Skip to content
anlyon.devby Anlyon

Laudus MCP by usefulapi

io.usefulapi/laudususefulapi.iostreamable-httpv1.0.0Scanned

Read Laudus ERP customers, sales, purchases, stock and accounting reports; create customers.

38 tools: 1 do something that can't be undone, 10 change things and 27 only read.

Tools: 0 delete, 1 irreversible, 10 write, 27 read.
  • Reads private data · 3
  • Reads text others write · 38
  • Can send data out · 1
  • 1 finding

Anlyon alternative

11 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

38 tools

Can't be undone 1Claude Code: ask
  • laudus_purchase_ledgerThe purchases ledger (libro de compras) for a year and month.Reads text others write1 finding

    Why it is in this group

    • The name "laudus_purchase_ledger" says "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "laudus_purchase_ledger" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "laudus_purchase_ledger" says "purchase": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    The purchases ledger (libro de compras) for a year and month. GET /purchases/invoices/ledger.

    Annotations the server declares

    • title: Purchase ledger
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Changes things 10Claude Code: ask
  • laudus_balance_sheetThe balance sheet (balance general) as of a date, either the standard layout or the totals layout.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The balance sheet (balance general) as of a date, either the standard layout or the totals layout. GET /accounting/balanceSheet/standard or /totals.

    Annotations the server declares

    • title: Balance sheet
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_create_customerWRITE: creates a new customer in Laudus (the customer id is assigned by Laudus; the customer record is not an invoice and sends nothing).Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "laudus_create_customer" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    WRITE: creates a new customer in Laudus (the customer id is assigned by Laudus; the customer record is not an invoice and sends nothing). Check laudus_list_customers for the RUT first to avoid duplicates. Laudus may require more fields than given and answers with its validation message. POST /sales/customers.

    Annotations the server declares

    • title: Create a customer
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • laudus_customer_credit_limitA customer's credit limit and how much of it is used.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    A customer's credit limit and how much of it is used. GET /sales/customers/{id}/creditLimit.

    Annotations the server declares

    • title: Customer credit limit
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_customer_pending_invoicesUnpaid sales invoices (accounts receivable).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Unpaid sales invoices (accounts receivable). Give customer_id for one customer, or leave it out for all customers. GET /sales/customers/{id}/pendingInvoices or /sales/customers/pendingInvoices.

    Annotations the server declares

    • title: Customer pending invoices
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_general_ledgerThe general ledger (libro mayor) movements of an account or a range of account numbers, for a date range.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The general ledger (libro mayor) movements of an account or a range of account numbers, for a date range. GET /accounting/ledger.

    Annotations the server declares

    • title: General ledger
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_pending_sales_ordersThe ids of sales orders not yet delivered, optionally for one customer or a due-date range.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The ids of sales orders not yet delivered, optionally for one customer or a due-date range. GET /sales/orders/pending.

    Annotations the server declares

    • title: Pending sales orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_product_kardexThe stock movements (kardex) of one product, optionally to a date and for one warehouse.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The stock movements (kardex) of one product, optionally to a date and for one warehouse. GET /production/products/{id}/kardex.

    Annotations the server declares

    • title: Product kardex
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_profit_and_lossThe profit and loss statement (estado de resultados) for a date range.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The profit and loss statement (estado de resultados) for a date range. GET /accounting/profitAndLoss.

    Annotations the server declares

    • title: Profit and loss
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_sales_invoice_receiptsThe customer payments (cobros) applied to one sales invoice.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The customer payments (cobros) applied to one sales invoice. GET /sales/invoices/{id}/receipts.

    Annotations the server declares

    • title: Sales invoice receipts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_sales_reportInvoiced sales totals grouped by day of week, day of month, month, year, salesman, customer, customer category, product, product category, county, state or branch, for a date range…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Invoiced sales totals grouped by day of week, day of month, month, year, salesman, customer, customer category, product, product category, county, state or branch, for a date range and optional filters. GET /reports/sales/invoices/{group}.

    Annotations the server declares

    • title: Sales report
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Only reads 27Show 27 read-only tools
  • laudus_get_customerGet a customer (addresses, contact data, credit limit, category, salesman, price list) by id.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_customer" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a customer (addresses, contact data, credit limit, category, salesman, price list) by id. GET /sales/customers/{id}.

