why it is in this group
- The name "brc_list_owner_type_groups" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC owner type groups.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Owner Type Groups
brc_list_owner_typesLists BRC owner types.1 finding
Why it is in this group
- The name "brc_list_owner_types" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC owner types.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Owner Types
brc_list_paymentsLists BRC payments.1 finding
Why it is in this group
- The name "brc_list_payments" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC payments.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Payments
brc_list_prepaymentsReturns a list of the company's Prepayments.1 finding
Why it is in this group
- The name "brc_list_prepayments" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns a list of the company's Prepayments. Supports optional OData filtering by entryDate. Supports optional ordering by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Prepayments
brc_list_product_typesLists BRC product types.1 finding
Why it is in this group
- The name "brc_list_product_types" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC product types.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Product Types
brc_list_productsLists BRC products.1 finding
Why it is in this group
- The name "brc_list_products" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC products.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Products
brc_list_products_without_dormantLists BRC products without dormant records.1 finding
Why it is in this group
- The name "brc_list_products_without_dormant" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC products without dormant records.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Active Products
brc_list_purchasesLists BRC purchases.1 finding
Why it is in this group
- The name "brc_list_purchases" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC purchases.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Purchases
brc_list_quotesLists BRC quotes.1 finding
Why it is in this group
- The name "brc_list_quotes" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC quotes. List and get may not return the same fields (for example note or analysis account codes); treat those as representation differences, not as create or update failures. Quote references are not necessarily unique — identify a quote by id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Quotes
brc_list_salesLists combined BRC sales entries, sales invoices and sales credit notes.Reads private data1 finding
Why it is in this group
- The name "brc_list_sales" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "note": it reads notes.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists combined BRC sales entries, sales invoices and sales credit notes.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Sales
brc_list_sales_credit_notesLists BRC sales credit notes.Reads private data1 finding
Why it is in this group
- The name "brc_list_sales_credit_notes" says "list": a word for reading.
What it can reach
- private-dataThe name "brc_list_sales_credit_notes" says "list" and "note": it reads notes.
- private-dataThe description's first sentence says "list" and "note": it reads notes.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC sales credit notes.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Sales Credit Notes
brc_list_sales_entriesLists BRC sales entries.1 finding
Why it is in this group
- The name "brc_list_sales_entries" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC sales entries.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Sales Entries
brc_list_sales_invoicesLists BRC sales invoices.1 finding
Why it is in this group
- The name "brc_list_sales_invoices" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC sales invoices.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Sales Invoices
brc_list_sales_repsLists BRC sales reps.1 finding
Why it is in this group
- The name "brc_list_sales_reps" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC sales reps.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Sales Representatives
brc_list_supplier_account_transReturns supplier account transactions.1 finding
Why it is in this group
- The name "brc_list_supplier_account_trans" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns supplier account transactions. Transaction IDs and types are endpoint- and company-specific.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Supplier Account Transactions
brc_list_supplier_op_bal_transGets a supplier's opening balance transaction list.1 finding
Why it is in this group
- The name "brc_list_supplier_op_bal_trans" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Gets a supplier's opening balance transaction list.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Supplier Opening Balance Transactions
brc_list_suppliersLists BRC suppliers.1 finding
Why it is in this group
- The name "brc_list_suppliers" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC suppliers.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List Suppliers
brc_list_user_defined_fieldsLists BRC user defined fields.1 finding
Why it is in this group
- The name "brc_list_user_defined_fields" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC user defined fields.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List User-Defined Fields
brc_list_vat_analysis_typesLists BRC VAT analysis types.1 finding
Why it is in this group
- The name "brc_list_vat_analysis_types" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC VAT analysis types.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List VAT Analysis Types
brc_list_vat_categoriesReturns company VAT categories and their Sales or Purchase context.1 finding
Why it is in this group
- The name "brc_list_vat_categories" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns company VAT categories and their Sales or Purchase context.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List VAT Categories
brc_list_vat_ratesReturns company VAT rates and their associated category identifiers.1 finding
Why it is in this group
- The name "brc_list_vat_rates" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns company VAT rates and their associated category identifiers.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List VAT Rates
brc_list_vat_typesLists BRC VAT types.1 finding
Why it is in this group
- The name "brc_list_vat_types" says "list": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Lists BRC VAT types.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List VAT Types
brc_multi_company_nom_ac_reportReturns a multi-company nominal-account report with period movements rather than monthly balances.1 finding
Why it is in this group
- The description's first verb is "return": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Returns a multi-company nominal-account report with period movements rather than monthly balances.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Multi-Company Nominal Account Report
brc_red_helpReturns Big Red Cloud help and manual Big Red Cloud instructions for how-to questions, including how do I queries and tutorials.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Returns Big Red Cloud help and manual Big Red Cloud instructions for how-to questions, including how do I queries and tutorials. Covers topics including sales invoices, purchases, customers, suppliers, banking, VAT, reports and company setup. Searches Freshdesk, YouTube, BRC Edu, webinars and screenshots. Read-only and available without a connected company.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Get Red Help
brc_resolve_book_transaction_typeResolves a company-specific bookTranTypeId against live transaction-type reference data.1 finding
Why it is in this group
- The name "brc_resolve_book_transaction_type" says "resolve": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Resolves a company-specific bookTranTypeId against live transaction-type reference data. Descriptions and numeric IDs are not globally stable.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Resolve Book Transaction Type
brc_validate_transaction_dateChecks whether a proposed transaction date is inside the connected BRC company's current financial year.1 finding
Why it is in this group
- The name "brc_validate_transaction_date" says "validate": a word for reading.
Findings
- Info
  The input schema at properties.connectionRef.description mentions "credentials".
  Matched text
  inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
  What this check looks for
Description, as the server wrote it
Checks whether a proposed transaction date is inside the connected BRC company's current financial year.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: Validate Transaction Date

