← Back to search

io.github.dontsovcmc/tochka-bank

dontsovcmc Scanned 20d ago

MCP server for Tochka Bank API — balance, payments, invoices, UPD, payment tracking

D
40 / 100

Versions

0.6.2latest
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 44

goods_list
annotations: none low

List all goods from local catalog. Use goods_add/goods_remove to manage. Returns JSON array of goods with name, unit, and price.

goods_add
annotations: none low

Add a new good to local catalog. Args: name: Product name (e.g. "Wi-Fi модем Ватериус") unit: Unit of measurement (шт., компл., усл.ед., etc.) price: Price per unit as string (e.g. "5290.00")

name str unit str price str
goods_remove
annotations: none low

Remove a good from local catalog by exact name. Args: name: Exact product name to remove

name str
tochka_balance
annotations: none low

Get bank account balance from Tochka Bank. For all accounts at once, use tochka_all_balances. Returns JSON with accountId, customerCode, currency, and balances (OpeningAvailable, ClosingAvailable, Expected).

tochka_payment
annotations: none low

Create outgoing payment order (I pay someone). Returns signing URL. The payment must be signed in Tochka internet bank to be processed. Args: counterparty_name: Recipient company name counterparty_inn: Recipient INN (10-12 digits) counterparty_bic: Recipient bank BIC (9 digits) counterparty_account: Recipient account number (20 digits) counterparty_corr_account: Recipient bank correspondent account (20 digits) amount: Payment amount in rubles purpose: Payment purpose (max 210 chars) counterparty_kpp: Recipient KPP (optional, 9 digits)

amount float purpose str counterparty_bic str counterparty_inn str counterparty_kpp str counterparty_name str counterparty_account str counterparty_corr_account str
tochka_invoice
annotations: none low

Issue an invoice to a buyer (they pay me). Returns documentId. Args: buyer_name: Buyer company name buyer_inn: Buyer INN buyer_type: "company" or "ip" number: Invoice number positions: JSON array of positions, each with positionName, unitCode, ndsKind, price, quantity, totalAmount buyer_kpp: Buyer KPP (optional) buyer_address: Buyer legal address (optional) total: Total amount (calculated from positions if empty) nds_total: Total VAT amount (optional) based_on: Basis document (optional) comment: Comment (optional) pay_until_date: Payment deadline YYYY-MM-DD (optional)

total str number str comment str based_on str buyer_inn str buyer_kpp str nds_total str positions str buyer_name str buyer_type string buyer_address str pay_until_date str
tochka_download_invoice
annotations: none low

Download invoice PDF to local file. Args: document_id: Invoice UUID from tochka_invoice result output_path: Absolute path to save PDF (e.g. /tmp/invoice_42.pdf)

document_id str output_path str
tochka_delete_closing_document
annotations: none low

Delete a closing document (UPD/Act) by document ID. Args: document_id: Closing document UUID from tochka_upd result

document_id str
tochka_subscriptions
annotations: none low

Get list of payment subscriptions. Args: page: Page number (default 1) per_page: Results per page (default 1000)

page int per_page int
tochka_upd
annotations: none low

Create UPD (universal transfer document). Returns documentId and signURL. function defaults to "schfdop" (invoice + primary document). Args: buyer_name: Buyer company name buyer_inn: Buyer INN buyer_type: "company" or "ip" number: UPD number positions: JSON array of positions (same format as invoice) buyer_kpp: Buyer KPP (optional) buyer_address: Buyer legal address (optional) total: Total amount (calculated from positions if empty) nds_total: Total VAT amount (optional) based_on: Basis document (optional) parent_document_id: Parent invoice UUID (optional, links UPD to invoice) function: "schfdop" (invoice + primary) or "dop" (primary only)

total str number str based_on str function str buyer_inn str buyer_kpp str nds_total str positions str buyer_name str buyer_type string buyer_address str parent_document_id str
tochka_search
annotations: none low

Search bank transactions by counterparty INN or name via statements. Returns full counterparty details including bank BIC, account and correspondent account — enough to create a payment via tochka_payment without asking the user for details. Args: query: INN or part of counterparty name days: Search depth in days (default 90)

ctx string days int query str
tochka_incoming
annotations: none low

Get incoming (Credit) bank transactions for a month, grouped by debtor INN. Useful for tax reports (AUSN vzaimozachet) — shows how much was received from each counterparty in a given month. Args: month: Month number (1-12) year: Year (e.g. 2026) inn: Optional debtor INN filter (e.g. "6316049606") description: Optional substring filter for payment description (case-insensitive, e.g. "РОБОКАССА")

ctx string inn str year int month int description str
tochka_track_invoice
annotations: none low

