tally-mcp-server (vimarsh244/tally-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 30 tools. No publisher has claimed this listing.

C
Emerging
74/100

tally-mcp-server

Tally Prime MCP (Model Context Protocol) Server implementation to feed Tally ERP data to popular LLM like Claude, ChatGPT supporting MCP

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

vimarsh244

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
30 tools verified — handlers match their declared behaviour
3 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: ALLOW_DEFAULT_PASSWORD, PASSWORD, TLS_PFX_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes30 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

set-company

sets the active company context in Tally Prime. This changes the global company context used by Tally for subsequent operations and report queries

set-period

sets the active reporting period in Tally Prime by specifying a from date and to date. This changes the global period context used by Tally for subsequent report queries

stock-summary

fetches stock item summary with fields stock_item_name, stock_group_name, opening_quantity, opening_value, inward_quantity, inward_value, outward_quantity, outward_value, closing_quantity, closing_value, returns output cached in pglite postgres in-memory table (specified in tableID property). synony

stock-item-balance

fetches stock item remaining quantity balance as on date, tool returns quantity and unit of measurement

stock-item-account

fetches GL stock item account statement with voucher level details containing fields date, voucher_type, voucher_number, party_name, quantity, amount, narration, tracking_number, voucher_category. party_name = ledger_name. quantity = inward as positive and outward as negative. amount = debit is nega

list-master

fetches list of masters from Tally Prime collection e.g. group, ledger, vouchertype, unit, godown, stockgroup, stockitem, costcategory, costcentre, attendancetype, company, currency, gstin, gstclassification returns output in JSON string array in the property list

ledger-balance

fetches ledger closing balance as on date, negative is debit and positive is credit, display Dr for Debit or Cr for Credit after the amount for better readability, instead of negative amount flip Debit or Credit to make it positive

bills-outstanding

fetches pending overdue outstanding bills receivable or payable as on date with fields bill_date,reference_number,outstanding_amount,party_name,overdue_days. outstanding_amount = Debit is negative and Credit is positive. party_name = ledger_name. returns output cached in pglite postgres in-memory ta

ledger-account

fetches GL ledger account statement with voucher level details containing fields guid, date, voucher_type, voucher_number, alternate_ledger, party_name, amount, narration . amount = debit is negative and credit is positive. alternate_ledger = if amount is credit then ledger by which it is debited an

metadata-collection

returns collections metadata with collection and description

metadata-fields

returns fields metadata for the selected tally collection containing field name, optional description and data type which can be string, number, date or boolean

query-option-values

returns predefined option values or drop-down values for the fields required for master and voucher creation, it returns back object array of pre-defined values

query-database

executes sql query on pglite postgres in-memory database for querying cached Tally Prime report data in table generated as output by other tools (in tableID property from tool output response). These tables are temporary and will be dropped after 15 minutes automatically. Use this tool to run comple

query-collection

queries a Tally Prime collection with selected fields and optional context like target company and reporting period. result is cached in pglite postgres in-memory table and returned as tableID. Use query-database tool to run SQL queries against that table for further analysis

chart-of-accounts

fetches chart of accounts or GL hierarchy with fields ledger_name, group_name, primary_group, bs_pl, dr_cr, affects_gross_profit, sort_position. the column bs_pl will have values false = Balance Sheet / true = Profit Loss. Column dr_cr as value true = Debit / false = Credit. primary_group is the pri

trial-balance

fetches trial balance with fields ledger_name, group_name (blank if Profit & Loss), opening_balance, net_debit, net_credit, closing_balance. opening_balance and closing_balance negative is debit and positive is credit. checks holds the total of each column, and on a balanced set of books the opening

profit-loss

fetches profit and loss statement with fields like ledger_name, group_name, closing_balance. closing_balance negative is debit or expense and positive is credit or income. closing stock to be treated as credit, kindly fetch data from chart-of-accounts tool to pull group hierarchy before calling this

balance-sheet

fetches balance sheet with fields like ledger_name, group_name (blank if Profit & Loss A/c), closing_balance. closing balance negative is debit or asset and positive is credit or liability. Profit & Loss A/c carries the result of the period and is reported once, with a blank group_name. checks.closi

voucher-create-update

creates new transactions or replaces existing ones in Tally Prime. amount = debit is negative and credit is positive, and every amount of a voucher must add up to zero. every ledger, voucher type and stock item is validated before anything is sent, so an invalid batch changes nothing in Tally. an al

voucher-cancel-delete

cancels or deletes existing transactions in Tally Prime. a cancelled voucher keeps its number and stays visible in the daybook with no entries, a deleted voucher is removed. every guid is looked up in the daybook first, so an unknown one changes nothing in Tally. this cannot be undone

daybook

fetches the daybook, one row per voucher entered in the period, with fields guid, date, voucher_type, voucher_number, reference, party_name, amount, narration, is_cancelled, is_optional. amount = total debit value of the voucher, always positive, and is zero for a voucher with no accounting entry su

voucher-get

fetches one complete voucher by its guid, with every ledger line, bill reference and inventory line. use the daybook tool or the ledger-account tool first to obtain the guid and the date. amount = debit is negative and credit is positive, on the voucher itself and on every line. the result is return

ledger-create-update

create or update ledger master data in Tally Prime, returns success count of created and / or altered records. a property left undefined keeps its current value in Tally, so a partial update is safe. read the result back with the query-collection tool on the ledger collection to confirm the fields T

group-create-update

create or update accounting group master data in Tally Prime, returns success count of created and / or altered records

stock-group-create-update

create or update stock group master data in Tally Prime, returns success count of created and / or altered records

unit-create-update

create or update unit of measurement master data in Tally Prime, returns success count of created and / or altered records. a simple unit carries a symbol and a formal name, a compound unit is built from two existing simple units and a conversion

godown-create-update

create or update godown or warehouse or location master data in Tally Prime, returns success count of created and / or altered records

stock-item-create-update

create or update stock item or product master data in Tally Prime, returns success count of created and / or altered records. an opening balance needs the quantity together with a rate or a value

company-create

creates a new company in Tally Prime. this is not the same as the set-company tool, which only selects a company that already exists. the company is created in the data directory Tally is configured to use. Tally must accept company creation over the XML interface for this to work, so read the retur

delete-master

deletes a master object from selected collection in Tally Prime and returns success count of deleted records

