Skip to content
anlyon.devby Anlyon

Bukku MCP by usefulapi

io.usefulapi/bukkuusefulapi.iostreamable-httpv1.0.0Scanned

Read Bukku contacts, accounts, invoices, bills and journals; create contacts and sales invoices.

23 tools: 3 change things and 20 only read.

Tools: 0 delete, 0 irreversible, 3 write, 20 read.
  • Reads private data · 9
  • Reads text others write · 23
  • Can send data out · 0
  • No findings

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

23 tools

Changes things 3Claude Code: ask
  • bukku_create_contactWRITE: create a contact (customer, supplier and/or employee) in Bukku.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_create_contact" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a contact (customer, supplier and/or employee) in Bukku. The contact code must be unique (A-Z, 0-9, _ and -, max 15 characters). POST /contacts.

    Annotations the server declares

    • title: Create contact
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • bukku_create_sales_invoiceWRITE: create a sales invoice for a customer.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_create_sales_invoice" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a sales invoice for a customer. status defaults to draft (nothing posted to the ledger), status ready finalizes it and affects the books. payment_mode credit needs term_items, cash needs deposit_items. Companies with MyInvois submission switched on must pass myinvois_action when status is ready: NORMAL (not sent), EXTERNAL (already validated elsewhere) or VALIDATE (submits the invoice to LHDN MyInvois, which cannot be taken back). Look up contact, account, term and tax code ids first. POST /sales/invoices.

    Annotations the server declares

    • title: Create sales invoice
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • bukku_set_contact_archivedWRITE: archive (is_archived true) or restore (false) a contact.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_set_contact_archived" says "set": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: archive (is_archived true) or restore (false) a contact. Archiving hides it from active lists; nothing is deleted. PATCH /contacts/{id}.

    Annotations the server declares

    • title: Archive or unarchive contact
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 20Show 20 read-only tools
  • bukku_get_accountOne ledger account by id.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_account" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One ledger account by id. GET /accounts/{id}.

    Annotations the server declares

    • title: Get account
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_get_bank_transactionOne money in, money out or transfer transaction in full.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_bank_transaction" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One money in, money out or transfer transaction in full. GET /banking/{incomes|expenses|transfers}/{id}.

    Annotations the server declares

    • title: Get bank transaction
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_get_contactOne contact with its persons, addresses, tax and registration numbers, default accounts and credit limit.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_contact" says "get": a word for reading.

    What it can reach

    • private-dataThe name "bukku_get_contact" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One contact with its persons, addresses, tax and registration numbers, default accounts and credit limit. GET /contacts/{id}.

    Annotations the server declares

    • title: Get contact
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_get_journal_entryOne journal entry with its debit and credit lines.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_journal_entry" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One journal entry with its debit and credit lines. GET /journal_entries/{id}.

    Annotations the server declares

    • title: Get journal entry
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_get_lookup_listsReference data needed to fill in documents: tax codes, payment terms, payment methods, currencies, countries, accounts, contact groups, product groups, price levels, tag groups, nu…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_lookup_lists" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reference data needed to fill in documents: tax codes, payment terms, payment methods, currencies, countries, accounts, contact groups, product groups, price levels, tag groups, number formats, custom fields and company settings. Read-only (POST /v2/lists is a read endpoint).

    Annotations the server declares

    • title: Get lookup lists
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_get_productOne product with its units, prices, accounts and tax settings.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_product" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One product with its units, prices, accounts and tax settings. GET /products/{id}.

    Annotations the server declares

    • title: Get product
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_get_purchase_documentOne purchase document in full (lines, taxes, terms, payments, status): a bill, order, goods received note, credit note, payment or refund.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_purchase_document" says "get": a word for reading.

    What it can reach

    • private-dataThe name "bukku_get_purchase_document" says "get" and "document": it reads documents.
    • private-dataThe description's first sentence says "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One purchase document in full (lines, taxes, terms, payments, status): a bill, order, goods received note, credit note, payment or refund. GET /purchases/{type}/{id}.