Start tracking an invoice for payment. Persists across sessions. Use tochka_pending_invoices to list tracked invoices, tochka_check_invoices to check payments. Args: number: Invoice number (e.g. "140") buyer_inn: Buyer INN (who should pay) buyer_name: Buyer company name amount: Expected payment amount (e.g. "5290.00") description: Invoice description (e.g. "Счёт №140 от 2026-04-10") document_id: Tochka documentId UUID (optional, for invoices created via tochka_invoice)

amount str number str buyer_inn str buyer_name str description str document_id str
tochka_untrack_invoice
annotations: none low

Stop tracking an invoice by its number. Args: number: Invoice number (from tochka_track_invoice or tochka_pending_invoices)

number str
tochka_pending_invoices
annotations: none low

List all invoices being tracked for payment. Use tochka_check_invoices to verify payment status. Returns JSON array of pending invoices with number, buyer_inn, buyer_name, amount, description, created_at.

tochka_check_invoices
annotations: none low

Check all pending invoices for payment. Automatically removes paid ones from tracking. Two strategies: - With document_id: uses Tochka payment-status API (fast, exact) - Without document_id: searches bank statement by buyer INN + amount (fallback) Fallback match criteria (all must be true): - Incoming (Credit) transaction - Debtor INN matches buyer_inn - Transaction date >= invoice created_at - abs(transaction amount - invoice amount) <= 1 ruble Args: days: Statement depth in days for fallback (default 30)

ctx string days int
tochka_account_detail
annotations: none low

Get detailed account information. Args: account_id: Account ID (e.g. "40702810100000000001/044525000"). Uses first account if empty.

account_id str
tochka_all_balances
annotations: none low

Get balances for all accounts at once. For a single account's balance, use tochka_balance. Returns JSON array of balances across all accessible accounts.

tochka_statements_list
annotations: none low

Get list of recent statements. Args: limit: Maximum number of statements (default 5)

limit int
tochka_card_transactions
annotations: none low

Get authorized card transactions for account. Args: account_id: Account ID. Uses first account if empty.

account_id str
tochka_customers
annotations: none low

Get list of all accessible customers (organizations). For details on a specific customer, use tochka_customer.

tochka_customer
annotations: none low

Get detailed customer information. Use tochka_customers to list all available customer codes. Args: customer_code: Customer identifier (e.g. "100000001")

customer_code str
tochka_delete_invoice
annotations: none low

Delete an invoice by document ID. Args: document_id: Invoice UUID from tochka_invoice result

document_id str
tochka_send_invoice_email
annotations: none low

Send invoice to specified email address. Args: document_id: Invoice UUID from tochka_invoice result email: Recipient email address

email str document_id str
tochka_send_closing_document_email
annotations: none low

Send closing document to specified email address. Args: document_id: Closing document UUID from tochka_upd result email: Recipient email address

email str document_id str
tochka_download_closing_document
annotations: none low

Download closing document PDF to local file. Args: document_id: Closing document UUID from tochka_upd result output_path: Absolute path to save PDF (e.g. /tmp/upd_42.pdf)

document_id str output_path str
tochka_payments_for_sign
annotations: none low

Get list of payment orders created for signing.

tochka_acquiring_payments
annotations: none low

Get list of acquiring payment operations. Args: page: Page number (default 1) per_page: Results per page (default 1000) from_date: Start date filter YYYY-MM-DD (optional) to_date: End date filter YYYY-MM-DD (optional) status: Filter by status: CREATED, APPROVED, ON-REFUND, REFUNDED, EXPIRED (optional)

page int status str to_date str per_page int from_date str
tochka_acquiring_payment_create
annotations: none low

