Abraflexi Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Abraflexi Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<img src="debian/abraflexi-mcp-server.svg" alt="AbraFlexi MCP Server icon" width="96" height="96">
A comprehensive Model Context Protocol (MCP) server for AbraFlexi integration using FastMCP and python-abraflexi. This server provides complete access to AbraFlexi REST API functionality through MCP-compatible tools.
69 tools in total, covering the full REST surface exposed by python-abraflexi: dedicated tools for the most common evidences (invoices, contacts, products, bank transactions), plus generic evidence_* tools that work against any AbraFlexi evidence by name.
One server process = one AbraFlexi company. A running server is bound for its whole lifetime to a single company, set viaABRAFLEXI_URL/ABRAFLEXI_COMPANY(see Configuration). Every record any tool returns already belongs to that company - it is not possible to ask this server for another company's data. Callserver_infoto check which company/URL a running server is bound to; the main record-fetching tools (invoice_issued_get,invoice_received_get,contact_get,product_get,bank_transaction_get,evidence_get,changes_get) also echo it back in a_contextblock on every response, together with a note clarifying any counterparty fields on the records (e.g. an invoice'snazFirmyis the customer/supplier, not the company that issued/received it).
server_info - Report which AbraFlexi company/URL this server session is bound toinvoice_issued_get - Retrieve issued invoices (faktura-vydana)invoice_issued_create - Create new issued invoicesinvoice_issued_update - Update existing issued invoicesinvoice_issued_delete - Remove issued invoicesinvoice_received_get - Retrieve received invoices (faktura-prijata)invoice_received_create - Create new received invoicesinvoice_issued_match_payment - Match an invoice against a payment document (Párování plateb)invoice_issued_cash_payment - Pay an invoice in cash (Hotovostní úhrada)invoice_issued_deduct_advance - Deduct an advance invoice (Odpočet záloh a ZDD)invoice_issued_deduct_zdd - Deduct an advance tax document, ZDD (Odpočet záloh a ZDD)invoice_issued_link_zdd - Link a ZDD to an income payment (Vazby ZDD)invoice_issued_unlink_zdd - Remove a ZDD bonding (Vazby ZDD)invoice_issued_overdue_days - Compute days overdue from a due date (pure, no API call)invoice_issued_get_email - Resolve the best recipient email for an invoiceinvoice_issued_get_recipients - Resolve all recipient emails for an invoicecompany_create - Found a brand-new AbraFlexi company (accounting unit) - requires server-admin/license REST rightscontact_get - Retrieve contacts and companies (adresar)contact_create - Create new contactscontact_update - Update existing contactscontact_delete - Remove contactscontact_get_notification_email - Best email to notify (primary/purpose-matching contact)contact_get_cell_phone - Cell phone number to usecontact_get_any_phone - Any usable phone number (mobile preferred over landline)contact_get_bank_accounts - Registered bank account(s) for a contactproduct_get - Retrieve products from price list (cenik)product_create - Create new productsproduct_update - Update existing productsproduct_delete - Remove productsbank_transaction_get - Retrieve bank transactions (banka)bank_transaction_create - Create new bank transactionsevidence_get - Get records from any evidence (filter, pagination, sorting, relations)evidence_create - Create record in any evidenceevidence_update - Update record in any evidence (supports remove_external_ids)evidence_delete - Delete record from any evidenceevidence_list - List all evidences available on the bound company (live evidence-list.json)abraflexi_client_methods - List public methods of core python-abraflexi clients (ReadOnly, ReadWrite, Changes, Adresar, FakturaVydana)abraflexi_client_call - Invoke a selected public client method with arguments (write methods still respect READ_ONLY)evidence_lock / evidence_unlock / evidence_lock_for_ucetni - Lock/unlock a recordevidence_storno - Cancel (storno) a document recordevidence_perform_action - Call a record's dedicated business action (e.g. pay)evidence_mass_update - Update, or act on, every record matching a filter (Dávkové operace)evidence_batch_insert / evidence_batch_update - Insert/update many records in one requestevidence_attach_file - Attach a local file to any recordevidence_list_attachments - List a record's attachmentsevidence_get_attachment - Get metadata for a single attachmentevidence_download_attachment - Download an attachment to a local fileevidence_get_attachment_thumbnail - Download an image attachment's thumbnailevidence_delete_attachment - Delete an attachmentevidence_export_report - Export a PDF/XLSX report for a record or evidence listingevidence_get_qr_code - Get a document's payment QR code (file or base64 data URI)user_query_list - List saved user-defined queries (uzivatelsky-dotaz)call_user_query - Call a saved user-defined query (uživatelský dotaz)evidence_get_properties - List the fields supported by an evidenceevidence_get_reports - List the printable reports available for an evidenceevidence_get_relations_list - List the sub-evidences (relations) available for an evidenceevidence_get_sum - Get summation (totals) for an evidenceevidence_get_record_changes - Get a single record's change historyevidence_get_labels - Get labels assigned to a recordevidence_set_label - Add a labelevidence_unset_label - Remove specific label(s)evidence_unset_labels - Remove all labelschanges_enable / changes_disable - Toggle change trackingchanges_status - Check whether change tracking is enabledchanges_get - Page through recorded changes since a given versionpip install abraflexi-mcp-serverThen run the server:
abraflexi-mcpDownload the self-contained AppImage from the latest release:
chmod +x AbraFlexi-MCP-Server-*-x86_64.AppImage
./AbraFlexi-MCP-Server-*-x86_64.AppImageNo Python or pip required. See AppImage section for details.