    Annotations the server declares

    • title: Get purchase document
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_get_sales_documentOne sales document in full (lines, taxes, terms, payments, status): an invoice, quote, order, delivery order, credit note, payment or refund.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_get_sales_document" says "get": a word for reading.

    What it can reach

    • private-dataThe name "bukku_get_sales_document" says "get" and "document": it reads documents.
    • private-dataThe description's first sentence says "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One sales document in full (lines, taxes, terms, payments, status): an invoice, quote, order, delivery order, credit note, payment or refund. GET /sales/{type}/{id}.

    Annotations the server declares

    • title: Get sales document
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_accountsList ledger accounts from the chart of accounts, optionally by category.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_accounts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List ledger accounts from the chart of accounts, optionally by category. Account ids are used on invoice lines. GET /accounts.

    Annotations the server declares

    • title: List accounts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_bank_transactionsList banking transactions: money in (incomes), money out (expenses) or transfers between accounts.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_bank_transactions" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List banking transactions: money in (incomes), money out (expenses) or transfers between accounts. contact_id and sort_by do not apply to transfers. GET /banking/{incomes|expenses|transfers}.

    Annotations the server declares

    • title: List bank transactions
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_contact_groupsList the contact groups; use their ids to filter bukku_list_contacts.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_contact_groups" says "list": a word for reading.

    What it can reach

    • private-dataThe name "bukku_list_contact_groups" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the contact groups; use their ids to filter bukku_list_contacts. GET /contacts/groups.

    Annotations the server declares

    • title: List contact groups
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_contactsList contacts (customers, suppliers, employees) with name, code, type, receivable and payable balances.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "bukku_list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List contacts (customers, suppliers, employees) with name, code, type, receivable and payable balances. Search matches the name, receivable, payable and created date. GET /contacts.

    Annotations the server declares

    • title: List contacts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_journal_entriesList manual journal entries by date, status or keywords.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_journal_entries" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List manual journal entries by date, status or keywords. GET /journal_entries.

    Annotations the server declares

    • title: List journal entries
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_product_groupsList the product groups.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_product_groups" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the product groups. GET /products/groups.

    Annotations the server declares

    • title: List product groups
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_productsList products and bundles (sales and purchase details, SKU, stock).Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_products" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List products and bundles (sales and purchase details, SKU, stock). GET /products.

    Annotations the server declares

    • title: List products
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_purchase_billsList purchase bills with number, date, supplier, amount, balance and payment status.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_purchase_bills" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List purchase bills with number, date, supplier, amount, balance and payment status. Filter by date, supplier, payment status (PAID, OUTSTANDING, OVERDUE) or keywords. GET /purchases/bills.

    Annotations the server declares

    • title: List purchase bills
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_purchase_documentsList purchase orders, goods received notes, supplier credit notes, supplier payments or refunds (bills have their own tool, bukku_list_purchase_bills).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_purchase_documents" says "list": a word for reading.

    What it can reach

    • private-dataThe name "bukku_list_purchase_documents" says "list" and "document": it reads documents.
    • private-dataThe description's first sentence says "list" and "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List purchase orders, goods received notes, supplier credit notes, supplier payments or refunds (bills have their own tool, bukku_list_purchase_bills). payment_status applies to credit notes, payments and refunds only. GET /purchases/{orders|goods_received_notes|credit_notes|payments|refunds}.

    Annotations the server declares

    • title: List other purchase documents
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_sales_documentsList quotes, sales orders, delivery orders, credit notes, customer payments or refunds (invoices have their own tool, bukku_list_sales_invoices).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_sales_documents" says "list": a word for reading.

    What it can reach

    • private-dataThe name "bukku_list_sales_documents" says "list" and "document": it reads documents.
    • private-dataThe description's first sentence says "list" and "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List quotes, sales orders, delivery orders, credit notes, customer payments or refunds (invoices have their own tool, bukku_list_sales_invoices). payment_status applies to credit notes, payments and refunds only. GET /sales/{quotes|orders|delivery_orders|credit_notes|payments|refunds}.