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

48 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 outbound tools breaks every one.

Reads private data4: Reads files, mail, messages, databases, secrets, calendars or repositories.; brc_get_company_api_key_status
brc_get_sales_credit_note
brc_list_sales
brc_list_sales_credit_notes
Reads text others write4: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; brc_open_edu_admin
brc_send_email_statement
brc_send_quote_email
brc_send_sales_invoice_email
Can send data out3: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; brc_send_email_statement
brc_send_quote_email
brc_send_sales_invoice_email

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__red__brc_send_email_statement",
      "mcp__red__brc_send_quote_email",
      "mcp__red__brc_send_sales_invoice_email"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:50 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 81
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: not observed
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

HighThe whole server
The endpoint served tools/list without credentials, and the list has 81 tools that change things (67 destructive, 14 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://red.bigredcloud.com/mcp: tools/list returned 159 tools to an anonymous client, including brc_clear_company_api_key (destructive), brc_clear_all_company_api_keys (destructive), brc_update_customer (destructive), brc_delete_customer (destructive), brc_update_supplier (destructive) and 76 more
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

4 warn159 info

Warnbrc_route_request
The server marks "brc_route_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "brc_route_request" says "request": a word for a change.
What this check looks for
Warnbrc_open_edu_admin
The server marks "brc_open_edu_admin" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "brc_open_edu_admin" says "open": a word for a change.
What this check looks for
Warnbrc_generate_support_report
The server marks "brc_generate_support_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "brc_generate_support_report" says "generate": a word for a change.
What this check looks for
Warnbrc_clear_audit_log
The server marks "brc_clear_audit_log" destructive (destructiveHint: true), and its name says "log", a word for reading.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":true,"openWorldHint":false}; The name "brc_clear_audit_log" says "log": a word for reading.
What this check looks for
Infobrc_start_company_connection
The description mentions "credentials".
Matched text
description: "...es, including CSV upload, and keeps API credentials outside chat. Available without an exis..."
What this check looks for
Infobrc_start_company_connection
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for

