← Back to search

Facture Électronique France

cmendezs Scanned 27d ago

MCP server for French e-invoicing (XP Z12-013). Manages invoices, validation and compliance.

D
46.8 / 100

Versions

0.1.2latest
first seen Jun 5, 2026
0.3.0
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 34

get_webhook
annotations: none low

Retrieve the full details of a webhook subscription: callback URL, authentication mode, signature configuration, and metadata filters (flow type, direction, processing rule, ack status).

webhook_uid string
get_directory_line_by_code
annotations: none low

Look up a directory line by addressing code (GET /ligne-annuaire/code:{identifiant-adressage}).

identifiant_adressage string
submit_flow
annotations: none low

Submit an electronic invoice, e-reporting, or lifecycle status to the Approved Platform. Scope: Compatible Solution (CS) mode, no payload validation. See README "Scope" section. This is the primary action for sending B2B invoices (Factur-X, UBL, CII), B2BInt/B2C e-reportings, or CDAR lifecycle status messages. HUMAN-IN-THE-LOOP: This tool requires explicit user confirmation. Call without confirmation_token first; show the returned summary to the user; then call again with the provided token to execute the submission. BEHAVIOR: - Submission is asynchronous: the AP returns a flowId and an initial status (typically 'Deposited'), not the final delivery status. Poll get_flow(flow_id) or search_flows to track processing. - Returns an error dict (with 'error' key) if the base64 encoding is invalid. - The AP may reject the flow synchronously (e.g. malformed XML, unknown recipient, quota exceeded); in that case the response contains an error code and message. - If processing_rule is B2B, the recipient must be registered in the PPF directory with an active directory line; verify with get_directory_line before submitting. RESPONSE on success: includes flowId (AP-assigned identifier), trackingId (echoed back), status (initial processing status), and submittedAt timestamp. USAGE GUIDELINES: - Always call get_directory_line (or search_directory_line) first to confirm the recipient is reachable and to identify their Approved Platform before submitting a B2B invoice. - Set a meaningful tracking_id (invoice number or UUID) to simplify later retrieval via search_flows. - After submission, use get_flow(flow_id, doc_type='Metadata') to monitor the flow status. - For lifecycle statuses on received invoices (Refused, Approved, etc.), prefer submit_lifecycle_status which provides structured status fields and handles mandatory PPF transmissions. - Call healthcheck_flow before a batch submission to confirm the AP is available.

file_name string flow_type string file_base64 string flow_syntax string tracking_id string processing_rule string confirmation_token string
search_flows
annotations: none low

Search flows (invoices, statuses, e-reportings) in the Approved Platform by criteria: flow type, status, processingRule, period, trackingId. Pagination via updatedAfter: use the 'nextUpdatedAfter' field from the response as the updated_after parameter value to get the next page.

limit string status string flow_type string tracking_id string updated_after string processing_rule string
get_flow
annotations: none low

Retrieve a flow by its identifier. docType allows choosing between JSON metadata (Metadata), the original document (Original), the converted document (Converted), or the readable representation (ReadableView). By default, returns the JSON metadata (status, dates, identifiers).

flow_id string doc_type string
create_webhook
annotations: none low

Subscribe to webhook notifications from the Approved Platform. The AP will POST event payloads to the callback URL whenever a flow matching the specified filters (flow type, direction, processing rule, ack status) is created or updated. HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

auth_type string flow_type string ack_status string auth_user_id string callback_url string signature_key string auth_client_id string auth_token_url string flow_direction string signature_algo string processing_rule string auth_client_secret string auth_user_password string confirmation_token string
submit_lifecycle_status
annotations: none low

Emit a processing status on a received invoice: Refused, Approved, PartiallyApproved, Disputed, Suspended, Cashed, PaymentTransmitted, Cancelled. Refused and Cashed are mandatory transmissions to PPF. Reason is mandatory for Refused, Disputed, PartiallyApproved, and Suspended. Builds a real CDAR (CrossDomainAcknowledgementAndResponse, XP Z12-014 v1.4) document — see mcp_facture_electronique_fr.clients.flow_client for the MDT-* field mapping this depends on. HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

reason string currency string invoice_id string reason_code string status_code string payment_date string included_note string recipient_uri string payment_amount string issuer_party_id string party_id_scheme string issuer_role_code string receipt_datetime string requested_action string invoice_type_code string issuer_party_name string confirmation_token string invoice_issue_date string recipient_party_id string referenced_flow_id string recipient_role_code string recipient_party_name string requested_action_code string
healthcheck_flow
annotations: none low

Check the availability of the Approved Platform's Flow Service. Returns the operational status of the service (ok/degraded/unavailable). Use before an invoice submission session to ensure the AP is reachable.