    Annotations the server declares

    • title: Get a customer
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_journal_entryGet an accounting journal entry (comprobante) with its lines by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_journal_entry" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get an accounting journal entry (comprobante) with its lines by id. GET /accounting/journal/entries/{id}.

    Annotations the server declares

    • title: Get a journal entry
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_productGet a product (SKU, description, category, units, prices) by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_product" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a product (SKU, description, category, units, prices) by id. GET /production/products/{id}.

    Annotations the server declares

    • title: Get a product
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_product_stockStock of one product, optionally as of a date, in one warehouse or lot; with by_warehouse true, the stock in each warehouse.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_product_stock" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Stock of one product, optionally as of a date, in one warehouse or lot; with by_warehouse true, the stock in each warehouse. GET /production/products/{id}/stock or /stockByWarehouses.

    Annotations the server declares

    • title: Get product stock
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_purchase_invoiceGet a purchase invoice with its lines by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_purchase_invoice" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a purchase invoice with its lines by id. GET /purchases/invoices/{id}.

    Annotations the server declares

    • title: Get a purchase invoice
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_purchase_orderGet a purchase order with its lines by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_purchase_order" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a purchase order with its lines by id. GET /purchases/orders/{id}.

    Annotations the server declares

    • title: Get a purchase order
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_sales_invoiceGet a sales invoice with its lines, taxes and totals by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_sales_invoice" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a sales invoice with its lines, taxes and totals by id. GET /sales/invoices/{id}.

    Annotations the server declares

    • title: Get a sales invoice
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_sales_orderGet a sales order with its lines by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_sales_order" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a sales order with its lines by id. GET /sales/orders/{id}.

    Annotations the server declares

    • title: Get a sales order
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_sales_quoteGet a sales quote with its lines by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_sales_quote" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a sales quote with its lines by id. GET /sales/quotes/{id}.

    Annotations the server declares

    • title: Get a sales quote
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_get_supplierGet a supplier by id.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_get_supplier" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a supplier by id. GET /purchases/suppliers/{id}.

    Annotations the server declares

    • title: Get a supplier
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_accountsList the chart of accounts (plan de cuentas) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_accounts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the chart of accounts (plan de cuentas) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example accountId, accountNumber, name. When a page is full, ask for the next one with offset = offset + limit. POST /accounting/accounts/list.

    Annotations the server declares

    • title: List accounting accounts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_cost_centersList cost centers (centros de costo) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_cost_centers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List cost centers (centros de costo) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example costCenterId, name, code. When a page is full, ask for the next one with offset = offset + limit. POST /purchases/costcenters/list.

    Annotations the server declares

    • title: List cost centers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_customer_contactsThe contact people of a customer.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_customer_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "laudus_list_customer_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The contact people of a customer. GET /sales/customers/{id}/contacts.

    Annotations the server declares

    • title: List customer contacts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_customersList customers with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_customers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List customers with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example customerId, name, legalName, VATId, email, phone1, city, county, creditLimit, blocked, customerCategory.name, salesman.name. When a page is full, ask for the next one with offset = offset + limit. POST /sales/customers/list.

    Annotations the server declares

    • title: List customers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_journal_entriesList accounting journal entries (comprobantes) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_journal_entries" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List accounting journal entries (comprobantes) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example journalEntryId, journalEntryNumber, date, lines.account.accountNumber, lines.debit, lines.credit. When a page is full, ask for the next one with offset = offset + limit. POST /accounting/journal/entries/list.

    Annotations the server declares

    • title: List journal entries
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_product_categoriesList product categories with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_product_categories" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List product categories with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example productCategoryId, name, fullPath. When a page is full, ask for the next one with offset = offset + limit. POST /production/products/categories/list.

    Annotations the server declares

    • title: List product categories
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_productsList products and services (the item master) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_products" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List products and services (the item master) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example productId, sku, description, productCategory.name, unitOfMeasure, unitPrice, stockable, discontinued. When a page is full, ask for the next one with offset = offset + limit. POST /production/products/list.

    Annotations the server declares

    • title: List products
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_purchase_invoicesList purchase invoices (facturas de compra) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_purchase_invoices" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List purchase invoices (facturas de compra) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example purchaseInvoiceId, docNumber, issuedDate, dueDate, supplier.name, totals.total. When a page is full, ask for the next one with offset = offset + limit. POST /purchases/invoices/list.

