Storno CLI (stornoro/storno-cli) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 289 tools. No publisher has claimed this listing.
Enables AI assistants to manage invoices, clients, companies, and ANAF e-Factura through the Storno.ro e-invoicing API.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
stornoro
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
accounting_export_settings_getGet the accounting export configuration for the active company. Returns settings for Saga, Winmentor, and Ciel accounting software integrations including account codes, journal mappings, and export preferences.
accounting_export_settings_updateUpdate accounting export configuration for the active company. Settings are merged with existing config. Configure account codes, journal mappings, and export preferences for Saga, Winmentor, or Ciel.
accounting_export_zipExport accounting data as a ZIP archive for import into accounting software (Saga, Winmentor, or Ciel). The ZIP contains XML files for clients, suppliers, products, invoices, receipts, and payments. Filter by date range. For SAGA you may override the chart-of-accounts at export time (e.g. card analy…
admin_organizationsList all organizations on the platform with pagination and filtering. SUPER_ADMIN only. Returns organization details including owner info, subscription plan, member/company/invoice counts, and ANAF token status.
admin_statsGet platform-wide statistics including user counts, organization metrics, company sync status, invoice totals, and system info. SUPER_ADMIN only. Results are typically cached for 5 minutes.
admin_usersList all users on the platform with pagination and filtering. SUPER_ADMIN only. Returns user account details, verification status, role, last login timestamp, and organization memberships.
admin_version_overridesList the per-platform version-gate overrides for the mobile app. SUPER_ADMIN only. Returns one entry per supported platform (ios/android/huawei) with the deploy-time YAML defaults, the live DB override (if any), and the merged effective values that drive /api/v1/version. Use admin_version_override_u…
admin_version_override_updateSet or clear per-field version-gate overrides for one mobile platform. SUPER_ADMIN only. Each override field is independent — set a string to override, set null to clear, omit to leave as-is. Audit-logged. Bumping `minOverride` to a value above the live install ratchets the in-app blocker on instant…
admin_email_logList lifecycle email log entries with filtering and pagination. SUPER_ADMIN only. Returns sent/skipped/failed lifecycle emails across all categories (re_engagement, trial_ended, feature_drip, account_without_login, first_company_created, first_invoice_created, dunning, trial_expiration). Use to audi…
anaf_statusCheck the current ANAF integration status for the authenticated user. Returns token count, overall validity, and per-token details including CIF, expiry, and validity for each saved ANAF token.
anaf_tokensList all ANAF OAuth tokens associated with the authenticated user. Each token enables e-Factura synchronization for a specific company CIF. Returns token ID, CIF, expiry, and validity status.
anaf_create_token_linkCreate a device-based authentication token link for completing the ANAF OAuth flow. Returns a unique URL that can be opened in a browser to complete ANAF authentication. Maximum 5 active links per user. Link expires after a short period.
anaf_delete_tokenDelete an ANAF OAuth token. This revokes e-Factura synchronization access for the CIF associated with this token. The token ID is an integer obtained from anaf_tokens.
anaf_validate_cifValidate that an ANAF token has proper access to e-Factura for a specific CIF. Checks organization ownership, ANAF registry, and e-Factura access permissions. Returns validation result with any error messages.
anaf_sync_triggerManually trigger e-Factura synchronization for all companies with valid ANAF tokens. Validates token availability and subscription plan rate limits, then dispatches an async sync job to fetch new invoices from ANAF SPV.
anaf_sync_statusGet the current e-Factura synchronization status and configuration. Returns whether sync is enabled, the last successful sync timestamp, token validity, and the sync frequency interval.
anaf_sync_logRetrieve the recent e-Factura sync activity log showing the last 50 synced invoices. Each entry shows the invoice ID, company CIF, sync timestamp, and status (success, failed, or skipped).
api_keys_listList all API tokens for the authenticated user within the current organization. Returns both active and revoked tokens sorted by creation date, newest first. The raw token value is never included — only the tokenPrefix for identification.
api_keys_scopesList all permission scopes available to the current user, grouped by category. Only scopes the user already holds are returned — useful for inspecting what permissions a token can be granted.
auth_loginAuthenticate with the Storno.ro API using email and password. Returns JWT access and refresh tokens, and stores them in the session config for all subsequent requests. Must be called before any other tool if STORNO_TOKEN is not set.
auth_registerCreate a new Storno.ro user account. A default organization is automatically created. Returns JWT tokens on success.
auth_refreshRefresh an expired JWT access token using the refresh token. Both tokens are rotated. The new tokens are stored in the session config. Use when the current token has expired.
auth_meGet the current authenticated user profile including organization memberships and subscription plan. Returns flat JSON with user, organization, memberships, and subscription.