Show 157 more findings

Infobrc_confirm_company_connection
The description mentions "credentials".
Matched text
description: "...opaque connection reference. Connection credentials are not returned."
What this check looks for
Infobrc_confirm_company_connection
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_company_api_key_status
The description mentions "credentials".
Matched text
description: "...ata without returning API keys or other credentials."
What this check looks for
Infobrc_get_company_api_key_status
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_company_contexts
The description mentions "credentials".
Matched text
description: "...g time and timezone details. Connection credentials are not returned."
What this check looks for
Infobrc_list_company_contexts
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_clear_company_api_key
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_clear_all_company_api_keys
The description mentions "credentials".
Matched text
description: "Clears all connection credentials for all company contexts from MCP serve..."
What this check looks for
Infobrc_clear_all_company_api_keys
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_accounts
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_customers
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_customer
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_customers_without_dormant
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_suppliers
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_supplier
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_products
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_product_types
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_products_without_dormant
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_sales_entries
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_sales_entry
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_sales_invoices
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_sales_invoice
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_purchases
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_purchase
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_analysis_categories
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_vat_rates
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_vat_analysis_types
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_vat_categories
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_vat_types
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_company_settings
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_category_types
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_owner_type_groups
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_owner_types
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_user_defined_fields
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_book_tran_types
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_nominal_accounts
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_nominal_account_ledger_by_id
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_quotes
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_quote
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_sales_credit_notes
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_sales_credit_note
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_sales_reps
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_sales_rep
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_company_setup_config
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_company_logo
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_financial_year
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_customer
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_customer
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_customer
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_customer_opening_balance
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_customer_op_bal_trans
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_customer_account_trans
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_customer_quotes
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_supplier
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_supplier
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_supplier
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_supplier_opening_balance
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_supplier_op_bal_trans
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_supplier_account_trans
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_purchase
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_purchase_gen_ref
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_purchase
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_purchase
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_sales_entry
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_sales_entry
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_sales_entry
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_sales_invoice
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_sales_invoice_gen_ref
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_sales_invoice
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_sales_invoice
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_quote
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_quote_gen_ref
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_quote
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_close_quote
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_reopen_quote
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_quote
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_generate_sales_invoice_from_quote
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_sales_credit_note
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_sales_credit_note_gen_ref
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_sales_credit_note
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_sales_credit_note
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_sales_rep
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_sales_rep
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_sales_rep
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_nom_ac_ledger_by_ids
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_grouped_nominal_accounts_report
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_multi_company_nom_ac_report
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_cash_payments
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_cash_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_cash_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_cash_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_cash_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_cash_payments
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_cash_receipts
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_cash_receipt
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_cash_receipt
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_cash_receipt
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_cash_receipt
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_cash_receipts
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_payments
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_payment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_payments
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_bank_accounts
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_bank_account
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_bank_account
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_bank_account
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_bank_account
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_product
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_product
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_product
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_product
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_purchases
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_quotes
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_sales_credit_notes
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_sales_entries
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_sales_invoices
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_sales_reps
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_suppliers
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_customers
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_batch_products
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_sales
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_process_vat_category_rates
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_validate_transaction_date
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_company_readiness_check
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_resolve_book_transaction_type
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_route_request
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_audit_log
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_generate_support_report
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_clear_audit_log
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_send_sales_invoice_email
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_send_email_statement
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_send_quote_email
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_company_processing_settings
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_company_reference_settings
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_check_transaction_settings
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_allocation_resolvers
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_allocations
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_allocated_transactions
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_allocation_resolver
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_nominal_journal_batches
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_nominal_journal_batch
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_nominal_journal_batch
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_nominal_journal_batch
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_nominal_journal_batch
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_accruals
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_accrual
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_accrual
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_accrual
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_accrual
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_list_prepayments
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_get_prepayment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_create_prepayment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_update_prepayment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for
Infobrc_delete_prepayment
The input schema at properties.connectionRef.description mentions "credentials".
Matched text
inputSchema.properties.connectionRef.description: "...is not an API key and does not contain credentials."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.4.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http red https://red.bigredcloud.com/mcp