Create acquiring payment operation (payment link). For payment with fiscal receipt, use tochka_acquiring_payment_with_receipt. Args: customer_code: Customer code (9 chars, e.g. "100000001") amount: Payment amount (> 0) purpose: Payment purpose (1-140 chars) payment_mode: Allowed payment methods, e.g. ["sbp", "card"] redirect_url: Success redirect URL (optional) fail_redirect_url: Failure redirect URL (optional) save_card: Save card for future payments (optional) consumer_id: Consumer identifier (optional) merchant_id: Merchant identifier, 15 chars (optional) pre_authorization: Two-stage payment mode (optional) ttl: Link lifetime in minutes, 1-44640, default 10080 (optional) payment_link_id: Custom payment link ID, 1-45 chars (optional)

ttl string amount float purpose str save_card string consumer_id str merchant_id str payment_mode string redirect_url str customer_code str payment_link_id str fail_redirect_url str pre_authorization string
tochka_acquiring_payment
annotations: none low

Get acquiring payment operation details. Args: operation_id: Payment operation ID

operation_id str
tochka_acquiring_payment_capture
annotations: none low

Capture funds for two-stage acquiring payment. Args: operation_id: Payment operation ID

operation_id str
tochka_acquiring_payment_refund
annotations: none low

Refund an acquiring payment (only for APPROVED status). Args: operation_id: Payment operation ID amount: Refund amount (must not exceed payment amount)

amount float operation_id str
tochka_acquiring_payment_with_receipt
annotations: none low

Create acquiring payment operation with fiscal receipt. For payment without receipt, use tochka_acquiring_payment_create. Args: customer_code: Customer code (9 chars, e.g. "100000001") amount: Payment amount (> 0) purpose: Payment purpose (1-140 chars) payment_mode: Allowed payment methods, e.g. ["sbp", "card"] client_email: Receipt recipient email items_json: JSON array of receipt items [{name, amount, quantity, vatType?, paymentMethod?, paymentObject?}] redirect_url: Success redirect URL (optional) fail_redirect_url: Failure redirect URL (optional) save_card: Save card for future payments (optional) consumer_id: Consumer identifier (optional) merchant_id: Merchant identifier, 15 chars (optional) pre_authorization: Two-stage payment mode (optional) ttl: Link lifetime in minutes, 1-44640, default 10080 (optional) payment_link_id: Custom payment link ID, 1-45 chars (optional) client_name: Receipt recipient name (optional) client_phone: Receipt recipient phone (optional) tax_system_code: Tax system: osn, usn_income, usn_income_outcome, esn, patent (optional)

ttl string amount float purpose str save_card string items_json str client_name str consumer_id str merchant_id str client_email str client_phone str payment_mode string redirect_url str customer_code str payment_link_id str tax_system_code str fail_redirect_url str pre_authorization string
tochka_acquiring_registry
annotations: none low

Get acquiring payment registry for a specific date. Use tochka_acquiring_retailers to get valid merchant_id values. Args: merchant_id: Merchant identifier registry_date: Registry date YYYY-MM-DD

merchant_id str registry_date str
tochka_acquiring_retailers
annotations: none low

Get list of acquiring retailers (merchant points).

tochka_subscription_create
annotations: none low

Create recurring payment subscription. For subscription with fiscal receipt, use tochka_subscription_with_receipt. Args: customer_code: Customer code (9 chars, e.g. "100000001") amount: Subscription amount (> 0) purpose: Subscription purpose (1-140 chars) redirect_url: Success redirect URL (optional) fail_redirect_url: Failure redirect URL (optional) save_card: Save card for future payments (optional) consumer_id: Consumer identifier (optional) merchant_id: Merchant identifier (optional) recurring: Enable recurring charges (optional) payment_link_id: Custom payment link ID, 1-45 chars (optional)

amount float purpose str recurring string save_card string consumer_id str merchant_id str redirect_url str customer_code str payment_link_id str fail_redirect_url str
tochka_subscription_charge
annotations: none low

Charge a subscription (recurring payment debit). Args: operation_id: Subscription operation ID amount: Charge amount

amount float operation_id str
tochka_subscription_status
annotations: none low

Get subscription status. Args: operation_id: Subscription operation ID

operation_id str
tochka_subscription_status_set
annotations: none low

Set subscription status (cancel subscription). Args: operation_id: Subscription operation ID status: New status (only "Cancelled" is allowed)

status string operation_id str
tochka_subscription_with_receipt
annotations: none low