    Annotations the server declares

    • title: List purchase invoices
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_purchase_ordersList purchase orders (ordenes de compra) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_purchase_orders" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List purchase orders (ordenes de compra) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example purchaseOrderId, issuedDate, supplier.name, status, items.product.sku, items.quantity. When a page is full, ask for the next one with offset = offset + limit. POST /purchases/orders/list.

    Annotations the server declares

    • title: List purchase orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_sales_invoicesList sales invoices and electronic tax documents (facturas, notas de credito) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_sales_invoices" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List sales invoices and electronic tax documents (facturas, notas de credito) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example salesInvoiceId, docType.name, docNumber, issuedDate, dueDate, customer.name, customer.VATId, totals.net, totals.total, items.product.sku, items.quantity. When a page is full, ask for the next one with offset = offset + limit. POST /sales/invoices/list.

    Annotations the server declares

    • title: List sales invoices
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_sales_ordersList sales orders (pedidos de venta) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_sales_orders" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List sales orders (pedidos de venta) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example salesOrderId, issuedDate, dueDate, customer.name, items.product.sku, items.quantity. When a page is full, ask for the next one with offset = offset + limit. POST /sales/orders/list.

    Annotations the server declares

    • title: List sales orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_sales_quotesList sales quotes (cotizaciones) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_sales_quotes" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List sales quotes (cotizaciones) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example salesQuoteId, issuedDate, customer.name, items.product.sku, items.quantity. When a page is full, ask for the next one with offset = offset + limit. POST /sales/quotes/list.

    Annotations the server declares

    • title: List sales quotes
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_sales_receiptsList customer payments received (cobros) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_sales_receipts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List customer payments received (cobros) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example receiptId, receiptType, issuedDate, dueDate. When a page is full, ask for the next one with offset = offset + limit. POST /sales/receipts/list.

    Annotations the server declares

    • title: List sales receipts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_salesmenList salespeople (vendedores) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_salesmen" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List salespeople (vendedores) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example salesmanId, name. When a page is full, ask for the next one with offset = offset + limit. POST /sales/salesmen/list.

    Annotations the server declares

    • title: List salespeople
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_stockStock of every product, optionally as of a date, for one warehouse or one product category.Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_stock" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Stock of every product, optionally as of a date, for one warehouse or one product category. Can be large: filter by warehouse or category. GET /production/products/stock.

    Annotations the server declares

    • title: List stock of all products
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_suppliersList suppliers (proveedores) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_suppliers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List suppliers (proveedores) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example supplierId, name, legalName, VATId, email, phone, city. When a page is full, ask for the next one with offset = offset + limit. POST /purchases/suppliers/list.

    Annotations the server declares

    • title: List suppliers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • laudus_list_warehousesList warehouses (bodegas) with filters, sorting, field selection and paging (rows 25 by default, at most 200).Reads text others writeNo findings

    Why it is in this group

    • The name "laudus_list_warehouses" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List warehouses (bodegas) with filters, sorting, field selection and paging (rows 25 by default, at most 200). Field names follow the Laudus data model, for example warehouseId, name, city. When a page is full, ask for the next one with offset = offset + limit. POST /production/warehouses/list.

    Annotations the server declares

    • title: List warehouses
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

114 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write38
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__laudus__laudus_create_customer"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnlaudus_purchase_ledger