auth_update_profileUpdate the authenticated user's profile. Can update name, phone, timezone, quiet-hours preference, preferences, or change password (requires currentPassword when changing password).
auth_forgot_passwordRequest a password reset email. Always returns success to prevent user enumeration — the email is only sent if the account exists. The reset link is valid for 1 hour.
auth_reset_passwordReset a user password using the token received via email from auth_forgot_password. The token is single-use and expires after 1 hour. All existing sessions are revoked on success.
backup_createCreate a new backup job for the active company. The backup is processed asynchronously and includes all company data (invoices, clients, products, settings). Optionally include uploaded files (PDFs, XMLs). Returns a job ID to check status.
backup_statusGet the status of a backup job. Returns progress percentage, current step, and download URL when complete. Statuses: pending, processing, completed, failed.
backup_downloadDownload a completed backup as a ZIP file. Returns base64-encoded binary data. The backup must be in "completed" status.
backup_restoreUpload a backup ZIP file to restore company data. The restore runs asynchronously. Use backup_restore_status to check progress. WARNING: if purgeExisting is true, all current company data will be deleted before restoring.
backup_restore_statusGet the status of a restore job. Returns progress percentage and current step. Same as backup_status but specifically for restore jobs.
backup_historyList recent backup jobs for the active company. Returns job ID, status, creation date, file size, and whether files were included.
bank_accounts_listList all bank accounts configured for the active company. Returns IBAN, bank name, currency, and which account is the default per currency. Bank accounts appear on invoices as payment instructions.
bank_accounts_createAdd a new bank account to the active company. For type=bank, IBAN is required and must be unique within the company. For type=cash (the till that backs POS / cash-register reports), IBAN is optional and openingBalance/openingBalanceDate enable cash-register tracking. A company can have at most one c…
bank_accounts_updateUpdate an existing bank account. Can update type, IBAN, bank name, currency, default status, or initial opening balance. Once openingBalance has been persisted with a value > 0 it locks — further changes are rejected and corrections must be made via cash movements. At least one field must be provide…
bank_accounts_deletePermanently delete a bank account. Cannot delete the last bank account for a company or the default account (set another as default first). Existing invoices that referenced this account retain the IBAN in their stored data.
borderou_providersList available borderou (bank statement) providers. Returns supported banks and file formats for bank statement import and reconciliation.
borderou_uploadUpload a bank statement or borderou file (CSV, XLSX, XLS) for transaction import and reconciliation. Parses the file, creates transactions, and runs automatic matching against existing invoices.
borderou_transactionsList borderou transactions with pagination. Returns imported bank statement transactions with matching status, amounts, and linked invoice/proforma references.
borderou_transaction_getGet detailed information about a specific borderou transaction including matched invoice/proforma details.
borderou_transaction_updateUpdate a borderou transaction match. Link or unlink the transaction to an invoice or proforma invoice for reconciliation.
borderou_transaction_available_invoicesGet invoices or proforma invoices available to match against a borderou transaction. Search by number, client name, or amount.
borderou_transactions_saveSave and persist selected borderou transaction matches. Creates payment records for matched transactions and updates invoice payment status.
borderou_transactions_rematchRe-run the automatic matching algorithm on selected borderou transactions. Useful after adding new invoices or updating client data.
cash_register_balanceLive snapshot of the till — opening balance, cash in/out since opening, manual movements, and current balance. Returns { configured: false } if no cash-type bank account exists or its opening balance is not set.
cash_register_ledgerDaily cash ledger across the requested date range. Each day bucket includes opening balance, chronological entries (receipts, cash payments, manual movements), totals, and closing balance. Range capped at 366 days.
cash_register_movements_listList manual cash movements (deposits, withdrawals, miscellaneous) in a date range. Receipts and invoice payments are NOT returned here — use cash_register_ledger for the full picture.
cash_register_movements_createRecord a manual cash movement (deposit, withdrawal, or miscellaneous). Direction is auto-set for deposits (out) and withdrawals (in); for kind=other, direction must be supplied. movementDate cannot be earlier than the cash account opening date.
cash_register_movements_updateUpdate a manual cash movement. All fields optional; omitted fields keep their current value. Currency cannot be changed. Changing kind between deposit/withdrawal re-applies auto-direction.
cash_register_movements_deletePermanently delete a manual cash movement. Receipts and invoice payments cannot be deleted via this endpoint — use their respective resources.
clients_listList clients for the active company. Results are grouped alphabetically by name and can be filtered by type (company/individual) or searched by name, CUI/CNP, or email.
clients_getGet detailed information about a specific client by UUID, including invoice summary statistics (total count, unpaid amount, overdue amount, total revenue) and a list of the 10 most recent invoices.
