Loyverse MCP by usefulapi
by usefulapi.io · remote · no sign-in to list tools · v1.16.4 · published by io.usefulapi
Query Loyverse POS receipts, shifts, items, inventory and customers, and update stock and customers.
Deletes · 4
21 tools: 4 can delete or cancel things and 17 only read.
Scanned Oct 22, 2026
- Deletes or cancels4Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things0Claude Code: ask
- Only reads17Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http loyverse https://loyverse.usefulapi.io/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
21 tools
Deletes or cancels 4Claude Code: deny
loyverse_set_inventory_levelsSet the ABSOLUTE stock (`stock_after`) of one or more variants at given stores — e.g.No findings
Why it is in this group
- The name "loyverse_set_inventory_levels" says "set": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Set the ABSOLUTE stock (`stock_after`) of one or more variants at given stores — e.g. after a stock count. This overwrites the current level rather than adding to it; read the current levels with loyverse_list_inventory first so they can be restored. Loyverse: POST /inventory.
Annotations the server declares
- title: Set inventory levels
- destructiveHint: true
loyverse_upsert_categoryCreate an item category, or rename/recolor one by passing its `id`.No findings
Why it is in this group
- The name "loyverse_upsert_category" says "upsert": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Create an item category, or rename/recolor one by passing its `id`. Loyverse: POST /categories.
Annotations the server declares
- title: Create or update a category
- destructiveHint: true
loyverse_upsert_customerCreate a loyalty customer, or update one by passing its `id`.No findings
Why it is in this group
- The name "loyverse_upsert_customer" says "upsert": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Create a loyalty customer, or update one by passing its `id`. Loyverse does not document whether omitted fields survive an update, so on update fetch the customer first and send the full record. Loyverse: POST /customers.
Annotations the server declares
- title: Create or update a customer
- destructiveHint: true
loyverse_upsert_supplierCreate a supplier, or update one by passing its `id`.No findings
Why it is in this group
- The name "loyverse_upsert_supplier" says "upsert": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Create a supplier, or update one by passing its `id`. Loyverse does not document whether omitted fields survive an update, so on update send the full record. Loyverse: POST /suppliers/.
Annotations the server declares
- title: Create or update a supplier
- destructiveHint: true
Only reads 17Claude Code: allow
loyverse_get_customerFetch a single customer by id, with visits, total spent and points balance.No findings
Why it is in this group
- The name "loyverse_get_customer" says "get": a word for reading.
Description, as the server wrote it Fetch a single customer by id, with visits, total spent and points balance. Loyverse: GET /customers/{customer_id}.
Annotations the server declares
- title: Get one customer
- readOnlyHint: true
loyverse_get_itemFetch a single catalog item by id, with its variants.No findings
Why it is in this group
- The name "loyverse_get_item" says "get": a word for reading.
Description, as the server wrote it Fetch a single catalog item by id, with its variants. Loyverse: GET /items/{item_id}.
Annotations the server declares
- title: Get one item
- readOnlyHint: true
loyverse_get_merchantFetch the merchant account this token belongs to — business name, email, country and currency.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "loyverse_get_merchant" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "fetch" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "fetch" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it Fetch the merchant account this token belongs to — business name, email, country and currency. A cheap way to confirm the token works. Loyverse: GET /merchant/.
Annotations the server declares
- title: Get the merchant
- readOnlyHint: true
loyverse_get_receiptFetch a single receipt by its receipt number (e.g.No findings
Why it is in this group
- The name "loyverse_get_receipt" says "get": a word for reading.
Description, as the server wrote it Fetch a single receipt by its receipt number (e.g. 2-1008), with line items, modifiers, discounts, taxes and payments. Loyverse: GET /receipts/{receipt_number}.
Annotations the server declares
- title: Get one receipt
- readOnlyHint: true
loyverse_list_categoriesList item categories.No findings
Why it is in this group
- The name "loyverse_list_categories" says "list": a word for reading.
Description, as the server wrote it List item categories. Loyverse: GET /categories.
Annotations the server declares
- title: List categories
- readOnlyHint: true
loyverse_list_customersList loyalty customers, newest first, with visits, total spent and points balance.No findings
Why it is in this group
- The name "loyverse_list_customers" says "list": a word for reading.
Description, as the server wrote it List loyalty customers, newest first, with visits, total spent and points balance. Filter by email or ids. Loyverse: GET /customers.
Annotations the server declares
- title: List customers
- readOnlyHint: true
loyverse_list_discountsList configured discounts (fixed/variable percent or amount, discount-by-points) and where they apply.No findings
Why it is in this group
- The name "loyverse_list_discounts" says "list": a word for reading.
Description, as the server wrote it List configured discounts (fixed/variable percent or amount, discount-by-points) and where they apply. Loyverse: GET /discounts.
Annotations the server declares
- title: List discounts
- readOnlyHint: true
loyverse_list_employeesList employees, with the stores each can access and whether they are the owner.No findings
Why it is in this group
- The name "loyverse_list_employees" says "list": a word for reading.
Description, as the server wrote it List employees, with the stores each can access and whether they are the owner. Loyverse: GET /employees.
Annotations the server declares
- title: List employees
- readOnlyHint: true
loyverse_list_inventoryList current stock (`in_stock`) per variant per store.No findings
Why it is in this group
- The name "loyverse_list_inventory" says "list": a word for reading.
