Storno CLI (stornoro/storno-cli) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 289 tools. No publisher has claimed this listing.

C
Caution
62/100

Storno CLI

Enables AI assistants to manage invoices, clients, companies, and ANAF e-Factura through the Storno.ro e-invoicing API.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

stornoro

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: STORNO_PASSWORD, STORNO_REFRESH_TOKEN, STORNO_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes289 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

accounting_export_settings_get

Get the accounting export configuration for the active company. Returns settings for Saga, Winmentor, and Ciel accounting software integrations including account codes, journal mappings, and export preferences.

accounting_export_settings_update

Update accounting export configuration for the active company. Settings are merged with existing config. Configure account codes, journal mappings, and export preferences for Saga, Winmentor, or Ciel.

accounting_export_zip

Export accounting data as a ZIP archive for import into accounting software (Saga, Winmentor, or Ciel). The ZIP contains XML files for clients, suppliers, products, invoices, receipts, and payments. Filter by date range. For SAGA you may override the chart-of-accounts at export time (e.g. card analy

admin_organizations

List all organizations on the platform with pagination and filtering. SUPER_ADMIN only. Returns organization details including owner info, subscription plan, member/company/invoice counts, and ANAF token status.

admin_stats

Get platform-wide statistics including user counts, organization metrics, company sync status, invoice totals, and system info. SUPER_ADMIN only. Results are typically cached for 5 minutes.

admin_users

List all users on the platform with pagination and filtering. SUPER_ADMIN only. Returns user account details, verification status, role, last login timestamp, and organization memberships.

admin_version_overrides

List the per-platform version-gate overrides for the mobile app. SUPER_ADMIN only. Returns one entry per supported platform (ios/android/huawei) with the deploy-time YAML defaults, the live DB override (if any), and the merged effective values that drive /api/v1/version. Use admin_version_override_u

admin_version_override_update

Set or clear per-field version-gate overrides for one mobile platform. SUPER_ADMIN only. Each override field is independent — set a string to override, set null to clear, omit to leave as-is. Audit-logged. Bumping `minOverride` to a value above the live install ratchets the in-app blocker on instant

admin_email_log

List lifecycle email log entries with filtering and pagination. SUPER_ADMIN only. Returns sent/skipped/failed lifecycle emails across all categories (re_engagement, trial_ended, feature_drip, account_without_login, first_company_created, first_invoice_created, dunning, trial_expiration). Use to audi

anaf_status

Check the current ANAF integration status for the authenticated user. Returns token count, overall validity, and per-token details including CIF, expiry, and validity for each saved ANAF token.

anaf_tokens

List all ANAF OAuth tokens associated with the authenticated user. Each token enables e-Factura synchronization for a specific company CIF. Returns token ID, CIF, expiry, and validity status.

anaf_create_token_link

Create a device-based authentication token link for completing the ANAF OAuth flow. Returns a unique URL that can be opened in a browser to complete ANAF authentication. Maximum 5 active links per user. Link expires after a short period.

anaf_delete_token

Delete an ANAF OAuth token. This revokes e-Factura synchronization access for the CIF associated with this token. The token ID is an integer obtained from anaf_tokens.

anaf_validate_cif

Validate that an ANAF token has proper access to e-Factura for a specific CIF. Checks organization ownership, ANAF registry, and e-Factura access permissions. Returns validation result with any error messages.

anaf_sync_trigger

Manually trigger e-Factura synchronization for all companies with valid ANAF tokens. Validates token availability and subscription plan rate limits, then dispatches an async sync job to fetch new invoices from ANAF SPV.

anaf_sync_status

Get the current e-Factura synchronization status and configuration. Returns whether sync is enabled, the last successful sync timestamp, token validity, and the sync frequency interval.

anaf_sync_log

Retrieve the recent e-Factura sync activity log showing the last 50 synced invoices. Each entry shows the invoice ID, company CIF, sync timestamp, and status (success, failed, or skipped).

api_keys_list

List all API tokens for the authenticated user within the current organization. Returns both active and revoked tokens sorted by creation date, newest first. The raw token value is never included — only the tokenPrefix for identification.

api_keys_scopes

List all permission scopes available to the current user, grouped by category. Only scopes the user already holds are returned — useful for inspecting what permissions a token can be granted.

auth_login

Authenticate with the Storno.ro API using email and password. Returns JWT access and refresh tokens, and stores them in the session config for all subsequent requests. Must be called before any other tool if STORNO_TOKEN is not set.

auth_register

Create a new Storno.ro user account. A default organization is automatically created. Returns JWT tokens on success.

auth_refresh

Refresh an expired JWT access token using the refresh token. Both tokens are rotated. The new tokens are stored in the session config. Use when the current token has expired.

auth_me

Get the current authenticated user profile including organization memberships and subscription plan. Returns flat JSON with user, organization, memberships, and subscription.

