paper-invoice-mcp (igun997/paper-invoice-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 72 tools. No publisher has claimed this listing.
MCP server for Paper.id Indonesian invoicing and accounting platform, providing 31 tools for partner and invoice management, QRIS payments, and reporting with automatic token refresh.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
igun997
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
paperid_refresh_tokenRe-login and refresh the JWT token stored in SQLite. Uses PAPERID_PHONE + PAPERID_PASSWORD from env, or pass credentials directly.
paperid_get_token_infoGet current token metadata from SQLite (expiry, user_id, company_id). Does not expose the raw token.
paperid_loginLogin to Paper.id with phone and password
paperid_get_current_userGet current authenticated user information
paperid_get_companyGet company details
paperid_get_sales_invoicesGet sales invoices with filters and pagination
paperid_get_partnersGet partners/clients list
paperid_get_account_receivableGet account receivable insights (unpaid, partially paid, overdue)
paperid_get_account_payableGet account payable insights
paperid_get_profit_lossGet profit and loss report
paperid_get_kyc_statusGet KYC verification status
paperid_get_user_packageGet user subscription package info
paperid_get_onboarding_statusGet company onboarding completion status
paperid_get_referral_linkGet user referral code and link
paperid_get_notificationsGet user notifications
paperid_get_dashboard_todosGet dashboard to-do list
paperid_get_bannersGet promotional banners
paperid_get_payment_numberGet next auto-generated payment number (e.g. PYI/2026/0010)
paperid_get_finance_accountsGet all finance accounts (bank + cash) used in payment form dropdown
paperid_get_payment_methodsGet payment methods list with UUIDs (Bank Transfer, Cash, Credit Card, etc.)
paperid_create_paymentCreate a payment receipt (Kuitansi Penjualan) for one or more invoices
paperid_get_paymentsList payment receipts (Kuitansi Penjualan) with filters and pagination
paperid_get_payment_pdfGet payment receipt PDF data
paperid_send_paymentSend payment receipt via WhatsApp, Email, or SMS
paperid_delete_paymentDelete a payment receipt by UUID
paperid_get_paperpay_balanceGet PaperPay In balance (Saldo Aktif, Dana Sedang Diproses, credit/debit totals)
paperid_get_digital_payment_transactionsList PaperPay In digital payment transactions (reconcile/all). Includes QRIS, Credit Card, Bank Transfer, e-wallet payments.
paperid_get_productsList products (Produk & Stok). POST /api/v1/inventory/products/all
paperid_get_productGet a single product by UUID. GET /api/v1/invoicer/products/{uuid}
paperid_get_next_product_skuGet the next auto-generated product SKU code. GET /api/v1/invoicer/products/sku/
paperid_create_productCreate a new product. POST /api/v1/invoicer/products
paperid_update_productUpdate an existing product. PUT /api/v1/invoicer/products/{uuid}
paperid_delete_productDelete (soft-delete) a product. DELETE /api/v1/invoicer/products/{uuid}
paperid_get_product_categoriesList all product categories. GET /api/v1/invoicer/categories
paperid_get_product_categoryGet single product category by UUID. GET /api/v1/invoicer/categories/{uuid}
paperid_create_product_categoryCreate a product category. POST /api/v1/invoicer/categories
paperid_update_product_categoryUpdate a product category. PUT /api/v1/invoicer/categories/{uuid}
paperid_delete_product_categoryDelete a product category. DELETE /api/v1/invoicer/categories/{uuid}
paperid_get_units_of_measureList units of measure (150 global units). POST /api/v2/saturn/uom/all
paperid_create_unit_of_measureCreate a custom unit of measure. POST /api/v2/saturn/uom
paperid_update_unit_of_measureUpdate a unit of measure. PUT /api/v2/saturn/uom/{uuid}
paperid_delete_unit_of_measureDelete a unit of measure. DELETE /api/v2/saturn/uom/{uuid}
paperid_get_uom_categoriesList UoM categories (Kategori Unit). POST /api/v1/saturn/uom-category/all
paperid_get_uom_categoryGet single UoM category by UUID. GET /api/v1/saturn/uom-category/{uuid}
paperid_create_uom_categoryCreate a UoM category (Kategori Unit). POST /api/v1/saturn/uom-category. Can assign UoM UUIDs to the category.
