Moysklad MCP

Findings (22)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.2: 2 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@1.1.15: 6 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.6: 6 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.0: 12 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  hono@4.12.9: 32 known vulnerabilities

  GHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-458j-xx4x-4375, GHSA-54fx-42gc-7vw4 +27 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.1.0: 6 known vulnerabilities

  GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@4.2.0: 3 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.15: 2 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.5.15: 2 known vulnerabilities

  GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.0.16: 5 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.12: 3 known vulnerabilities

  GHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.9: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.27.4: 1 known vulnerability

  GHSA-g7r4-m6w7-qqqr

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.0: 4 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.9: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  husky

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (60)

• search_products

  Search products in MoySklad by name or article. Prices returned in RUBLES.

• get_product

  Get a single product by UUID. Prices returned in RUBLES.

• create_product

  Create a new product. Prices in RUBLES (converted to kopecks internally).

• update_prices

  Update sale/buy/min prices for a product. Prices in RUBLES.

• get_stock

  Get current stock/inventory report. Shows quantities, reserves, and in-transit.

• get_stock_by_store

  Get stock report broken down by warehouse/store. Shows how much of each product is in each store.

• get_counterparties

  Search counterparties (customers/suppliers) by name, INN, or phone.

• get_counterparty

  Get full details of a counterparty by UUID.

• create_counterparty

  Create a new counterparty. Set companyType to 'legal', 'entrepreneur', or 'individual'.

• create_customer_order

  Create a customer order. Prices in RUBLES (converted to kopecks).

• get_orders

  Get customer orders with filtering and sorting. Sums in RUBLES.

• get_customer_order

  Get a single customer order by UUID with expanded positions.

• update_customer_order_status

  Change the status/state of a customer order.

• get_profit_report

  Get profit report by product. Shows sales, costs, returns, profit, margin.

• get_sales_report

  Get sales report by product. Shows quantities sold and revenue.

• create_supply

  Create an incoming supply (purchase receipt). Prices in RUBLES.

• create_demand

  Create a shipment (demand) to fulfill a customer order. Links to a warehouse.

• list_stores

  List all warehouses/stores with names, addresses, and meta hrefs.

• list_organizations

  List all organizations (your legal entities) with names, INN, and meta hrefs.

• list_webhooks

  List all registered webhooks with URL, action, entity type, and status.

• create_webhook

  Register a new webhook for entity events (CREATE/UPDATE/DELETE/PROCESSED).

• update_webhook

  Update a webhook (URL, action, entity type, enabled state).

• delete_webhook

  Delete a registered webhook by UUID.

• create_move

  Create a stock transfer (move) between two warehouses.

• get_moves

  List stock transfer (move) documents.

• create_enter

  Create a stock enter (оприходование) — add stock into a warehouse.

• get_enters

  List stock enter (оприходование) documents.

• create_loss

  Create a stock write-off (списание) from a warehouse.

• get_losses

  List stock write-off (списание) documents.

• create_inventory

  Create an inventory count (инвентаризация) for a warehouse.

• get_inventories

  List inventory count (инвентаризация) documents.

• create_purchase_order

  Create a purchase order (заказ поставщику). Prices in RUBLES.

• get_purchase_orders

  List purchase orders (заказы поставщикам).

• create_sales_return

  Create a sales return (возврат покупателя). Prices in RUBLES.

• create_purchase_return

  Create a purchase return (возврат поставщику). Prices in RUBLES.

• get_documents

  Generic: list documents of any MoySklad entity type (fallback for entities without a dedicated tool).

• get_document

  Generic: get a single document of any MoySklad entity type by UUID (positions expanded).

• create_payment_in

  Create an incoming bank payment (входящий платёж). Amount in RUBLES.

• create_payment_out

  Create an outgoing bank payment (исходящий платёж). Amount in RUBLES.

• create_cash_in

  Create a cash receipt order (приходный кассовый ордер). Amount in RUBLES.

• create_cash_out

  Create a cash expense order (расходный кассовый ордер). Amount in RUBLES.

• create_invoice_out

  Create a sales invoice (счёт покупателю). Prices in RUBLES.

• create_invoice_in

  Create a supplier invoice (счёт поставщика). Prices in RUBLES.

• get_invoices_out

  List sales invoices (счета покупателям).

• search_assortment

  Unified search across products, variants, services and bundles. Returns name, type, price.

• list_price_types

  List the account's price types (the first is the default). Use a price type href when setting product prices.

• search_variants

  Search product variants (modifications).

• search_bundles

  Search bundles (kits/sets).

• search_services

  Search services.

• create_service

  Create a service. Prices in RUBLES.

• get_dashboard

  Get dashboard metrics (sales, orders, money) for a day/week/month. Money values are in kopecks.

• get_turnover

  Get product turnover (обороты) over a period: opening, income, outcome, closing. Sums in RUBLES.

• get_money_report

  Get current money balances by bank account and cash register. Balances in RUBLES.

• get_stock_current

  Fast current stock report (assortment id -> stock), optionally for one warehouse.

• list_employees

  List employees (for document owners/responsible persons).

• list_currencies

  List currencies with ISO codes and rates.

• list_product_folders

  List product groups/folders.

• get_metadata

  Get metadata for an entity type (states, attributes, price types). Use to find order state hrefs for update_customer_order_status.

• get_audit

  Get the account audit/event log (who changed what, when).

• get_entity_audit

  Get the change history of a single entity by type and UUID.