auth_update_profile

Update the authenticated user's profile. Can update name, phone, timezone, quiet-hours preference, preferences, or change password (requires currentPassword when changing password).

auth_forgot_password

Request a password reset email. Always returns success to prevent user enumeration — the email is only sent if the account exists. The reset link is valid for 1 hour.

auth_reset_password

Reset a user password using the token received via email from auth_forgot_password. The token is single-use and expires after 1 hour. All existing sessions are revoked on success.

backup_create

Create a new backup job for the active company. The backup is processed asynchronously and includes all company data (invoices, clients, products, settings). Optionally include uploaded files (PDFs, XMLs). Returns a job ID to check status.

backup_status

Get the status of a backup job. Returns progress percentage, current step, and download URL when complete. Statuses: pending, processing, completed, failed.

backup_download

Download a completed backup as a ZIP file. Returns base64-encoded binary data. The backup must be in "completed" status.

backup_restore

Upload a backup ZIP file to restore company data. The restore runs asynchronously. Use backup_restore_status to check progress. WARNING: if purgeExisting is true, all current company data will be deleted before restoring.

backup_restore_status

Get the status of a restore job. Returns progress percentage and current step. Same as backup_status but specifically for restore jobs.

backup_history

List recent backup jobs for the active company. Returns job ID, status, creation date, file size, and whether files were included.

bank_accounts_list

List all bank accounts configured for the active company. Returns IBAN, bank name, currency, and which account is the default per currency. Bank accounts appear on invoices as payment instructions.

bank_accounts_create

Add a new bank account to the active company. For type=bank, IBAN is required and must be unique within the company. For type=cash (the till that backs POS / cash-register reports), IBAN is optional and openingBalance/openingBalanceDate enable cash-register tracking. A company can have at most one c

bank_accounts_update

Update an existing bank account. Can update type, IBAN, bank name, currency, default status, or initial opening balance. Once openingBalance has been persisted with a value > 0 it locks — further changes are rejected and corrections must be made via cash movements. At least one field must be provide

bank_accounts_delete

Permanently delete a bank account. Cannot delete the last bank account for a company or the default account (set another as default first). Existing invoices that referenced this account retain the IBAN in their stored data.

borderou_providers

List available borderou (bank statement) providers. Returns supported banks and file formats for bank statement import and reconciliation.

borderou_upload

Upload a bank statement or borderou file (CSV, XLSX, XLS) for transaction import and reconciliation. Parses the file, creates transactions, and runs automatic matching against existing invoices.

borderou_transactions

List borderou transactions with pagination. Returns imported bank statement transactions with matching status, amounts, and linked invoice/proforma references.

borderou_transaction_get

Get detailed information about a specific borderou transaction including matched invoice/proforma details.

borderou_transaction_update

Update a borderou transaction match. Link or unlink the transaction to an invoice or proforma invoice for reconciliation.

borderou_transaction_available_invoices

Get invoices or proforma invoices available to match against a borderou transaction. Search by number, client name, or amount.

borderou_transactions_save

Save and persist selected borderou transaction matches. Creates payment records for matched transactions and updates invoice payment status.

borderou_transactions_rematch

Re-run the automatic matching algorithm on selected borderou transactions. Useful after adding new invoices or updating client data.

cash_register_balance

Live snapshot of the till — opening balance, cash in/out since opening, manual movements, and current balance. Returns { configured: false } if no cash-type bank account exists or its opening balance is not set.

cash_register_ledger

Daily cash ledger across the requested date range. Each day bucket includes opening balance, chronological entries (receipts, cash payments, manual movements), totals, and closing balance. Range capped at 366 days.

cash_register_movements_list

List manual cash movements (deposits, withdrawals, miscellaneous) in a date range. Receipts and invoice payments are NOT returned here — use cash_register_ledger for the full picture.

cash_register_movements_create

Record a manual cash movement (deposit, withdrawal, or miscellaneous). Direction is auto-set for deposits (out) and withdrawals (in); for kind=other, direction must be supplied. movementDate cannot be earlier than the cash account opening date.

cash_register_movements_update

Update a manual cash movement. All fields optional; omitted fields keep their current value. Currency cannot be changed. Changing kind between deposit/withdrawal re-applies auto-direction.

cash_register_movements_delete

Permanently delete a manual cash movement. Receipts and invoice payments cannot be deleted via this endpoint — use their respective resources.

clients_list

List clients for the active company. Results are grouped alphabetically by name and can be filtered by type (company/individual) or searched by name, CUI/CNP, or email.

clients_get

Get detailed information about a specific client by UUID, including invoice summary statistics (total count, unpaid amount, overdue amount, total revenue) and a list of the 10 most recent invoices.

