Model Context Protocol (MCP) server for ERPNext - manage timesheets, leave applications, projects, and software releases via Claude, Gemini, or any MCP-compatible AI assistant.
SaferSkills independently audited MCP ERPNext (MCP Server) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 6 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 6 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Model Context Protocol (MCP) server for ERPNext - manage timesheets, leave applications, projects, and software releases via Claude, Gemini, or any MCP-compatible AI assistant.
npm install -g mcp-erpnextgit clone https://github.com/sharat9703/mcp-erpnext-taiga-gitlab-redmine.git
cd mcp-erpnext
npm installCreate a .env file or set environment variables:
ERPNEXT_URL=https://your-erpnext-instance.com
[email protected]
ERPNEXT_PASSWORD=your-password
ERPNEXT_TOTP_SECRET=your-totp-secret # Optional, for 2FA
# For Software Releases (optional)
GITLAB_URL=https://gitlab.example.com
GITLAB_TOKEN=your-gitlab-personal-access-token
REDMINE_URL=https://redmine.example.com
REDMINE_API_KEY=your-redmine-api-key # For auto-fetching ticket titlesClaude Desktop (~/.claude/claude_desktop_config.json or %APPDATA%\Claude\claude_desktop_config.json):
{
"mcpServers": {
"erpnext": {
"command": "npx",
"args": ["mcp-erpnext"],
"env": {
"ERPNEXT_URL": "https://your-erpnext-instance.com",
"ERPNEXT_USERNAME": "your-username",
"ERPNEXT_PASSWORD": "your-password"
}
}
}
}Or from local installation:
{
"mcpServers": {
"erpnext": {
"command": "node",
"args": ["/path/to/mcp-erpnext/src/index.js"]
}
}
}Gemini CLI (~/.gemini/settings.json):
{
"mcpServers": {
"erpnext": {
"command": "npx",
"args": ["mcp-erpnext"],
"env": {
"ERPNEXT_URL": "https://your-erpnext-instance.com",
"ERPNEXT_USERNAME": "your-username",
"ERPNEXT_PASSWORD": "your-password"
}
}
}
}Once configured, you can ask your AI assistant:
Create weekly timesheet for project PROJ-0460Show my draft timesheetsSubmit timesheet TS-2025-00123Apply for leave from Dec 25 to Dec 27Update time log 0 in timesheet TS-2025-00123 to 8 hoursCreate software release for https://gitlab.example.com/project/-/merge_requests/123
using template https://erp.example.com/app/software-release/Product-v1.0.0See USAGE.md for complete examples.
| Tool | Description |
|---|---|
erpnext_create_weekly_timesheet | Create weekly timesheet (7h billable + 2h non-billable/day) |
erpnext_create_timesheet | Create custom timesheet |
erpnext_create_custom_timesheet | Create timesheet with specific entries |
erpnext_list_timesheets | List timesheets with filters |
erpnext_get_timesheet | Get timesheet details |
erpnext_get_my_draft_timesheets | Get current user's draft timesheets |
erpnext_update_time_log | Edit a time entry in draft timesheet |
erpnext_remove_time_log | Remove a time entry from draft |
erpnext_update_timesheet_note | Update timesheet note |
erpnext_delete_timesheet | Delete draft timesheet |
erpnext_submit_timesheet | Submit for approval |
erpnext_cancel_timesheet | Cancel timesheet |
| Tool | Description |
|---|---|
erpnext_apply_leave | Apply for leave |
erpnext_list_leave_applications | List leave applications |
erpnext_get_my_pending_leaves | Get pending leave applications |
erpnext_get_leave_balance | Check leave balance |
erpnext_submit_leave_application | Submit for approval |
erpnext_cancel_leave_application | Cancel leave application |
| Tool | Description |
|---|---|
erpnext_login | Authenticate with ERPNext |
erpnext_get_current_employee | Get logged-in user's employee record |
erpnext_list_projects | List projects |
erpnext_list_tasks | List tasks for a project |
erpnext_list_activity_types | List available activity types |
| Tool | Description |
|---|---|
erpnext_preview_software_release | Preview release before creating - shows all fields and sources |
erpnext_create_software_release | Create release from GitLab MR with auto-detection |
erpnext_get_mr_details | Get MR details (Redmine IDs, patches, version) |
erpnext_get_redmine_issue | Get Redmine ticket title |
erpnext_get_software_release | Get existing release (use as template) |
erpnext_list_software_releases | List recent releases |
erpnext_list_products | List available products |
erpnext_list_customers_for_release | List available customers |
The server automatically validates that time entries don't overlap:
Error: Time entries have overlapping times:
Time entry 1 (Billable Work: 2025-12-02 10:00:00 - 17:00:00) overlaps with
entry 2 (Non Billable Work: 2025-12-02 15:00:00 - 17:00:00)Edit draft timesheets before submission:
Create software releases from GitLab MRs with intelligent auto-detection:
| 1. | #124323 | Title |)release-v1.0.0.12)mcp-erpnext/
├── src/
│ ├── index.js # Entry point
│ ├── erpnext-client.js # ERPNext API client
│ ├── gitlab-client.js # GitLab API client (for software releases)
│ ├── redmine-client.js # Redmine API client (for ticket titles)
│ ├── resources.js # MCP resources
│ ├── definitions/ # Tool schemas
│ ├── handlers/ # Tool handlers
│ ├── tools/ # Business logic
│ └── formatters/ # Response formatters
├── .env.example
├── package.json
├── README.md
└── USAGE.mdContributions are welcome! Please feel free to submit a Pull Request.
git checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)MIT License - see LICENSE file for details.
Sharat Yaragatti - GitHub
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.