Create subscription with fiscal receipt. For subscription without receipt, use tochka_subscription_create. Args: customer_code: Customer code (9 chars, e.g. "100000001") amount: Subscription amount (> 0) purpose: Subscription purpose (1-140 chars) client_email: Receipt recipient email items_json: JSON array of receipt items [{name, amount, quantity, vatType?, paymentMethod?, paymentObject?}] redirect_url: Success redirect URL (optional) fail_redirect_url: Failure redirect URL (optional) save_card: Save card for future payments (optional) consumer_id: Consumer identifier (optional) merchant_id: Merchant identifier (optional) recurring: Enable recurring charges (optional) payment_link_id: Custom payment link ID, 1-45 chars (optional) client_name: Receipt recipient name (optional) client_phone: Receipt recipient phone (optional) tax_system_code: Tax system: osn, usn_income, usn_income_outcome, esn, patent (optional)

amount float purpose str recurring string save_card string items_json str client_name str consumer_id str merchant_id str client_email str client_phone str redirect_url str customer_code str payment_link_id str tax_system_code str fail_redirect_url str
tochka_consents
annotations: none low

Get list of all API consents (permissions).

tochka_consent_create
annotations: none low

Create a new API consent. Args: permissions: List of permission strings (e.g. ["ReadAccountsBasic", "ReadBalances"]) expiration_date_time: Consent expiry in ISO8601 format (optional)

permissions string expiration_date_time str
tochka_consent
annotations: none low

Get consent details. Args: consent_id: Consent identifier

consent_id str
tochka_consent_children
annotations: none low

Get all child consents for a given consent. Args: consent_id: Parent consent identifier

consent_id str

Permissions 3

network medium
Server uses network capabilities via: requests
filesystem low
Server uses filesystem capabilities via: open(), os, tempfile
env_vars low
Server uses env_vars capabilities via: os.environ, os.getenv()