paperid_update_uom_categoryUpdate a UoM category. PUT /api/v1/saturn/uom-category/{uuid}
paperid_delete_uom_categoryDelete a UoM category. DELETE /api/v1/saturn/uom-category/{uuid}
paperid_get_stock_locationsList all stock locations (warehouses). GET /api/v1/inventory/locations
paperid_get_stock_type_locationsList stock-type locations only (where products can be stored). GET /api/v1/inventory/locations/types/stock
paperid_get_stock_documentsList stock documents (Dokumen Stok). POST /api/v1/inventory/stock-documents-all. Types: gr=Penerimaan Barang, do=Surat Jalan, sa=Penyesuaian Stok, sc=Stok Opname.
paperid_get_next_stock_document_numberGet next auto-generated stock document number. GET /api/v1/inventory/stock-documents/next-number/{type}. Types: gr (Penerimaan Barang GR/YYYY/NNNN), do (Surat Jalan DO/YYYY/NNNN), sa (Penyesuaian Stok SA/YYYY/NNNN), sc (Stok Opname SC/YYYY/NNNN).
paperid_get_tracked_productsList products with stock tracking enabled (track_stock=1). POST /api/v1/inventory/products/tracked. Only tracked products can be used in stock documents.
paperid_get_inventoryList inventory (Persediaan) — current stock levels per product. POST /api/v2/saturn/products/fifo/all.
paperid_get_stock_dashboardGet stock dashboard card info. POST /api/v1/inventory/dashboard/get-card-info. data_type: gr=Penerimaan Barang (goods receipt), do=Surat Jalan (delivery order).
paperid_get_inventory_settingsGet inventory meta settings (direct_purchase/sales defaults, default locations). GET /api/v1/inventory/inventory-meta-settings.
paperid_update_product_track_stockEnable or disable stock tracking on a product. PUT /api/v1/saturn/products/{uuid}. Products must have track_stock=true to appear in stock documents.
paperid_get_partnerGet a single partner by UUID
paperid_create_partnerCreate a new partner/client/supplier
paperid_update_partnerUpdate an existing partner
paperid_delete_partnerDelete a partner by UUID
paperid_get_partner_contactsGet contacts for a partner
paperid_get_partner_bank_accountsGet bank accounts for a partner
paperid_get_next_partner_numberGet next auto-generated partner number
paperid_search_partnersSearch partners by name (uses earth API, used in invoice form dropdowns)
paperid_create_invoiceCreate a new sales invoice (multipart/form-data)
paperid_get_invoiceGet a single sales invoice by UUID
paperid_get_invoice_pdfGet PDF data for a sales invoice
paperid_send_invoiceSend invoice via WhatsApp, Email, and/or SMS
paperid_generate_invoice_qrisGenerate QRIS (QR code) payment for an invoice
paperid_delete_invoiceDelete a sales invoice by UUID
paperid_publish_invoiceChange invoice status (Draft → Posted/Unpaid, or other transitions). GET /api/v1/invoicer/invoice/change-status/{uuid}/{status_code}
paperid_update_invoiceUpdate an existing sales invoice (multipart/form-data). POST /api/v1/invoicer/sales-invoices/{uuid}
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
PAPERID_COMPANY_ID"": "37e0eae0-xxxx-xxxx-xxxx-xxxxxxxxxxxx",PAPERID_DB_PATHToken persisted at ~/.paperid-mcp/tokens.db. Override path with .PAPERID_PASSWORD"": "your_password_here"PAPERID_PHONE"": "08xxxxxxxxxx",PAPERID_TOKENOr: set first, then call tool paperid_get_current_user — it returns bothPAPERID_USER_ID"": "3f5a9896-xxxx-xxxx-xxxx-xxxxxxxxxxxx"Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
72/72 tools missing one or more hints — paperid_refresh_token (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); paperid_get_token_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); paperid_login (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +69 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Shell command execution
1 child_process call — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@0.5.0 (high), axios@1.6.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/igun997/paper-invoice-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check