MCP ERPNext (sharat9703/mcp-erpnext-taiga-gitlab-redmine) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 104 tools. No publisher has claimed this listing.

D
Caution
56/100

MCP ERPNext

Model Context Protocol (MCP) server for ERPNext - manage timesheets, leave applications, projects, and software releases via Claude, Gemini, or any MCP-compatible AI assistant.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

sharat9703

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 6 credentials: ERPNEXT_PASSWORD, ERPNEXT_TOTP_SECRET, GITLAB_TOKEN, REDMINE_API_KEY, TAIGA_PASS, TAIGA_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes52 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

erpnext_login

Login to ERPNext with username/password and optional TOTP. Call this first before other operations.

erpnext_get_current_employee

Get the employee record linked to the currently logged in user

erpnext_list_activity_types

List all available activity types for timesheets

erpnext_list_projects

List all projects

erpnext_list_tasks

List tasks for a specific project

erpnext_create_timesheet

Create a new timesheet with time logs.

erpnext_quick_timesheet

Create a timesheet for today with a single entry

erpnext_list_timesheets

List timesheets with optional filters

erpnext_get_timesheet

Get details of a specific timesheet

erpnext_get_my_draft_timesheets

Get all draft timesheets for current employee

erpnext_add_time_log

Add time log to existing draft timesheet

erpnext_submit_timesheet

Submit a draft timesheet

erpnext_cancel_timesheet

Cancel a submitted timesheet

erpnext_create_weekly_timesheet

Create weekly timesheet: 7h Billable + 2h Non-Billable per day, Mon-Fri

erpnext_create_custom_timesheet

Create timesheet with custom entries

erpnext_update_time_log

Update a specific time log in a draft timesheet. Use this to edit hours, times, project, activity type, or description of an existing time entry.

erpnext_remove_time_log

Remove a specific time log from a draft timesheet. Cannot remove the last time log.

erpnext_update_timesheet_note

Update the note on a draft timesheet

erpnext_delete_timesheet

Delete a draft timesheet. Only works on timesheets that have not been submitted.

erpnext_list_leave_types

List all available leave types

erpnext_get_leave_balance

Get leave balance for employee

erpnext_list_leave_applications

List leave applications with filters

erpnext_get_leave_application

Get details of a specific leave application

erpnext_get_my_pending_leaves

Get pending leave applications for current employee

erpnext_get_my_approved_leaves

Get approved leave applications for current employee

erpnext_apply_leave

Apply for leave (single or multiple days)

erpnext_submit_leave_application

Submit leave application for approval

erpnext_cancel_leave_application

Cancel a leave application

erpnext_create_software_release

Create a software release document in ERPNext from GitLab merge request URL(s). When template_release_url is provided, auto-fills Product, Customer, and Reviewer from that release. Also auto-fetches: Redmine IDs from MR description (#123456), patch/test report URLs from MR notes, and Redmine ticket

erpnext_preview_software_release

Preview what a software release will look like BEFORE creating it. Shows all auto-detected fields, their sources, and any missing required fields. Use this to review the release details before calling erpnext_create_software_release.

erpnext_list_products

List available products (Brands) for software release selection

erpnext_list_customers_for_release

List available customers for software release selection

erpnext_get_mr_details

Get details from a GitLab merge request URL including auto-detected customer, version, Redmine IDs from description, and auto-fetched patch/test report URLs from MR notes

erpnext_get_redmine_issue

Get Redmine issue details (title/subject) from issue ID or URL. Requires REDMINE_API_KEY to be configured.

erpnext_get_redmine_issue_details

Get FULL Redmine issue details from an ID or URL: description, status, priority, assignee, done ratio, comments/journal notes, attachments, sub-tasks (children) and relations. Use this (not erpnext_get_redmine_issue) when you need the actual issue content, reported bugs, or discussion. Requires REDM

erpnext_update_redmine_issue

Update a Redmine issue: add a comment/note and/or change fields (status, assignee, priority, done ratio, subject, description, dates). Provide either status_id or status_name (name is resolved automatically). Requires REDMINE_API_KEY with write permission on the project.

erpnext_create_redmine_issue

Create a NEW Redmine issue in a project. Use this to open a fresh ticket (e.g. a Clarification/tracking ticket) — distinct from erpnext_update_redmine_issue, which only edits an existing issue. Some projects require assignee (yourself), due date and certain custom fields (e.g. Complexity); pass assi

erpnext_get_software_release

Get details of an existing software release (can be used as template reference)

erpnext_list_software_releases

List recent software releases with optional filters

erpnext_download_redmine_attachment

Download a file attachment from a Redmine issue to local disk (e.g. an issue's SQL script, spreadsheet, or document). Accepts the attachment id or a Redmine attachment download URL. Returns the saved file path, metadata, and — for text-like files — a content preview. Requires REDMINE_API_KEY.