    The server marks "laudus_purchase_ledger" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "laudus_purchase_ledger" says "purchase": a word that usually means money moves, which cannot be taken back.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http laudus https://laudus.usefulapi.io/mcp
claude mcp add --transport http laudus https://laudus.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__laudus__laudus_list_customers",
      "mcp__laudus__laudus_list_sales_invoices",
      "mcp__laudus__laudus_list_sales_orders",
      "mcp__laudus__laudus_list_sales_quotes",
      "mcp__laudus__laudus_list_sales_receipts",
      "mcp__laudus__laudus_list_products",
      "mcp__laudus__laudus_list_product_categories",
      "mcp__laudus__laudus_list_warehouses",
      "mcp__laudus__laudus_list_salesmen",
      "mcp__laudus__laudus_list_suppliers",
      "mcp__laudus__laudus_list_purchase_invoices",
      "mcp__laudus__laudus_list_purchase_orders",
      "mcp__laudus__laudus_list_accounts",
      "mcp__laudus__laudus_list_journal_entries",
      "mcp__laudus__laudus_list_cost_centers",
      "mcp__laudus__laudus_get_customer",
      "mcp__laudus__laudus_get_sales_invoice",
      "mcp__laudus__laudus_get_sales_order",
      "mcp__laudus__laudus_get_sales_quote",
      "mcp__laudus__laudus_get_product",
      "mcp__laudus__laudus_get_supplier",
      "mcp__laudus__laudus_get_purchase_invoice",
      "mcp__laudus__laudus_get_purchase_order",
      "mcp__laudus__laudus_get_journal_entry",
      "mcp__laudus__laudus_list_customer_contacts",
      "mcp__laudus__laudus_get_product_stock",
      "mcp__laudus__laudus_list_stock"
    ],
    "ask": [
      "mcp__laudus__laudus_customer_pending_invoices",
      "mcp__laudus__laudus_customer_credit_limit",
      "mcp__laudus__laudus_sales_invoice_receipts",
      "mcp__laudus__laudus_pending_sales_orders",
      "mcp__laudus__laudus_sales_report",
      "mcp__laudus__laudus_product_kardex",
      "mcp__laudus__laudus_balance_sheet",
      "mcp__laudus__laudus_profit_and_loss",
      "mcp__laudus__laudus_general_ledger",
      "mcp__laudus__laudus_purchase_ledger",
      "mcp__laudus__laudus_create_customer"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as laudus. Review it before you use it.

Capability tags behind 38 rules
  • mcp__laudus__laudus_list_customers untrusted-input
  • mcp__laudus__laudus_list_sales_invoices private-data, untrusted-input
  • mcp__laudus__laudus_list_sales_orders untrusted-input
  • mcp__laudus__laudus_list_sales_quotes untrusted-input
  • mcp__laudus__laudus_list_sales_receipts untrusted-input
  • mcp__laudus__laudus_list_products untrusted-input
  • mcp__laudus__laudus_list_product_categories untrusted-input
  • mcp__laudus__laudus_list_warehouses untrusted-input
  • mcp__laudus__laudus_list_salesmen untrusted-input
  • mcp__laudus__laudus_list_suppliers untrusted-input
  • mcp__laudus__laudus_list_purchase_invoices untrusted-input
  • mcp__laudus__laudus_list_purchase_orders untrusted-input
  • mcp__laudus__laudus_list_accounts untrusted-input
  • mcp__laudus__laudus_list_journal_entries untrusted-input
  • mcp__laudus__laudus_list_cost_centers untrusted-input
  • mcp__laudus__laudus_get_customer private-data, untrusted-input
  • mcp__laudus__laudus_get_sales_invoice untrusted-input
  • mcp__laudus__laudus_get_sales_order untrusted-input
  • mcp__laudus__laudus_get_sales_quote untrusted-input
  • mcp__laudus__laudus_get_product untrusted-input
  • mcp__laudus__laudus_get_supplier untrusted-input
  • mcp__laudus__laudus_get_purchase_invoice untrusted-input
  • mcp__laudus__laudus_get_purchase_order untrusted-input
  • mcp__laudus__laudus_get_journal_entry untrusted-input
  • mcp__laudus__laudus_customer_pending_invoices untrusted-input
  • mcp__laudus__laudus_customer_credit_limit untrusted-input
  • mcp__laudus__laudus_list_customer_contacts private-data, untrusted-input
  • mcp__laudus__laudus_sales_invoice_receipts untrusted-input
  • mcp__laudus__laudus_pending_sales_orders untrusted-input
  • mcp__laudus__laudus_sales_report untrusted-input
  • mcp__laudus__laudus_get_product_stock untrusted-input
  • mcp__laudus__laudus_list_stock untrusted-input
  • mcp__laudus__laudus_product_kardex untrusted-input
  • mcp__laudus__laudus_balance_sheet untrusted-input
  • mcp__laudus__laudus_profit_and_loss untrusted-input
  • mcp__laudus__laudus_general_ledger untrusted-input
  • mcp__laudus__laudus_purchase_ledger untrusted-input
  • mcp__laudus__laudus_create_customer untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/laudus/verify?hash=1d023d8229a1d1230edacb13bc2b569ad7aff2fa639f41d9ab58bd41fd236ce8" | jq -e '.changed == false'

Pinned hash 1d023d8229a1, from Oct 26, 2026, 07:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/laudus/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/laudus
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/laudus.svg)](https://anlyon.dev/servers/io.usefulapi/laudus)

Source: MCP Registry · repository. Synced Oct 26, 2026, 07:18 UTC.