validate_facturx
annotations: none low

Validate a Factur-X CII XML document against its profile's Schematron ruleset. Scope: Schematron (SVRL) business-rule validation only, no XSD structural check. Returns is_valid, errors, and warnings (rule_id, location, text). Use this before embedding the XML into a PDF/A-3 or submitting via submit_flow. Requires the optional `saxonche` extra (FR-XSLT2-1, resolved in mcp-einvoicing-core 1.14.0): the bundled Factur-X 1.09.2 Schematron stylesheets require XSLT 2.0, which lxml/libxslt (XSLT 1.0 only) cannot compile. Install with `pip install mcp-facture-electronique-fr[xslt2]`. If it is missing, this tool returns level="unavailable" with is_valid=None instead of raising.

profile string xml_content string
validate_ereporting_xml
annotations: none low

Validate a DGFiP e-reporting (Flux 10) FRR XML payload. Scope: XSD schema validation only, no business-rule checks. See README "Scope" section. Checks the XML against the DGFiP Spécifications Externes v3.2 ereporting.xsd. Returns validation result with errors if any. Use this before submitting to catch structural problems early. Validation levels (in order of preference): - xsd — full schema validation - wellformedness — XML failed to parse (malformed or unsafe input) - none — XSD files not found on disk

xml_content string
submit_transaction_report
annotations: none low

Submit a DGFiP Flux 10.1 / 10.3 transaction e-reporting flow. Scope: Compatible Solution (CS) mode, no payload validation. See README "Scope" section. Builds a FRR XML payload conforming to DGFiP Spécifications Externes v3.2 (transaction.xsd / ereporting.xsd) and submits it to the Approved Platform via POST /v1/flows with flowSyntax="FRR". Use for: - International B2B outbound sales (processing_rule=B2BInt, flow_type=IndividualCustomerTransactionReport) - International B2B inbound purchases (processing_rule=B2BInt, flow_type=UnitarySupplierTransactionReport) - B2C individual transactions (processing_rule=B2C, flow_type=IndividualCustomerTransactionReport) - Aggregated B2C reports (processing_rule=B2C, flow_type=AggregatedCustomerTransactionReport)

flow_type string issuer_id string sender_id string type_code string period_end string issuer_name string sender_name string tracking_id string period_start string invoices_json string issue_datetime string processing_rule string transmission_id string issuer_id_scheme string issuer_role_code string sender_id_scheme string sender_role_code string transmission_name string confirmation_token string
submit_payment_report
annotations: none low

Submit a DGFiP Flux 10.2 / 10.4 payment e-reporting flow. Scope: Compatible Solution (CS) mode, no payload validation. See README "Scope" section. Builds a FRR XML payload conforming to DGFiP Spécifications Externes v3.2 (payment.xsd / ereporting.xsd) and submits it to the Approved Platform via POST /v1/flows with flowSyntax="FRR". Use for: - International B2B payment reporting (processing_rule=B2BInt, flow_type=UnitaryCustomerPaymentReport) - B2C individual payment reporting (processing_rule=B2C, flow_type=UnitaryCustomerPaymentReport) - Aggregated B2C payment reporting (processing_rule=B2C, flow_type=AggregatedCustomerPaymentReport)

flow_type string issuer_id string sender_id string type_code string period_end string issuer_name string sender_name string tracking_id string period_start string invoices_json string issue_datetime string processing_rule string transmission_id string issuer_id_scheme string issuer_role_code string sender_id_scheme string sender_role_code string transmission_name string confirmation_token string
list_webhooks
annotations: none low

List all webhook subscription IDs owned by the current OAuth2 token holder. Returns a list of webhook UUIDs. Use get_webhook with each ID to retrieve the full subscription details (callback URL, filters, authentication).

update_webhook
annotations: none low

Update a webhook subscription's technical parameters (authentication, signature, custom headers). Metadata filters (flow type, direction) cannot be changed; delete and recreate the webhook instead. Only provided fields are modified (PATCH semantics).

auth_type string webhook_uid string auth_user_id string signature_key string auth_client_id string auth_token_url string signature_algo string auth_client_secret string auth_user_password string
delete_webhook
annotations: none low

Delete (unsubscribe from) a webhook. After deletion, the AP will stop sending notifications to the callback URL. HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

webhook_uid string confirmation_token string
search_company
annotations: none low

Search legal units (SIRENs) in the PPF Annuaire (POST /siren/recherche). A company must appear here before its establishments (SIRETs) or directory lines (ligne-annuaire) can be resolved. Prefer get_company_by_siren when the exact SIREN is already known.

siren string limite string ignorer string type_entite string raison_sociale string etat_administratif string
get_company_by_siren
annotations: none low

Look up a legal unit by SIREN (GET /siren/code-insee:{siren}).

siren string
get_company_by_id_instance
annotations: none low

Look up a legal unit by directory instance ID (GET /siren/id-instance:{id-instance}).