Scan Findings 123

low
Tool 'goods_list' has no annotations annotation_checker · 100%
low
Tool 'goods_add' has no annotations annotation_checker · 100%
low
Tool 'goods_remove' has no annotations annotation_checker · 100%
low
Tool 'tochka_balance' has no annotations annotation_checker · 100%
low
Tool 'tochka_payment' has no annotations annotation_checker · 100%
low
Tool 'tochka_invoice' has no annotations annotation_checker · 100%
low
Tool 'tochka_download_invoice' has no annotations annotation_checker · 100%
low
Tool 'tochka_upd' has no annotations annotation_checker · 100%
low
Tool 'tochka_search' has no annotations annotation_checker · 100%
low
Tool 'tochka_incoming' has no annotations annotation_checker · 100%
low
Tool 'tochka_track_invoice' has no annotations annotation_checker · 100%
low
Tool 'tochka_untrack_invoice' has no annotations annotation_checker · 100%
low
Tool 'tochka_pending_invoices' has no annotations annotation_checker · 100%
low
Tool 'tochka_check_invoices' has no annotations annotation_checker · 100%
low
Tool 'tochka_account_detail' has no annotations annotation_checker · 100%
low
Tool 'tochka_all_balances' has no annotations annotation_checker · 100%
low
Tool 'tochka_statements_list' has no annotations annotation_checker · 100%
low
Tool 'tochka_card_transactions' has no annotations annotation_checker · 100%
low
Tool 'tochka_customers' has no annotations annotation_checker · 100%
low
Tool 'tochka_customer' has no annotations annotation_checker · 100%
low
Tool 'tochka_delete_invoice' has no annotations annotation_checker · 100%
low
Tool 'tochka_send_invoice_email' has no annotations annotation_checker · 100%
low
Tool 'tochka_delete_closing_document' has no annotations annotation_checker · 100%
low
Tool 'tochka_send_closing_document_email' has no annotations annotation_checker · 100%
low
Tool 'tochka_download_closing_document' has no annotations annotation_checker · 100%
low
Tool 'tochka_payments_for_sign' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_payments' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_payment_create' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_payment' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_payment_capture' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_payment_refund' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_payment_with_receipt' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_registry' has no annotations annotation_checker · 100%
low
Tool 'tochka_acquiring_retailers' has no annotations annotation_checker · 100%
low
Tool 'tochka_subscription_create' has no annotations annotation_checker · 100%
low
Tool 'tochka_subscriptions' has no annotations annotation_checker · 100%
low
Tool 'tochka_subscription_charge' has no annotations annotation_checker · 100%
low
Tool 'tochka_subscription_status' has no annotations annotation_checker · 100%
low
Tool 'tochka_subscription_status_set' has no annotations annotation_checker · 100%
low
Tool 'tochka_subscription_with_receipt' has no annotations annotation_checker · 100%
low
Tool 'tochka_consents' has no annotations annotation_checker · 100%
low
Tool 'tochka_consent_create' has no annotations annotation_checker · 100%
low
Tool 'tochka_consent' has no annotations annotation_checker · 100%
low
Tool 'tochka_consent_children' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-3qhf-m339-9g5v) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-9h52-p55h-vw2f) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-j975-95f5-7wqh) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-jpw9-pfvf-9f58) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-vj7q-gjh5-988w) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1616) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1617) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1618) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-3482) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-3483) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (GHSA-9hjg-9r4m-mvj7) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (GHSA-9wx4-h78v-vm56) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (GHSA-gc5v-m9x4-r6x2) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (GHSA-j8r2-6x86-q33q) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (PYSEC-2023-74) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (PYSEC-2026-1872) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (PYSEC-2026-1873) dependency_analyzer · 95%
medium
Vulnerable dependency: requests@2.28 (PYSEC-2026-2275) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0 (PYSEC-2026-1812) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: goods_list manifest_parser · 90%
info
Tool: goods_add manifest_parser · 90%
info
Tool: goods_remove manifest_parser · 90%
info
Tool: tochka_balance manifest_parser · 90%
info
Tool: tochka_payment manifest_parser · 90%
info
Tool: tochka_invoice manifest_parser · 90%
info
Tool: tochka_download_invoice manifest_parser · 90%
info
Tool: tochka_upd manifest_parser · 90%
info
Tool: tochka_search manifest_parser · 90%
info
Tool: tochka_incoming manifest_parser · 90%
info
Tool: tochka_track_invoice manifest_parser · 90%
info
Tool: tochka_untrack_invoice manifest_parser · 90%
info
Tool: tochka_pending_invoices manifest_parser · 90%
info
Tool: tochka_check_invoices manifest_parser · 90%
info
Tool: tochka_account_detail manifest_parser · 90%
info
Tool: tochka_all_balances manifest_parser · 90%
info
Tool: tochka_statements_list manifest_parser · 90%
info
Tool: tochka_card_transactions manifest_parser · 90%
info
Tool: tochka_customers manifest_parser · 90%
info
Tool: tochka_customer manifest_parser · 90%
info
Tool: tochka_delete_invoice manifest_parser · 90%
info
Tool: tochka_send_invoice_email manifest_parser · 90%
info
Tool: tochka_delete_closing_document manifest_parser · 90%
info
Tool: tochka_send_closing_document_email manifest_parser · 90%
info
Tool: tochka_download_closing_document manifest_parser · 90%
info
Tool: tochka_payments_for_sign manifest_parser · 90%
info
Tool: tochka_acquiring_payments manifest_parser · 90%
info
Tool: tochka_acquiring_payment_create manifest_parser · 90%
info
Tool: tochka_acquiring_payment manifest_parser · 90%
info
Tool: tochka_acquiring_payment_capture manifest_parser · 90%
info
Tool: tochka_acquiring_payment_refund manifest_parser · 90%
info
Tool: tochka_acquiring_payment_with_receipt manifest_parser · 90%
info
Tool: tochka_acquiring_registry manifest_parser · 90%
info
Tool: tochka_acquiring_retailers manifest_parser · 90%
info
Tool: tochka_subscription_create manifest_parser · 90%
info
Tool: tochka_subscriptions manifest_parser · 90%
info
Tool: tochka_subscription_charge manifest_parser · 90%
info
Tool: tochka_subscription_status manifest_parser · 90%
info
Tool: tochka_subscription_status_set manifest_parser · 90%
info
Tool: tochka_subscription_with_receipt manifest_parser · 90%
info
Tool: tochka_consents manifest_parser · 90%
info
Tool: tochka_consent_create manifest_parser · 90%
info
Tool: tochka_consent manifest_parser · 90%
info
Tool: tochka_consent_children manifest_parser · 90%
info
Required env vars (1) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 80%
low
Permission: env_vars access detected permission_analyzer · 90%
critical
Tool poisoning in 'tochka_acquiring_payment_with_receipt': System prompt override attempt poisoning · 90%
critical
Tool poisoning in 'tochka_subscription_with_receipt': System prompt override attempt poisoning · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
high
Cyrillic homoglyphs in 'goods_add' field 'description' unicode_scanner · 90%
high
Cyrillic homoglyphs in 'tochka_incoming' field 'description' unicode_scanner · 90%
high
Cyrillic homoglyphs in 'tochka_track_invoice' field 'description' unicode_scanner · 90%