claude mcp add --transport http red https://red.bigredcloud.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__red__brc_get_company_api_key_status",
      "mcp__red__brc_list_company_contexts",
      "mcp__red__brc_list_accounts",
      "mcp__red__brc_list_customers",
      "mcp__red__brc_get_customer",
      "mcp__red__brc_list_customers_without_dormant",
      "mcp__red__brc_list_suppliers",
      "mcp__red__brc_get_supplier",
      "mcp__red__brc_list_products",
      "mcp__red__brc_list_product_types",
      "mcp__red__brc_list_products_without_dormant",
      "mcp__red__brc_list_sales_entries",
      "mcp__red__brc_get_sales_entry",
      "mcp__red__brc_list_sales_invoices",
      "mcp__red__brc_get_sales_invoice",
      "mcp__red__brc_list_purchases",
      "mcp__red__brc_get_purchase",
      "mcp__red__brc_list_analysis_categories",
      "mcp__red__brc_list_vat_rates",
      "mcp__red__brc_list_vat_analysis_types",
      "mcp__red__brc_list_vat_categories",
      "mcp__red__brc_list_vat_types",
      "mcp__red__brc_list_company_settings",
      "mcp__red__brc_list_category_types",
      "mcp__red__brc_list_owner_type_groups",
      "mcp__red__brc_list_owner_types",
      "mcp__red__brc_list_user_defined_fields",
      "mcp__red__brc_list_book_tran_types",
      "mcp__red__brc_list_nominal_accounts",
      "mcp__red__brc_get_nominal_account_ledger_by_id",
      "mcp__red__brc_list_quotes",
      "mcp__red__brc_get_quote",
      "mcp__red__brc_list_sales_credit_notes",
      "mcp__red__brc_get_sales_credit_note",
      "mcp__red__brc_list_sales_reps",
      "mcp__red__brc_get_sales_rep",
      "mcp__red__brc_get_company_setup_config",
      "mcp__red__brc_get_company_logo",
      "mcp__red__brc_get_financial_year",
      "mcp__red__brc_get_customer_opening_balance",
      "mcp__red__brc_list_customer_op_bal_trans",
      "mcp__red__brc_list_customer_account_trans",
      "mcp__red__brc_list_customer_quotes",
      "mcp__red__brc_get_supplier_opening_balance",
      "mcp__red__brc_list_supplier_op_bal_trans",
      "mcp__red__brc_list_supplier_account_trans",
      "mcp__red__brc_get_nom_ac_ledger_by_ids",
      "mcp__red__brc_grouped_nominal_accounts_report",
      "mcp__red__brc_multi_company_nom_ac_report",
      "mcp__red__brc_list_cash_payments",
      "mcp__red__brc_get_cash_payment",
      "mcp__red__brc_list_cash_receipts",
      "mcp__red__brc_get_cash_receipt",
      "mcp__red__brc_list_payments",
      "mcp__red__brc_get_payment",
      "mcp__red__brc_list_bank_accounts",
      "mcp__red__brc_get_bank_account",
      "mcp__red__brc_get_product",
      "mcp__red__brc_list_sales",
      "mcp__red__brc_get_deployment_policy",
      "mcp__red__brc_validate_transaction_date",
      "mcp__red__brc_company_readiness_check",
      "mcp__red__brc_resolve_book_transaction_type",
      "mcp__red__brc_red_help",
      "mcp__red__brc_find_help_resources",
      "mcp__red__brc_get_help_resource_details",
      "mcp__red__brc_list_audit_log",
      "mcp__red__brc_get_company_processing_settings",
      "mcp__red__brc_get_company_reference_settings",
      "mcp__red__brc_check_transaction_settings",
      "mcp__red__brc_list_allocation_resolvers",
      "mcp__red__brc_list_allocated_transactions",
      "mcp__red__brc_list_nominal_journal_batches",
      "mcp__red__brc_get_nominal_journal_batch",
      "mcp__red__brc_list_accruals",
      "mcp__red__brc_get_accrual",
      "mcp__red__brc_list_prepayments",
      "mcp__red__brc_get_prepayment"
    ],
    "ask": [
      "mcp__red__brc_start_company_connection",
      "mcp__red__brc_confirm_company_connection",
      "mcp__red__brc_create_customer",
      "mcp__red__brc_create_supplier",
      "mcp__red__brc_create_quote",
      "mcp__red__brc_create_quote_gen_ref",
      "mcp__red__brc_close_quote",
      "mcp__red__brc_reopen_quote",
      "mcp__red__brc_create_sales_rep",
      "mcp__red__brc_create_bank_account",
      "mcp__red__brc_create_product",
      "mcp__red__brc_route_request",