clients_createCreate a new client manually. Supports both company and individual client types. Company details (address, VAT, bank account, etc.) can be auto-filled using clients_anaf_lookup or clients_from_registry before calling this tool.
clients_updateUpdate an existing client by UUID. All fields are optional — only the provided fields will be updated.
clients_sync_invoicesResync all unsent invoices with the client's current profile data (name, CUI, tax details). Unlike the automatic propagation on client update (current month only), this also rewrites older invoices, as long as they were not uploaded to ANAF and are not cancelled. Cached XML/PDF files are invalidated…
clients_deletePermanently delete a client by UUID. Clients with existing invoices or documents cannot be deleted.
clients_bulk_deleteDelete multiple clients in a single request. Accepts up to 100 client UUIDs. Clients with existing documents will be skipped or cause an error depending on server configuration.
clients_anaf_lookupLook up company details by CUI in the ANAF public registry without creating a client. Returns pre-filled form data (name, address, VAT status, registration number, etc.) that can be used to populate a clients_create call.
clients_vies_lookupValidate a VAT code against the EU VIES system. Returns whether the VAT number is valid and the registered company name/address. Use this to verify EU intra-community VAT numbers before applying reverse charge.
clients_from_registryCreate a client by looking up a CUI in the ANAF registry and auto-filling all available details (name, address, VAT status, registration number, etc.). Use this instead of clients_create when you only have a CUI and want the company details resolved automatically.
clients_export_csvExport all clients for the active company as a CSV file. Returns base64-encoded binary data representing the CSV file contents.
clients_export_saga_xmlExport clients in Saga XML format for import into Saga accounting software. Returns the XML document as text.
companies_listList all companies belonging to the authenticated user's organization. Returns company details including CIF, addresses, bank info, sync settings, and ANAF token status. Use this to find company UUIDs for the companies_select tool.
companies_getGet detailed information for a specific company by UUID. Returns all configuration settings, bank info, sync settings, and ANAF token validity status.
companies_createCreate a new company by providing its CIF (Romanian tax identification number). The system automatically validates the CIF with ANAF and retrieves official registration data (name, address, VAT status). The CIF can be provided with or without the RO prefix.
companies_updateUpdate configuration settings for a company. Note: core ANAF data (CIF, registration number, VAT status, official address) cannot be modified as they are synced from official ANAF sources. Only editable fields like contact info, bank details, and sync settings can be changed.
companies_deletePermanently delete a company and all associated data (invoices, clients, products, ANAF tokens). This triggers an asynchronous cascade deletion. Only Owner or Admin roles can delete companies. This action cannot be undone.
companies_upload_logoUpload a logo image for a company. Accepts PNG, JPG, or SVG files up to 2MB. The logo appears on PDF documents (invoices, proformas, delivery notes, receipts).
companies_delete_logoRemove the logo from a company. PDFs will no longer include the company logo.
companies_toggle_syncToggle ANAF SPV / e-Factura synchronization on or off for a specific company. Calls POST /api/v1/companies/{uuid}/toggle-sync — flips the company's syncEnabled boolean. Requires COMPANY_EDIT permission. Enabling fails with 422 (messageKey ERR_SYNC_ENABLE_NO_TOKEN) when the company has no valid ANAF …
companies_set_activeSet the organization-level active company by UUID. Calls PUT /api/v1/companies/{uuid}/set-active on the server and returns the updated list of all companies with the new active company reflected. Requires COMPANY_EDIT permission. Use companies_list first to find available company UUIDs.
companies_selectSelect the active company for the current session. This sets the X-Company header used by all subsequent invoice, client, product, and other company-scoped requests. Call companies_list first to find available company UUIDs.
company_registry_searchSearch the Romanian company registry (ONRC) by company name. Returns matching companies with CUI, name, and registration details. Useful for finding a company before creating a client. Results are cached for 5 minutes.
company_registry_citiesGet a list of cities for a given Romanian county. Optionally filter by city name. Useful for address auto-complete when creating clients or companies. Results are cached for 5 minutes.
cpv_codes_searchSearch CPV (Common Procurement Vocabulary) classification codes by code number or description. CPV codes are used in e-Transport declarations and public procurement. Returns matching codes with their descriptions.
dashboard_statsGet comprehensive dashboard statistics for the selected company. Returns invoice counts (total, draft, issued, paid, overdue), revenue amounts (total revenue, VAT, paid, unpaid), monthly breakdown, top clients, top products, recent activity, and payment summary. Supports predefined periods (month, q…
declarations_listList tax declarations for the active company. Supports filtering by type, status, year, and month. Returns paginated list of declarations with their status and period.