id_instance string
search_establishment
annotations: none low

Search establishments (SIRETs) in the PPF Annuaire (POST /siret/recherche).

siren string siret string limite string ignorer string denomination string etat_administratif string
get_establishment_by_siret
annotations: none low

Look up an establishment by SIRET (GET /siret/code-insee:{siret}).

siret string
get_establishment_by_id_instance
annotations: none low

Look up an establishment by directory instance ID (GET /siret/id-instance:{id-instance}).

id_instance string
search_routing_code
annotations: none low

Search routing codes (POST /code-routage/recherche).

siret string limite string ignorer string etat_administratif string identifiant_routage string libelle_code_routage string
get_routing_code_by_siret_and_code
annotations: none low

Look up a routing code by SIRET and code (GET /code-routage/siret:{siret}/code:{identifiant-routage}).

siret string identifiant_routage string
get_routing_code_by_id_instance
annotations: none low

Look up a routing code by directory instance ID (GET /code-routage/id-instance:{id-instance}).

id_instance string
create_routing_code
annotations: none low

Create a routing code (POST /code-routage). HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

siret string confirmation_token string etat_administratif string identifiant_routage string libelle_code_routage string nature_etablissement string type_identifiant_routage string gestion_engagement_juridique string
update_routing_code
annotations: none low

Partially update a routing code (PATCH /code-routage/id-instance:{id-instance}). Only provided fields are modified.

id_instance string etat_administratif string libelle_code_routage string type_identifiant_routage string
replace_routing_code
annotations: none low

Fully replace a routing code (PUT /code-routage/id-instance:{id-instance}). Unlike update_routing_code, all fields are required and replace the existing object entirely. HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

id_instance string confirmation_token string etat_administratif string libelle_code_routage string type_identifiant_routage string
search_directory_line
annotations: none low

Search directory lines (electronic invoice receiving addresses) (POST /ligne-annuaire/recherche). Call before sending an invoice to verify the recipient has a registered line and to identify their Approved Platform.

siren string siret string limite string ignorer string identifiant_routage string matricule_plateforme string identifiant_adressage string
get_directory_line
annotations: none low

Look up a directory line by directory instance ID (GET /ligne-annuaire/id-instance:{id-instance}).

id_instance string
create_directory_line
annotations: none low

Create a directory line (electronic invoice receiving address) (POST /ligne-annuaire). HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

siren string siret string date_fin_effet string date_debut_effet string suffixe_adressage string confirmation_token string identifiant_routage string matricule_plateforme string
update_directory_line
annotations: none low

Partially update a directory line (PATCH /ligne-annuaire/id-instance:{id-instance}). Only provided fields are modified.

id_instance string date_fin_effet string matricule_plateforme string
replace_directory_line
annotations: none low

Fully replace a directory line (PUT /ligne-annuaire/id-instance:{id-instance}). HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

id_instance string date_fin_effet string confirmation_token string matricule_plateforme string
delete_directory_line
annotations: none low

Delete a directory line (DELETE /ligne-annuaire/id-instance:{id-instance}). HUMAN-IN-THE-LOOP: Requires user confirmation. Call without confirmation_token first, show the summary to the user, then call again with the token.

id_instance string confirmation_token string
check_ppf_annuaire_health
annotations: none low

Check the availability of the PPF Annuaire service (GET /healthcheck). Use before a directory-management session to ensure the service is reachable.

Permissions 2

network medium
Server uses network capabilities via: httpx
filesystem low
Server uses filesystem capabilities via: pathlib