clients_create

Create a new client manually. Supports both company and individual client types. Company details (address, VAT, bank account, etc.) can be auto-filled using clients_anaf_lookup or clients_from_registry before calling this tool.

clients_update

Update an existing client by UUID. All fields are optional — only the provided fields will be updated.

clients_sync_invoices

Resync all unsent invoices with the client's current profile data (name, CUI, tax details). Unlike the automatic propagation on client update (current month only), this also rewrites older invoices, as long as they were not uploaded to ANAF and are not cancelled. Cached XML/PDF files are invalidated

clients_delete

Permanently delete a client by UUID. Clients with existing invoices or documents cannot be deleted.

clients_bulk_delete

Delete multiple clients in a single request. Accepts up to 100 client UUIDs. Clients with existing documents will be skipped or cause an error depending on server configuration.

clients_anaf_lookup

Look up company details by CUI in the ANAF public registry without creating a client. Returns pre-filled form data (name, address, VAT status, registration number, etc.) that can be used to populate a clients_create call.

clients_vies_lookup

Validate a VAT code against the EU VIES system. Returns whether the VAT number is valid and the registered company name/address. Use this to verify EU intra-community VAT numbers before applying reverse charge.

clients_from_registry

Create a client by looking up a CUI in the ANAF registry and auto-filling all available details (name, address, VAT status, registration number, etc.). Use this instead of clients_create when you only have a CUI and want the company details resolved automatically.

clients_export_csv

Export all clients for the active company as a CSV file. Returns base64-encoded binary data representing the CSV file contents.

clients_export_saga_xml

Export clients in Saga XML format for import into Saga accounting software. Returns the XML document as text.

companies_list

List all companies belonging to the authenticated user's organization. Returns company details including CIF, addresses, bank info, sync settings, and ANAF token status. Use this to find company UUIDs for the companies_select tool.

companies_get

Get detailed information for a specific company by UUID. Returns all configuration settings, bank info, sync settings, and ANAF token validity status.

companies_create

Create a new company by providing its CIF (Romanian tax identification number). The system automatically validates the CIF with ANAF and retrieves official registration data (name, address, VAT status). The CIF can be provided with or without the RO prefix.

companies_update

Update configuration settings for a company. Note: core ANAF data (CIF, registration number, VAT status, official address) cannot be modified as they are synced from official ANAF sources. Only editable fields like contact info, bank details, and sync settings can be changed.

companies_delete

Permanently delete a company and all associated data (invoices, clients, products, ANAF tokens). This triggers an asynchronous cascade deletion. Only Owner or Admin roles can delete companies. This action cannot be undone.

companies_upload_logo

Upload a logo image for a company. Accepts PNG, JPG, or SVG files up to 2MB. The logo appears on PDF documents (invoices, proformas, delivery notes, receipts).

companies_delete_logo

Remove the logo from a company. PDFs will no longer include the company logo.

companies_toggle_sync

Toggle ANAF SPV / e-Factura synchronization on or off for a specific company. Calls POST /api/v1/companies/{uuid}/toggle-sync — flips the company's syncEnabled boolean. Requires COMPANY_EDIT permission. Enabling fails with 422 (messageKey ERR_SYNC_ENABLE_NO_TOKEN) when the company has no valid ANAF

companies_set_active

Set the organization-level active company by UUID. Calls PUT /api/v1/companies/{uuid}/set-active on the server and returns the updated list of all companies with the new active company reflected. Requires COMPANY_EDIT permission. Use companies_list first to find available company UUIDs.

companies_select

Select the active company for the current session. This sets the X-Company header used by all subsequent invoice, client, product, and other company-scoped requests. Call companies_list first to find available company UUIDs.

company_registry_search

Search the Romanian company registry (ONRC) by company name. Returns matching companies with CUI, name, and registration details. Useful for finding a company before creating a client. Results are cached for 5 minutes.

company_registry_cities

Get a list of cities for a given Romanian county. Optionally filter by city name. Useful for address auto-complete when creating clients or companies. Results are cached for 5 minutes.

cpv_codes_search

Search CPV (Common Procurement Vocabulary) classification codes by code number or description. CPV codes are used in e-Transport declarations and public procurement. Returns matching codes with their descriptions.

dashboard_stats

Get comprehensive dashboard statistics for the selected company. Returns invoice counts (total, draft, issued, paid, overdue), revenue amounts (total revenue, VAT, paid, unpaid), monthly breakdown, top clients, top products, recent activity, and payment summary. Supports predefined periods (month, q

declarations_list

List tax declarations for the active company. Supports filtering by type, status, year, and month. Returns paginated list of declarations with their status and period.

declarations_get

Get a single tax declaration by UUID. Returns full declaration details including populated data, status, metadata, and error messages.

declarations_create

Create a new tax declaration and auto-populate it from existing invoice data. Supported types: d394, d300, d390, d100, d112. The system automatically aggregates invoice data by partner CIF and VAT rate for the specified period.