git clone https://github.com/VitexSoftware/abraflexi-mcp-server.git
cd abraflexi-mcp-server uv sync
uv run python scripts/start_server.pyOr with pip:
pip install -e .
abraflexi-mcpA testing deployment is available at:
🌐 https://abraflexi.fastmcp.app/mcp
This cloud-hosted instance allows you to test and use the AbraFlexi MCP server without local installation. Configure your MCP client to connect to this endpoint with HTTP transport.
Note: This is a testing deployment. For production use, we recommend self-hosting using one of the installation methods above.
Create a .env file or set environment variables:
cp .env.example .env
# Edit .env with your AbraFlexi server detailsABRAFLEXI_URL - Your AbraFlexi server URL (e.g., https://demo.flexibee.eu:5434)ABRAFLEXI_COMPANY - Company identifier (e.g., demo_de)Method 1: Username/Password (Recommended)
ABRAFLEXI_LOGIN - Your AbraFlexi usernameABRAFLEXI_PASSWORD - Your AbraFlexi passwordMethod 2: Session ID
ABRAFLEXI_AUTHSESSID - Your AbraFlexi session IDREAD_ONLY - Set to true, 1, or yes to enable read-only mode (default: true)ABRAFLEXI_TIMEOUT - Request timeout in seconds (default: 300)ABRAFLEXI_MCP_TRANSPORT - Transport type: stdio (default) or streamable-httpHTTP Transport Configuration (only used when ABRAFLEXI_MCP_TRANSPORT=streamable-http):
ABRAFLEXI_MCP_HOST - Server host (default: 127.0.0.1)ABRAFLEXI_MCP_PORT - Server port (default: 8000)ABRAFLEXI_MCP_STATELESS_HTTP - Stateless mode (default: false)AUTH_TYPE - Must be set to no-auth for streamable-http transportWith startup script (recommended):
uv run python scripts/start_server.pyDirect execution:
uv run python -m abraflexi_mcp_server.serverCLI help:
abraflexi-mcp --helpThe server supports two transport methods:
#### STDIO Transport (Default) Standard input/output transport for MCP clients like Claude Desktop:
# Set in .env or environment
ABRAFLEXI_MCP_TRANSPORT=stdio#### HTTP Transport HTTP-based transport for web integrations:
# Set in .env or environment
ABRAFLEXI_MCP_TRANSPORT=streamable-http
ABRAFLEXI_MCP_HOST=127.0.0.1
ABRAFLEXI_MCP_PORT=8000
ABRAFLEXI_MCP_STATELESS_HTTP=false
AUTH_TYPE=no-authRun test suite:
uv run python scripts/test_server.pyWhen READ_ONLY=true (default), the server will only expose GET operations (retrieve data) and block all create, update, and delete operations. This is useful for:
To enable write operations, set READ_ONLY=false in your .env file.
Get all issued invoices:
invoice_issued_get(limit=10)Get specific invoice by code:
invoice_issued_get(kod="INV-2024-001")Count invoices issued in August 2026 (without downloading full records):
invoice_issued_get(
datum_vystaveni_od="2026-08-01",
datum_vystaveni_do="2026-08-31",
detail="id",
add_row_count=True
)Create a new contact:
contact_create(
kod="CUSTOMER01",
nazev="Example Company s.r.o.",
email="[email protected]",
tel="+420123456789"
)Get products:
product_get(nazev="Widget", limit=5)Generic evidence query (with pagination/sorting):
evidence_get(
evidence="faktura-vydana",
filter_expr="datVyst >= '2024-01-01'",
order="datVyst",
order_direction="D",
limit=20,
start=0
)Attach a local file to any record:
evidence_attach_file(evidence="cenik", kod="PRODUCT01", filepath="/path/to/photo.jpg")Lock an invoice, then export its PDF:
evidence_lock(evidence="faktura-vydana", kod="INV-2024-001")
evidence_export_report(
evidence="faktura-vydana",
kod="INV-2024-001",
output_path="/tmp/invoice.pdf",
report_name="dodaciList"
)Mass-update every price-list item from a supplier:
evidence_mass_update(
evidence="cenik",
filter_expr="dodavatel = 'code:SUPPLIER01'",
data={"stitky": "code:VIP"}
)Incremental sync via the Changes API:
changes_enable()
page = changes_get(start=0, limit=500, evidences=["faktura-vydana"])
# page["changes"], page["next"], page["global_version"]This server is designed to work with MCP-compatible clients like Claude Desktop. See MCP_SETUP.md for detailed integration instructions.