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configACCESS_TOKEN_TTL_MSLifetime of an issued access token (optional, default is 3600000, i.e. 1 hour)
configALLOWED_HOSTSExtra Host header values the /mcp endpoint accepts, comma separated. The value of MCP_DOMAIN and the loopback names are always accepted (optional)
🔐 secretALLOW_DEFAULT_PASSWORDSet to 1 to start on a public domain with the default password anyway (optional, default is 0). Only for a deployment you know is otherwise protected
configAUTH_ATTEMPT_LIMITFailed password attempts allowed per address per window (optional, default is 10)
configAUTH_ATTEMPT_WINDOW_MSLength of that window (optional, default is 900000, i.e. 15 minutes)
configBIND_HOSTAddress the HTTP server binds to. Set 127.0.0.1 to accept connections from this machine only (optional, default is 0.0.0.0, i.e. every interface)
configBLOCK_WRITEControls if MCP completely block access of write functionality. Setting this flag to value 1 will completely hide write functionality tools from the tool list. [ 0 = Allow , 1 = Block ] (optional, default is 0 i.e. allowed). Not applicable for Claude Desktop (as it offers graphical switch to disable write functionality)
configCACHE_INSERT_BATCH_ROWSRows sent to the in-memory database in one INSERT (optional, default 500). Held below the 32767 bind parameters a statement may carry, whatever is set here
configCACHE_TABLE_TTL_MSMilliseconds a cached result table survives before it is dropped (optional, default is 900000, i.e. 15 minutes)
configINLINE_BYTE_LIMITUpper bound in bytes on an inline result, so a few long narrations cannot make a large response (optional, default 4096)
configINLINE_ROW_LIMITA result of this many rows or fewer is also returned inline under rows, so reading it needs no second call (optional, default 25). Set 0 to always answer with the table id alone
configMAX_REGISTERED_CLIENTSUpper bound on dynamically registered OAuth clients (optional, default is 100)
configMCP_DOMAINDomain name of Tally MCP Server website (optional, default is https://localhost:9000). Not applicable for Claude Desktop
configMULTI_USERSet to 1 to serve one profile per Tally user at /u/<id>/mcp. Each profile has its own Tally port, password and token, and the unprefixed routes are switched off (optional, default is 0)
🔐 secretPASSWORDPassword for the OAuth Login front-end page to authenticate genuine user. The server refuses to start on a non-local MCP_DOMAIN while this is left at the default of password. Not applicable for Claude Desktop
configProgramDataWhere the profile registry and the admin token are kept. Applies only when MULTI_USER=1 (optional, defaults to %ProgramData%\TallyMcpServer on Windows and ~/.tally-mcp-server elsewhere)
configREFRESH_TOKEN_TTL_MSLifetime of an issued refresh token (optional, default is 2592000000, i.e. 30 days)
configTALLY_HOSTHost name or IP where XML Server is running (optional, default is localhost)
configTALLY_MAX_CONCURRENTRequests allowed against one Tally at a time, per host and port (optional, default 4). Tally builds one report at a time, so a higher number mostly moves the queue into Tally. Set 0 to remove the limit
configTALLY_MCP_DATA_DIRWhere the profile registry and the admin token are kept. Applies only when MULTI_USER=1 (optional, defaults to %ProgramData%\TallyMcpServer on Windows and ~/.tally-mcp-server elsewhere)
configTALLY_PORTPort Number of XML Server of Tally (optional, default is 9000)
configTALLY_TIMEOUTMilliseconds to wait for a reply from Tally before giving up (optional, default is 120000, i.e. 2 minutes)
🔐 secretTLS_PFX_PASSWORD
configTLS_PFX_PATH
configTRACESet to 1 to emit one structured timing record per tool call on stderr: queue wait, wait for Tally's first byte, the whole Tally request with byte counts, the cache insert with its row count, and the SQL. Stage names, durations and sizes only (optional, default 0)
configTRUST_PROXYSet to 1 when running behind a reverse proxy, so the attempt limiter sees the real client address from X-Forwarded-For (optional, default is 0)
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

All four hints declared on every tool

18/30 tools missing one or more hints — stock-summary (missing: destructiveHint, idempotentHint); stock-item-balance (missing: destructiveHint, idempotentHint); stock-item-account (missing: destructiveHint, idempotentHint), +15 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Dependency freshness

1/7 production deps stale: nunjucks@2023-04-13 (3.4y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/vimarsh244/tally-mcp-server)](https://m8ven.ai/mcp/vimarsh244/tally-mcp-server)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: d6a34ac6dfd532d608342f5ab47eea16b09611af
code hash: 5a4c77bd259c9e7d8ee0c5162457e21b9e56c1edecdfb944fbbf7bc856417028
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client