Scan Findings 95

low
Tool 'submit_flow' has no annotations annotation_checker · 100%
low
Tool 'search_flows' has no annotations annotation_checker · 100%
low
Tool 'get_flow' has no annotations annotation_checker · 100%
low
Tool 'submit_lifecycle_status' has no annotations annotation_checker · 100%
low
Tool 'healthcheck_flow' has no annotations annotation_checker · 100%
low
Tool 'validate_facturx' has no annotations annotation_checker · 100%
low
Tool 'validate_ereporting_xml' has no annotations annotation_checker · 100%
low
Tool 'submit_transaction_report' has no annotations annotation_checker · 100%
low
Tool 'submit_payment_report' has no annotations annotation_checker · 100%
low
Tool 'list_webhooks' has no annotations annotation_checker · 100%
low
Tool 'get_webhook' has no annotations annotation_checker · 100%
low
Tool 'create_webhook' has no annotations annotation_checker · 100%
low
Tool 'update_webhook' has no annotations annotation_checker · 100%
low
Tool 'delete_webhook' has no annotations annotation_checker · 100%
low
Tool 'search_company' has no annotations annotation_checker · 100%
low
Tool 'get_company_by_siren' has no annotations annotation_checker · 100%
low
Tool 'get_company_by_id_instance' has no annotations annotation_checker · 100%
low
Tool 'search_establishment' has no annotations annotation_checker · 100%
low
Tool 'get_establishment_by_siret' has no annotations annotation_checker · 100%
low
Tool 'get_establishment_by_id_instance' has no annotations annotation_checker · 100%
low
Tool 'search_routing_code' has no annotations annotation_checker · 100%
low
Tool 'get_routing_code_by_siret_and_code' has no annotations annotation_checker · 100%
low
Tool 'get_routing_code_by_id_instance' has no annotations annotation_checker · 100%
low
Tool 'create_routing_code' has no annotations annotation_checker · 100%
low
Tool 'update_routing_code' has no annotations annotation_checker · 100%
low
Tool 'replace_routing_code' has no annotations annotation_checker · 100%
low
Tool 'search_directory_line' has no annotations annotation_checker · 100%
low
Tool 'get_directory_line_by_code' has no annotations annotation_checker · 100%
low
Tool 'get_directory_line' has no annotations annotation_checker · 100%
low
Tool 'create_directory_line' has no annotations annotation_checker · 100%
low
Tool 'update_directory_line' has no annotations annotation_checker · 100%
low
Tool 'replace_directory_line' has no annotations annotation_checker · 100%
low
Tool 'delete_directory_line' has no annotations annotation_checker · 100%
low
Tool 'check_ppf_annuaire_health' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in cmendezs-mcp-facture-electronique-fr-3d979c8/tests/test_directory.py auth_checker · 95%
high
Hardcoded OAuth client secret in cmendezs-mcp-facture-electronique-fr-3d979c8/tests/test_flow.py auth_checker · 95%
info
Tool: check_ppf_annuaire_health manifest_parser · 90%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-5h2m-4q8j-pqpj) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-c2jp-c369-7pvx) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-m8x7-r2rg-vh5g) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-mxxr-jv3v-6pgc) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-rcfx-77hg-w2wv) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-rj5c-58rq-j5g5) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-rww4-4w9c-7733) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (GHSA-vv7q-7jx5-f767) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (PYSEC-2026-1364) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (PYSEC-2026-1365) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (PYSEC-2026-2474) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (PYSEC-2026-2475) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (PYSEC-2026-2476) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0.0 (PYSEC-2026-338) dependency_analyzer · 95%
medium
Vulnerable dependency: python-dotenv@1.0.0 (GHSA-mf9w-mj56-hr94) dependency_analyzer · 95%
medium
Vulnerable dependency: python-dotenv@1.0.0 (PYSEC-2026-2270) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: submit_flow manifest_parser · 90%
info
Tool: search_flows manifest_parser · 90%
info
Tool: get_flow manifest_parser · 90%
info
Tool: submit_lifecycle_status manifest_parser · 90%
info
Tool: healthcheck_flow manifest_parser · 90%
info
Tool: validate_facturx manifest_parser · 90%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
info
Tool: validate_ereporting_xml manifest_parser · 90%
info
Tool: submit_transaction_report manifest_parser · 90%
info
Tool: submit_payment_report manifest_parser · 90%
info
Tool: list_webhooks manifest_parser · 90%
info
Tool: get_webhook manifest_parser · 90%
info
Tool: create_webhook manifest_parser · 90%
info
Tool: update_webhook manifest_parser · 90%
info
Tool: delete_webhook manifest_parser · 90%
info
Tool: search_company manifest_parser · 90%
info
Tool: get_company_by_siren manifest_parser · 90%
info
Tool: get_company_by_id_instance manifest_parser · 90%
info
Tool: search_establishment manifest_parser · 90%
info
Tool: get_establishment_by_siret manifest_parser · 90%
info
Tool: get_establishment_by_id_instance manifest_parser · 90%
info
Tool: search_routing_code manifest_parser · 90%
info
Tool: get_routing_code_by_siret_and_code manifest_parser · 90%
info
Tool: get_routing_code_by_id_instance manifest_parser · 90%
info
Tool: create_routing_code manifest_parser · 90%
info
Tool: update_routing_code manifest_parser · 90%
info
Tool: replace_routing_code manifest_parser · 90%
info
Tool: search_directory_line manifest_parser · 90%
info
Tool: get_directory_line_by_code manifest_parser · 90%
info
Tool: get_directory_line manifest_parser · 90%
info
Tool: create_directory_line manifest_parser · 90%
info
Tool: update_directory_line manifest_parser · 90%
info
Tool: replace_directory_line manifest_parser · 90%
info
Tool: delete_directory_line manifest_parser · 90%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 70%
critical
Tool poisoning in 'submit_flow': Directive language: 'always' poisoning · 85%
critical
Tool poisoning in 'submit_flow': Cross-tool sequencing directive poisoning · 85%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%