# @ekwo-ai/mcp MCP server for Ekwo OS: let an AI assistant work on the books, under the user's own row level security. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 0.8.0 - **Author:** Ekwo AI - **License:** AGPL-3.0-only - **npm:** @ekwo-ai/mcp - **Source:** https://github.com/Ekwo-ai/ekwo-os - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-23T11:29:19.736Z - **Version scanned:** 0.8.0 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `list_companies` — The companies of this installation that you are a member of, with your role on each. Start here: every other tool needs a company_id. Returns id, name, country, - `get_company` — Everything needed before booking in a company: its financial years and whether they are closed, its lock dates, its journals, and the accounts that play the rec - `list_accounts` - `search_contacts` — Customers, suppliers and other third parties of a company, by name, by type or by VAT number. Use it before creating a document: a document is booked against a - `list_documents` — Invoices, credit notes and quotes of a company, filtered by type, state, settlement state, contact or date range. `state` is the document (draft, posted, cancel - `get_document` — One document with its lines, the account and tax of each line, the legal mentions its country requires on it, that country's payment and e-invoicing rules, and - `get_preferences` — The signed-in user’s own preferences — which company an interface opens on, the language they read labels in, their timezone and how they like a date and a numb - `list_api_keys` — The keys a company has issued to machines, what each one may do, when it was last used and whether it is still live. Only somebody who manages members sees them - `list_invitations` — The people invited into a company and not yet on its books, with the preset and the capabilities each was invited with, and whether the invitation is still pend - `list_shares` — The links a company has published onto its own sales documents, with how many times each was opened and when it was last opened. No token is in here: a link is - `list_bank_transactions` — Statement lines of a company, pending by default — the ones still waiting to be dealt with. `amount` is signed: positive is money in. A statement line is not a - `trial_balance` — Opening balance, movements of the period and closing balance for every account, from posted entries only. The debit and credit totals are equal on a healthy led - `general_ledger` — Every posted line of an account over a period, with the balance carried forward from before it and a running balance. Give account_code for one account; leave i - `aged_balance` — What customers still owe (or what is still owed to suppliers), bucketed by how overdue it is. It reads unmatched ledger lines, not invoices, so it ties back to - `vat_return` — The boxes of the VAT return for a period, with their names: the base and tax boxes are summed from what the postings wrote on the ledger lines, the totals are d - `ec_sales_list` - `portfolio_upcoming_filings` - `portfolio_filings_touched_since` - `list_statements` — The schemes this company can be presented on: those of its country and of its chart of accounts, plus the generic framework by account type that fits any chart. - `financial_statement` — A balance sheet or an income statement for a period, on the scheme the country pack declares — the Belgian abbreviated model, the French liasse — or on the gene - `generate_fec` — The Fichier des Écritures Comptables for a period: the eighteen columns of the arrêté du 29 juillet 2013, as text, with the checks a tax inspector applies first - `describe_pack` - `status` — The schema version, the instance this is, how this server is connected and as whom, and the companies you can see. Use it first when something does not add up — - `read_audit_log` - `search_products` — The catalogue of a company: what it sells and buys, with the code, the unit, the price, the account each books to and the tax each carries. Search it before wri - `create_product` — Adds an item to the catalogue: a code unique in the company, a name, a unit, a price, and optionally the account and the tax a sale or a purchase of it carries. - `update_product` — Changes a catalogue row — its name, price, unit, account, tax — or retires it with active: false. Documents already written keep the text, the price and the acc - `create_contact` — Adds a customer, supplier or other third party to a company. Search first: a duplicate contact splits a customer account in two and the aged balance stops makin - `create_document` - `update_document_lines` - `post_document` - `cancel_document` - `reverse_entry` - `record_payment` - `reconcile` - `unreconcile` - `create_bank_account` - `list_bank_accounts` - `create_bank_transaction` - `import_bank_statement` ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@ekwo-ai/mcp\"\n ],\n \"env\": {\n \"SUPABASE_ANON_KEY\": \"\",\n \"EKWO_PASSWORD\": \"\",\n \"EKWO_ACCESS_TOKEN\": \"\",\n \"EKWO_DB_URL\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `SUPABASE_ANON_KEY` — Supabase Anon Key (optional) - `EKWO_PASSWORD` — Ekwo Password (optional) - `EKWO_ACCESS_TOKEN` — Ekwo Access Token (optional) - `EKWO_DB_URL` — Ekwo DB URL (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 4 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Moderate blast radius — holds an api key; runs on your machine. - Floor 26, ceiling 26 (tier: moderate) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40ekwo-ai%2Fmcp - Install plan: https://forgeregistry.com/api/v1/packages/%40ekwo-ai%2Fmcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40ekwo-ai%2Fmcp - HTML page: https://forgeregistry.com/registry/%40ekwo-ai%2Fmcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.