Description, as the server wrote it List current stock (`in_stock`) per variant per store. Filter by stores and/or variants — the answer to 'what is running low?'. Loyverse: GET /inventory.
Annotations the server declares
- title: List inventory levels
- readOnlyHint: true
loyverse_list_itemsList catalog items with their variants (SKU, barcode, price, cost, per-store pricing), category, taxes and modifiers.No findings
Why it is in this group
- The name "loyverse_list_items" says "list": a word for reading.
Description, as the server wrote it List catalog items with their variants (SKU, barcode, price, cost, per-store pricing), category, taxes and modifiers. Loyverse: GET /items.
Annotations the server declares
- title: List items
- readOnlyHint: true
loyverse_list_payment_typesList the payment types (cash, card, integrated terminals…) and the stores where each is available.No findings
Why it is in this group
- The name "loyverse_list_payment_types" says "list": a word for reading.
Description, as the server wrote it List the payment types (cash, card, integrated terminals…) and the stores where each is available. Receipt payments reference these ids. Loyverse: GET /payment_types.
Annotations the server declares
- title: List payment types
- readOnlyHint: true
loyverse_list_receiptsList sales and refund receipts, newest first, with line items, payments, discounts and taxes.No findings
Why it is in this group
- The name "loyverse_list_receipts" says "list": a word for reading.
Description, as the server wrote it List sales and refund receipts, newest first, with line items, payments, discounts and taxes. Filter by store, time range or receipt numbers — the core of any sales question. Loyverse: GET /receipts.
Annotations the server declares
- title: List receipts
- readOnlyHint: true
loyverse_list_shiftsList cash-register shifts with their cash, gross/net sales, refunds, discounts, taxes, per-payment-type totals and pay-in/pay-out movements — the end-of-day view.No findings
Why it is in this group
- The name "loyverse_list_shifts" says "list": a word for reading.
Description, as the server wrote it List cash-register shifts with their cash, gross/net sales, refunds, discounts, taxes, per-payment-type totals and pay-in/pay-out movements — the end-of-day view. Loyverse: GET /shifts.
Annotations the server declares
- title: List shifts
- readOnlyHint: true
loyverse_list_storesList the merchant's stores (locations) with their addresses.No findings
Why it is in this group
- The name "loyverse_list_stores" says "list": a word for reading.
Description, as the server wrote it List the merchant's stores (locations) with their addresses. Store ids are what the receipt, shift and inventory filters take. Loyverse: GET /stores.
Annotations the server declares
- title: List stores
- readOnlyHint: true
loyverse_list_suppliersList suppliers with their contact details.Reads private dataNo findings
Why it is in this group
- The name "loyverse_list_suppliers" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "contact": it reads contacts.
Description, as the server wrote it List suppliers with their contact details. Loyverse: GET /suppliers/.
Annotations the server declares
- title: List suppliers
- readOnlyHint: true
loyverse_list_taxesList taxes with their rate, whether they are INCLUDED in or ADDED to the price, and the stores they apply in.No findings
Why it is in this group
- The name "loyverse_list_taxes" says "list": a word for reading.
Description, as the server wrote it List taxes with their rate, whether they are INCLUDED in or ADDED to the price, and the stores they apply in. Loyverse: GET /taxes.
Annotations the server declares
- title: List taxes
- readOnlyHint: true
loyverse_list_variantsList item variants — the sellable SKUs — optionally for given items or one SKU.No findings
Why it is in this group
- The name "loyverse_list_variants" says "list": a word for reading.
Description, as the server wrote it List item variants — the sellable SKUs — optionally for given items or one SKU. Variant ids are what inventory levels are keyed on. Loyverse: GET /variants.
Annotations the server declares
- title: List item variants
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.16.4. Values in angle brackets are yours to fill in.
claude mcp add --transport http loyverse https://loyverse.usefulapi.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__loyverse__loyverse_get_merchant",
"mcp__loyverse__loyverse_list_stores",
"mcp__loyverse__loyverse_list_employees",
"mcp__loyverse__loyverse_list_receipts",
"mcp__loyverse__loyverse_get_receipt",
"mcp__loyverse__loyverse_list_shifts",
"mcp__loyverse__loyverse_list_items",
"mcp__loyverse__loyverse_get_item",
"mcp__loyverse__loyverse_list_variants",
"mcp__loyverse__loyverse_list_categories",
"mcp__loyverse__loyverse_list_inventory",
"mcp__loyverse__loyverse_list_customers",
"mcp__loyverse__loyverse_get_customer",
"mcp__loyverse__loyverse_list_payment_types",
"mcp__loyverse__loyverse_list_discounts",
"mcp__loyverse__loyverse_list_taxes",
"mcp__loyverse__loyverse_list_suppliers"
],
"ask": [],
"deny": [
"mcp__loyverse__loyverse_upsert_customer",
"mcp__loyverse__loyverse_upsert_category",
"mcp__loyverse__loyverse_upsert_supplier",
"mcp__loyverse__loyverse_set_inventory_levels"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as loyverse. Review it before you use it.
Capability tags behind 2 rules
- mcp__loyverse__loyverse_get_merchant private-data, untrusted-input
- mcp__loyverse__loyverse_list_suppliers private-data