    Annotations the server declares

    • title: List other sales documents
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_sales_invoicesList sales invoices with number, date, contact, amount, balance and payment status.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_sales_invoices" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List sales invoices with number, date, contact, amount, balance and payment status. Filter by date, customer, payment status (PAID, OUTSTANDING, OVERDUE) or keywords. GET /sales/invoices.

    Annotations the server declares

    • title: List sales invoices
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bukku_list_tagsList the tags (labels) that can be put on transactions.Reads text others writeNo findings

    Why it is in this group

    • The name "bukku_list_tags" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the tags (labels) that can be put on transactions. GET /tags.

    Annotations the server declares

    • title: List tags
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data9
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write23
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http bukku https://bukku.usefulapi.io/mcp
claude mcp add --transport http bukku https://bukku.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__bukku__bukku_list_contacts",
      "mcp__bukku__bukku_get_contact",
      "mcp__bukku__bukku_list_contact_groups",
      "mcp__bukku__bukku_list_accounts",
      "mcp__bukku__bukku_get_account",
      "mcp__bukku__bukku_list_products",
      "mcp__bukku__bukku_get_product",
      "mcp__bukku__bukku_list_product_groups",
      "mcp__bukku__bukku_list_sales_invoices",
      "mcp__bukku__bukku_list_sales_documents",
      "mcp__bukku__bukku_get_sales_document",
      "mcp__bukku__bukku_list_purchase_bills",
      "mcp__bukku__bukku_list_purchase_documents",
      "mcp__bukku__bukku_get_purchase_document",
      "mcp__bukku__bukku_list_journal_entries",
      "mcp__bukku__bukku_get_journal_entry",
      "mcp__bukku__bukku_list_bank_transactions",
      "mcp__bukku__bukku_get_bank_transaction",
      "mcp__bukku__bukku_list_tags",
      "mcp__bukku__bukku_get_lookup_lists"
    ],
    "ask": [
      "mcp__bukku__bukku_create_contact",
      "mcp__bukku__bukku_set_contact_archived",
      "mcp__bukku__bukku_create_sales_invoice"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bukku. Review it before you use it.

Capability tags behind 23 rules
  • mcp__bukku__bukku_list_contacts private-data, untrusted-input
  • mcp__bukku__bukku_get_contact private-data, untrusted-input
  • mcp__bukku__bukku_list_contact_groups private-data, untrusted-input
  • mcp__bukku__bukku_list_accounts untrusted-input
  • mcp__bukku__bukku_get_account untrusted-input
  • mcp__bukku__bukku_list_products untrusted-input
  • mcp__bukku__bukku_get_product untrusted-input
  • mcp__bukku__bukku_list_product_groups untrusted-input
  • mcp__bukku__bukku_list_sales_invoices private-data, untrusted-input
  • mcp__bukku__bukku_list_sales_documents private-data, untrusted-input
  • mcp__bukku__bukku_get_sales_document private-data, untrusted-input
  • mcp__bukku__bukku_list_purchase_bills untrusted-input
  • mcp__bukku__bukku_list_purchase_documents private-data, untrusted-input
  • mcp__bukku__bukku_get_purchase_document private-data, untrusted-input
  • mcp__bukku__bukku_list_journal_entries untrusted-input
  • mcp__bukku__bukku_get_journal_entry untrusted-input
  • mcp__bukku__bukku_list_bank_transactions untrusted-input
  • mcp__bukku__bukku_get_bank_transaction untrusted-input
  • mcp__bukku__bukku_list_tags untrusted-input
  • mcp__bukku__bukku_get_lookup_lists private-data, untrusted-input
  • mcp__bukku__bukku_create_contact untrusted-input
  • mcp__bukku__bukku_set_contact_archived untrusted-input
  • mcp__bukku__bukku_create_sales_invoice untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/bukku/verify?hash=b4fa94f4d8e51a262165354d2588d5bb3b56530a8e4175b63e19715b9cb5f0dd" | jq -e '.changed == false'

Pinned hash b4fa94f4d8e5, from Oct 26, 2026, 01:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/bukku/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/bukku
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/bukku.svg)](https://anlyon.dev/servers/io.usefulapi/bukku)

Source: MCP Registry · repository. Synced Oct 26, 2026, 01:17 UTC.