      "mcp__red__brc_open_edu_admin",
      "mcp__red__brc_generate_support_report"
    ],
    "deny": [
      "mcp__red__brc_clear_company_api_key",
      "mcp__red__brc_clear_all_company_api_keys",
      "mcp__red__brc_update_customer",
      "mcp__red__brc_delete_customer",
      "mcp__red__brc_update_supplier",
      "mcp__red__brc_delete_supplier",
      "mcp__red__brc_create_purchase",
      "mcp__red__brc_create_purchase_gen_ref",
      "mcp__red__brc_update_purchase",
      "mcp__red__brc_delete_purchase",
      "mcp__red__brc_create_sales_entry",
      "mcp__red__brc_update_sales_entry",
      "mcp__red__brc_delete_sales_entry",
      "mcp__red__brc_create_sales_invoice",
      "mcp__red__brc_create_sales_invoice_gen_ref",
      "mcp__red__brc_update_sales_invoice",
      "mcp__red__brc_delete_sales_invoice",
      "mcp__red__brc_update_quote",
      "mcp__red__brc_delete_quote",
      "mcp__red__brc_generate_sales_invoice_from_quote",
      "mcp__red__brc_create_sales_credit_note",
      "mcp__red__brc_create_sales_credit_note_gen_ref",
      "mcp__red__brc_update_sales_credit_note",
      "mcp__red__brc_delete_sales_credit_note",
      "mcp__red__brc_update_sales_rep",
      "mcp__red__brc_delete_sales_rep",
      "mcp__red__brc_create_cash_payment",
      "mcp__red__brc_update_cash_payment",
      "mcp__red__brc_delete_cash_payment",
      "mcp__red__brc_batch_cash_payments",
      "mcp__red__brc_create_cash_receipt",
      "mcp__red__brc_update_cash_receipt",
      "mcp__red__brc_delete_cash_receipt",
      "mcp__red__brc_batch_cash_receipts",
      "mcp__red__brc_create_payment",
      "mcp__red__brc_update_payment",
      "mcp__red__brc_delete_payment",
      "mcp__red__brc_batch_payments",
      "mcp__red__brc_update_bank_account",
      "mcp__red__brc_delete_bank_account",
      "mcp__red__brc_update_product",
      "mcp__red__brc_delete_product",
      "mcp__red__brc_batch_purchases",
      "mcp__red__brc_batch_quotes",
      "mcp__red__brc_batch_sales_credit_notes",
      "mcp__red__brc_batch_sales_entries",
      "mcp__red__brc_batch_sales_invoices",
      "mcp__red__brc_batch_sales_reps",
      "mcp__red__brc_batch_suppliers",
      "mcp__red__brc_batch_customers",
      "mcp__red__brc_batch_products",
      "mcp__red__brc_process_vat_category_rates",
      "mcp__red__brc_clear_audit_log",
      "mcp__red__brc_send_sales_invoice_email",
      "mcp__red__brc_send_email_statement",
      "mcp__red__brc_send_quote_email",
      "mcp__red__brc_update_allocations",
      "mcp__red__brc_delete_allocation_resolver",
      "mcp__red__brc_create_nominal_journal_batch",
      "mcp__red__brc_update_nominal_journal_batch",
      "mcp__red__brc_delete_nominal_journal_batch",
      "mcp__red__brc_create_accrual",
      "mcp__red__brc_update_accrual",
      "mcp__red__brc_delete_accrual",
      "mcp__red__brc_create_prepayment",
      "mcp__red__brc_update_prepayment",
      "mcp__red__brc_delete_prepayment"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as red. Review it before you use it.

Capability tags behind 8 rules

mcp__red__brc_get_company_api_key_status private-data
mcp__red__brc_list_sales_credit_notes private-data
mcp__red__brc_get_sales_credit_note private-data
mcp__red__brc_list_sales private-data
mcp__red__brc_open_edu_admin untrusted-input
mcp__red__brc_send_sales_invoice_email untrusted-input, outbound
mcp__red__brc_send_email_statement untrusted-input, outbound
mcp__red__brc_send_quote_email untrusted-input, outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.BigRedCloud/red-mcp-server/verify?hash=d8175ebf743a47ab8942f3894ce7620155705233cfcc6e0437d8a42654a710d3" | jq -e '.changed == false'

Pinned hash d8175ebf743a, from Oct 21, 2026, 19:02 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.BigRedCloud/red-mcp-server/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.BigRedCloud/red-mcp-server.svg)](https://anlyon.dev/servers/io.github.BigRedCloud/red-mcp-server)

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:14 UTC.