erpnext_list_merge_requests

List merge requests from a GitLab project with filters (state, author, date range). Returns a list of MRs that can be selected for task creation analysis.

erpnext_analyze_merge_request

Analyze one or multiple GitLab merge requests and generate intelligent task breakdown. Extracts commits, groups them by type (features/fixes/refactors), and identifies Redmine issues from MR descriptions. Returns suggested tasks for user review before creation.

erpnext_create_tasks_from_analysis

Create tasks in ERPNext from previously analyzed merge request data. Tasks are created with "Completed" status and automatically assigned to the current employee.

erpnext_get_developer_tasks

Get Developer Tasks assigned to a developer (defaults to the logged-in user) with optional filters by date range, status, product, or subject search. Returns the tasks plus a breakdown of task counts per client/project (SBI, ICICI, TCIL/Mudra 2, etc.). Useful for building a delivery footprint or act

erpnext_validate_user_story

Validate a Taiga User Story by its URL and return its id, title and project. Use this before creating tasks to confirm the user story exists and to obtain the user_story_id.

erpnext_create_user_story

Create a new User Story in a Taiga project. Returns the created user story id, ref and URL. Use the returned user_story_id with erpnext_create_taiga_tasks to add tasks under it.

erpnext_create_taiga_tasks

Create one or more tasks in Taiga under a given User Story. Resolves assignees from project members and sets custom attributes (complexity, task_type) when those attributes exist on the project. Returns created task refs/ids and any failures.

erpnext_export_tasks_to_erp

Export tasks to ERPNext as "Developer Task" documents. Resolves the developer (employee code) from a name when not provided, maps the Taiga task_type to an ERP category, and normalizes complexity. Returns created ids, in-batch skips, and failures.

erpnext_get_taiga_tasks

Get Taiga tasks assigned to a user (defaults to the authenticated user), with each task's description and attachment metadata. Optionally filter by project (slug or name) and status; by default only OPEN tasks are returned. Use this to read a task's description and see its attachments (download them

erpnext_get_user_story_tasks

Get ALL tasks under a Taiga user story (any assignee) with their FULL descriptions, plus the merge-commit SHAs and Redmine issue ids referenced in each description. Use this — not erpnext_get_taiga_tasks — when working from a user story URL/ref, e.g. to collect the 'Ready for test' points of a sprin

erpnext_update_taiga_task

Update a Taiga task's status and/or description. Identify the task by numeric task_id, or by ref + project (slug or name). Status names are resolved to the project's status ids automatically.

erpnext_download_taiga_attachment

Download a Taiga task attachment to local disk. Provide the attachment url (from erpnext_get_taiga_tasks) or a numeric attachment_id. Returns the saved file path and — for text-like files — a content preview.

// known CVEs in dependencies14 high4 medium12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.6.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.6.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.6.0GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.6.0GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretERPNEXT_PASSWORDyour-password
🔐 secretERPNEXT_TOTP_SECRETyour-totp-secret # Optional, for 2FA
configERPNEXT_URL"": "https://your-erpnext-instance.com",
configERPNEXT_USERNAMEyour-email@example.com
🔐 secretGITLAB_TOKENyour-gitlab-personal-access-token
configGITLAB_URL
🔐 secretREDMINE_API_KEYyour-redmine-api-key # For auto-fetching ticket titles
configREDMINE_URL
configTAIGA_HOST
🔐 secretTAIGA_PASS
🔐 secretTAIGA_TOKEN
configTAIGA_USER
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

104/104 tools missing one or more hints — erpnext_login (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); erpnext_get_current_employee (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); erpnext_list_activity_types (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +101 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Shell command execution

8 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Secrets not logged

4 secret values sent to console.log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), axios@1.6.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/sharat9703/mcp-erpnext-taiga-gitlab-redmine?variant=verified)](https://m8ven.ai/mcp/sharat9703/mcp-erpnext-taiga-gitlab-redmine)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 652a66f6108aa16356f67157ea1d689c55c0b68f
code hash: 7519ed535f0dc30b93789149c8b819399666a026f3f024abddcd966ce21ec7e3
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client