declarations_getGet a single tax declaration by UUID. Returns full declaration details including populated data, status, metadata, and error messages.
declarations_createCreate a new tax declaration and auto-populate it from existing invoice data. Supported types: d394, d300, d390, d100, d112. The system automatically aggregates invoice data by partner CIF and VAT rate for the specified period.
declarations_recalculateRecalculate a draft declaration by re-populating its data from current invoices. Only works on declarations in "draft" status.
declarations_validateValidate a draft declaration by generating and checking the XML output. Transitions the declaration to "validated" status if successful.
declarations_submitSubmit a declaration to ANAF. Generates XML, uploads to ANAF SPV, and begins async status polling. Works on "draft" or "validated" declarations.
declarations_deleteSoft-delete a tax declaration. Cannot delete accepted declarations.
declarations_syncSync declarations from ANAF for a given year. Discovers filed declarations via SPV messages, creates missing local records, downloads recipise, and updates in-flight statuses. Returns 202 (async processing).
declarations_refresh_statusesRefresh statuses for all in-flight (submitted/processing) declarations from ANAF. Checks SPV messages for status updates and downloads recipise. Returns 202 (async processing).
declarations_download_xmlDownload the generated XML for a tax declaration. Returns the raw XML content.
declarations_preparePrepare a declaration for agent-based submission. Returns XML content, ANAF URL, Bearer token, and CIF needed by the local agent to proxy the mTLS request. Use operation param for different flows: submit (default), listMessages, download.
declarations_agent_resultSubmit the ANAF response received via the local agent back to the server. The server parses the response, extracts the upload ID, sets status to PROCESSING, and dispatches status checking.
defaults_invoiceGet all default values and dropdown options needed for invoice creation. Returns VAT rates, currencies with symbols, payment terms (in days), units of measure, payment methods, and current BNR exchange rates for EUR/USD/GBP/CHF relative to RON. Always fetch this before creating invoices — never hard…
delivery_notes_listList delivery notes for the selected company with optional filtering by status, date range, client, and search term. Delivery notes document physical delivery of goods or completion of services.
delivery_notes_getGet complete details for a specific delivery note including all line items, client information, deputy details, and calculated totals.
delivery_notes_createCreate a new delivery note in draft status. Delivery notes document physical delivery of goods or services and can later be converted to invoices. Include deputy information for proof of delivery. A default delivery_note series is auto-assigned if neither seriesId nor documentSeriesId is provided.
delivery_notes_updateUpdate an existing delivery note. Delivery notes in draft or issued status can be updated. Replaces all line items with the provided array.
delivery_notes_deletePermanently delete a delivery note. Only draft delivery notes can be deleted. Use cancel for issued delivery notes to preserve audit trail.
delivery_notes_issueMark a delivery note as issued when the physical delivery of goods or completion of services occurs. Transitions status from draft to issued. Once issued, the delivery note becomes read-only.
delivery_notes_cancelCancel a delivery note when delivery will not occur. Can be cancelled from draft or issued status. Preserves historical record unlike deletion. Optionally provide a cancellation reason.
delivery_notes_pdfDownload the PDF for a delivery note. Returns base64-encoded PDF binary data. The delivery note must be in issued or converted status. Optionally hide VAT or prices for simplified delivery documents.
delivery_notes_convertConvert a delivery note into a final invoice. Creates a new invoice with all delivery note data, marks the delivery note as converted, and establishes a link between the two documents. Returns both the new invoice and updated delivery note.
delivery_notes_restoreRestore a cancelled delivery note back to draft status. Only cancelled delivery notes can be restored. This reverses the cancellation and allows the delivery note to be re-issued.
delivery_notes_emailSend a delivery note to a client via email with the PDF attached. Supports custom subject, body, CC, and BCC recipients.
189 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
STORNO_BASE_URLNo https://api.storno.ro API base URLSTORNO_COMPANY_ID"": "your-company-uuid"STORNO_EMAILNo — Email for auto-login (if no token)STORNO_HTTP_HOSTNo 127.0.0.1 HTTP bind address (used with STORNO_HTTP_PORT)STORNO_HTTP_PORTNo — If set, starts Streamable HTTP transport on this portSTORNO_OAUTH_BASE_URLSTORNO_OAUTH_CLIENT_IDSTORNO_PASSWORDNo — Password for auto-login (if no token)STORNO_REFRESH_TOKENNo — JWT refresh token (for auto-renewal)STORNO_TOKEN"": "your-jwt-token",Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
289/289 tools missing one or more hints — accounting_export_settings_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); accounting_export_settings_update (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); accounting_export_zip (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +286 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/stornoro/storno-cli)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check