The server can be run as an OCI container (Docker/Podman) — no Python installation needed on the host.
podman build -t abraflexi-mcp-server -f Containerfile .The image defaults to streamable-http transport on port 8000.
With individual environment variables:
podman run --rm -p 8000:8000 \
-e ABRAFLEXI_URL=https://demo.flexibee.eu:5434 \
-e ABRAFLEXI_COMPANY=demo_de \
-e ABRAFLEXI_LOGIN=winstrom \
-e ABRAFLEXI_PASSWORD=winstrom \
abraflexi-mcp-serverWith an env file:
podman run --rm -p 8000:8000 --env-file .env abraflexi-mcp-server| Variable | Default |
|---|---|
ABRAFLEXI_MCP_TRANSPORT | streamable-http |
ABRAFLEXI_MCP_HOST | 0.0.0.0 |
ABRAFLEXI_MCP_PORT | 8000 |
READ_ONLY | true |
All other configuration variables can be passed as environment variables.
A self-contained, single-file Linux executable — no Python, pip, or any other dependency required on the host.
bash appimage/build-appimage.shThe script downloads a portable CPython and appimagetool automatically. The resulting file is placed in build/appimage/:
build/appimage/AbraFlexi-MCP-Server-<version>-x86_64.AppImageThe AppImage automatically loads a .env file from the current working directory if one is present.
With a .env file (recommended):
cp .env.example .env
# edit .env with your credentials
./AbraFlexi-MCP-Server-*-x86_64.AppImageWith inline environment variables:
ABRAFLEXI_URL=https://demo.flexibee.eu:5434 \
ABRAFLEXI_COMPANY=demo_de \
ABRAFLEXI_LOGIN=winstrom \
ABRAFLEXI_PASSWORD=winstrom \
./AbraFlexi-MCP-Server-*-x86_64.AppImageabraflexi-mcp-server/
├── abraflexi_mcp_server/
│ ├── __init__.py
│ └── server.py # Main server implementation
├── appimage/
│ ├── AppRun # AppImage entry point
│ ├── abraflexi-mcp-server.desktop
│ ├── abraflexi-mcp-server.svg
│ └── build-appimage.sh # AppImage build script
├── debian/ # Debian packaging
│ ├── abraflexi-mcp-server.svg # AppStream stock icon
│ ├── abraflexi-mcp-server.install
│ └── cz.vitexsoftware.abraflexi-mcp-server.metainfo.xml
├── scripts/
│ ├── start_server.py # Startup script with validation
│ └── test_server.py # Test script
├── Containerfile # OCI container build
├── server.json # MCP Registry manifest
├── pyproject.toml # Python project configuration
├── setup.py # Legacy setuptools configuration
├── requirements.txt # Dependencies
├── .env.example # Environment configuration template
├── .env # Your configuration (not in git)
├── .gitignore # Git ignore patterns
└── README.md # This file# Tool registration + basic connectivity
uv run python scripts/test_server.py
# Live capability scenario (all read tools + READ_ONLY write guards)
# Official public demo (login winstrom / winstrom):
python tests/live_capability_scenario.py \
--url https://demo.flexibee.eu:5434 \
--company demo \
--login winstrom --password winstrom \
--json-out /tmp/abra-demo-live.json
# Private/dev company example:
python tests/live_capability_scenario.py \
--url https://flexibee-dev.spoje.net:5434 \
--company testa_invest_s_r_o_ \
--login "$ABRAFLEXI_LOGIN" --password "$ABRAFLEXI_PASSWORD" \
--json-out /tmp/abra-live.jsonExit code is non-zero when any non-skipped check fails.
The server includes comprehensive error handling:
.env file (never commit to git).env file has proper permissions (600)Connection Failed:
ABRAFLEXI_URL is correct and accessiblePermission Denied:
Tool Not Found:
uv syncSet environment variable for detailed logging:
export DEBUG=1
uv run python scripts/start_server.pyThis project is licensed under the MIT License.
Vítězslav Dvořák
Made with ❤️ for the AbraFlexi and MCP communities
<!-- mcp-name: io.github.Vitexus/abraflexi -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.