declarations_recalculate

Recalculate a draft declaration by re-populating its data from current invoices. Only works on declarations in "draft" status.

declarations_validate

Validate a draft declaration by generating and checking the XML output. Transitions the declaration to "validated" status if successful.

declarations_submit

Submit a declaration to ANAF. Generates XML, uploads to ANAF SPV, and begins async status polling. Works on "draft" or "validated" declarations.

declarations_delete

Soft-delete a tax declaration. Cannot delete accepted declarations.

declarations_sync

Sync declarations from ANAF for a given year. Discovers filed declarations via SPV messages, creates missing local records, downloads recipise, and updates in-flight statuses. Returns 202 (async processing).

declarations_refresh_statuses

Refresh statuses for all in-flight (submitted/processing) declarations from ANAF. Checks SPV messages for status updates and downloads recipise. Returns 202 (async processing).

declarations_download_xml

Download the generated XML for a tax declaration. Returns the raw XML content.

declarations_prepare

Prepare a declaration for agent-based submission. Returns XML content, ANAF URL, Bearer token, and CIF needed by the local agent to proxy the mTLS request. Use operation param for different flows: submit (default), listMessages, download.

declarations_agent_result

Submit the ANAF response received via the local agent back to the server. The server parses the response, extracts the upload ID, sets status to PROCESSING, and dispatches status checking.

defaults_invoice

Get all default values and dropdown options needed for invoice creation. Returns VAT rates, currencies with symbols, payment terms (in days), units of measure, payment methods, and current BNR exchange rates for EUR/USD/GBP/CHF relative to RON. Always fetch this before creating invoices — never hard

delivery_notes_list

List delivery notes for the selected company with optional filtering by status, date range, client, and search term. Delivery notes document physical delivery of goods or completion of services.

delivery_notes_get

Get complete details for a specific delivery note including all line items, client information, deputy details, and calculated totals.

delivery_notes_create

Create a new delivery note in draft status. Delivery notes document physical delivery of goods or services and can later be converted to invoices. Include deputy information for proof of delivery. A default delivery_note series is auto-assigned if neither seriesId nor documentSeriesId is provided.

delivery_notes_update

Update an existing delivery note. Delivery notes in draft or issued status can be updated. Replaces all line items with the provided array.

delivery_notes_delete

Permanently delete a delivery note. Only draft delivery notes can be deleted. Use cancel for issued delivery notes to preserve audit trail.

delivery_notes_issue

Mark a delivery note as issued when the physical delivery of goods or completion of services occurs. Transitions status from draft to issued. Once issued, the delivery note becomes read-only.

delivery_notes_cancel

Cancel a delivery note when delivery will not occur. Can be cancelled from draft or issued status. Preserves historical record unlike deletion. Optionally provide a cancellation reason.

delivery_notes_pdf

Download the PDF for a delivery note. Returns base64-encoded PDF binary data. The delivery note must be in issued or converted status. Optionally hide VAT or prices for simplified delivery documents.

delivery_notes_convert

Convert a delivery note into a final invoice. Creates a new invoice with all delivery note data, marks the delivery note as converted, and establishes a link between the two documents. Returns both the new invoice and updated delivery note.

delivery_notes_restore

Restore a cancelled delivery note back to draft status. Only cancelled delivery notes can be restored. This reverses the cancellation and allows the delivery note to be re-issued.

delivery_notes_email

Send a delivery note to a client via email with the PDF attached. Supports custom subject, body, CC, and BCC recipients.

189 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configSTORNO_BASE_URLNo https://api.storno.ro API base URL
configSTORNO_COMPANY_ID"": "your-company-uuid"
configSTORNO_EMAILNo — Email for auto-login (if no token)
configSTORNO_HTTP_HOSTNo 127.0.0.1 HTTP bind address (used with STORNO_HTTP_PORT)
configSTORNO_HTTP_PORTNo — If set, starts Streamable HTTP transport on this port
configSTORNO_OAUTH_BASE_URL
configSTORNO_OAUTH_CLIENT_ID
🔐 secretSTORNO_PASSWORDNo — Password for auto-login (if no token)
🔐 secretSTORNO_REFRESH_TOKENNo — JWT refresh token (for auto-renewal)
🔐 secretSTORNO_TOKEN"": "your-jwt-token",
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

289/289 tools missing one or more hints — accounting_export_settings_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); accounting_export_settings_update (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); accounting_export_zip (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +286 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/stornoro/storno-cli?variant=verified)](https://m8ven.ai/mcp/stornoro/storno-cli)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 9e5571c6571d77513fb8d5bbf263dc1cf1621409
code hash: b6a5c8192ca55f5fab8e71b44306a00e672b899c37387c16a7d0c4a1e54702c5
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client