toconline-mcp (themiguelamador/toconline-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 58 tools. No publisher has claimed this listing.
Local MCP server for TOCOnline accounting/invoicing API that enables AI assistants to manage customers, products, sales documents, and call arbitrary endpoints via natural language after OAuth login.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
themiguelamador
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
list_addressesList addresses. Normally scope to a customer_id or supplier_id.
get_addressFetch a single address by id.
create_addressCreate an address attached to a customer or supplier.
update_addressUpdate an address. Only non-null fields are sent.
delete_addressDelete an address. Requires `confirm=true`.
auth_statusReport whether TOCOnline credentials are configured and their expiry.
loginOpen a browser and complete OAuth login against TOCOnline.
logoutDelete the stored TOCOnline credentials and drop in-memory tokens.
list_bank_accountsList company bank accounts (name, IBAN, SWIFT, type).
get_bank_accountFetch a single bank account by id, enriched with derived `id_banco` and `pais_conta` fields (see `list_bank_accounts` for the rules).
list_bank_transactionsList bank transactions (movements) imported into TOCOnline.
get_bank_transactionFetch a single bank transaction by id.
get_current_companyReturn the authenticated company's own profile.
list_contactsList contacts. Normally scope to a customer_id or supplier_id.
get_contactFetch a single contact by id.
create_contactCreate a contact attached to a customer or supplier.
update_contactUpdate a contact. Only non-null fields are sent.
delete_contactDelete a contact. Requires `confirm=true`.
list_customersList customers. All filters are exact match.
get_customerFetch a single customer by id.
create_customerCreate a customer. Returns the created record.
update_customerUpdate a customer. Only non-null fields are sent.
get_document_pdf_urlGet a signed, shareable URL to a PDF render of a document or receipt.
send_document_emailSend a sales document or receipt to a recipient by email.
finalize_sales_documentFinalize (issue) a draft sales document.
finalize_purchase_documentFinalize a draft purchase document.
void_sales_receiptVoid (anular) a sales receipt.
void_purchase_documentVoid (anular) a purchase document.
api_requestEscape hatch for endpoints not covered by typed tools.
gmail_auth_statusReport whether Gmail credentials are configured and their expiry.
gmail_loginRun the Google OAuth browser flow and store Gmail credentials.
gmail_logoutDelete stored Gmail credentials and drop in-memory tokens.
gmail_search_messagesSearch Gmail and return compact message metadata.
gmail_get_messageFetch one message's metadata and attachment list.
gmail_download_attachmentDownload one attachment to `save_dir`. Returns the saved path and size.
gmail_list_labelsList Gmail labels (system + user) with their ids.
gmail_create_labelCreate a Gmail label. Fails if a label of the same name already exists.
gmail_add_label_to_messageAdd a label to a message — useful to mark it as processed/imported.
gmail_remove_label_from_messageRemove a label from a message.
list_productsList products. All filters are exact match.
get_productFetch a single product by id.
list_purchase_documentsList commercial purchase documents, newest first by default.
get_purchase_documentFetch a purchase document, optionally with its line items merged.
create_purchase_documentCreate a purchase document with lines in a single v1 call.
list_purchase_paymentsList purchase payments, newest first by default.
get_purchase_paymentFetch a single purchase payment by id.
create_purchase_paymentCreate a purchase payment record.
list_sales_documentsList commercial sales documents, newest first by default.
get_sales_documentFetch a sales document, optionally with its line items merged.
create_sales_documentCreate a sales document with line items.
delete_sales_documentDelete a draft sales document.
list_sales_receiptsList sales receipts (customer payments), newest first by default.
get_sales_receiptFetch a single sales receipt by id.
create_sales_receiptCreate a sales receipt (customer payment) record.
list_servicesList services. All filters are exact match.
get_serviceFetch a single service by id.
list_suppliersList suppliers. All filters are exact match.
get_supplierFetch a single supplier by id.
TOCONLINE_CREDENTIALS_PATHoverride the credentials file location.XDG_CONFIG_HOMETOCONLINE_REDIRECT_PORTTOCONLINE_CLIENT_IDexport ='...'TOCONLINE_CLIENT_SECRETexport ='...'TOCONLINE_AUTH_URLexport ='<OAUTH_URL>/auth'TOCONLINE_TOKEN_URLexport ='<OAUTH_URL>/token'TOCONLINE_API_BASEexport ='<API_URL>'TOCONLINE_SCOPETOCONLINE_ENV_FILE1. Whatever points at (if set).GMAIL_CLIENT_ID/ GMAIL_CLIENT_SECRET — skip the CLI prompts duringGMAIL_CLIENT_SECRETGMAIL_CLIENT_ID / — skip the CLI prompts duringGMAIL_SCOPETOCONLINE_GMAIL_CREDENTIALS_PATHoverride the credentials file location.TOCONLINE_GMAILtools only appear once Gmail credentials exist (or you set =1).TOCONLINE_LOG_LEVELDEBUG, INFO, WARNING, etc. Logs go to stderr.Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
58/58 tools missing one or more hints — list_addresses (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_address (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); create_address (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +55 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Destructive tools are labelled
2 tools perform destructive updates without destructiveHint — logout deletes at line 112 (path.unlink()); gmail_logout deletes at line 76 (path.unlink())
Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.
Tool inputs are validated
52/58 tool handlers declare input schemas (90%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 2/58 tool handlers wrap calls in try/catch (3%)
Wrap each tool handler body in try/catch and return a structured error response.
Tests exist
No test files found
Add tests that exercise each declared tool.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/themiguelamador/toconline-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check