
Retainer
io.github.theluckystrikePublished by GitHub account theluckystrikev0.22.6Updated Oct 24, 2026
Client retainers held on account: record one, draw it down against invoices, refund it.
Overview
Records client retainers and security deposits held on account, applies them to invoices, refunds them, and reports balances — all stored locally.
- What you can do
- Record, list and delete client deposits with amount, currency, date and reference
- Apply part or all of a held deposit to an invoice as a payment, or refund it back to the client
- Report balances held per client and per currency, with received, applied and refunded totals
- Produce plain-text and A4 PDF deposit statements, plus a Pro report on held funds and ageing
- Check and activate a Pro licence
- When to use it
- For freelancers or small businesses that hold client retainers or security deposits and want an assistant to track what is held, apply it against invoices, refund it, and answer how much of a client's money is on hand. It is meant to run alongside the same author's invoice server, whose clients and invoices it reads and writes.
- Requirements
- Runs as a local process on the user's machine (desktop only), installed from the .mcpb bundle or a clone and build; the npm package is not yet published. Requires the mcp-invoice server alongside it for clients and invoices, and a shared business profile. No account, API key or network access; an optional MCP_LICENSE_KEY enables Pro features and is verified offline.
Installation
In SourceWeft
- Open Retainer in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
mcp-deposits
Security and retainer deposits, held per client, on the same engine as your invoices.
A deposit is the client's money sitting on your account. It has to be recorded when it arrives, set
against an invoice when the work is billed, given back when it is not, and answered for at any point
in between: how much of theirs are you holding, in which currency, since when. This server does
those four things, against the invoices and the clients the mcp-invoice server already holds. When
a deposit is applied to an invoice, the payment is recorded on that invoice, so invoice_list and
overdue_report stop chasing money you already have. Everything stays on your machine.
Built on @theluckystrike/mcp-invoice/lib for the money, currency and store code, and on
@theluckystrike/mcp-billing-docs/lib for the A4 page, so a deposit statement looks like the credit
note and the invoice next to it and agrees with them to the minor unit.
In the official MCP Registry (io.github.theluckystrike/deposits).
npm publish for @theluckystrike/mcp-deposits is pending, so npx -y @theluckystrike/mcp-deposits returns 404 today. Until then, the .mcpb one-click bundle or a clone+build is the working path.
Install
Claude Desktop (claude_desktop_config.json):
Claude Code:
Cursor (.cursor/mcp.json):
Run mcp-invoice alongside it: this server reads that server's invoices and clients, writes the
payment an applied deposit makes onto the invoice, and both take their name, address, VAT id and
default currency from one shared business profile.
Tools
One resource, deposits://held, and one prompt, settle_deposits.
Free vs Pro
The free cap is on recording new deposits only. Money already held can always be applied, refunded and accounted for, on any tier: a limit that trapped a client's deposit would be a limit on their money, not on yours.
The cap counts the deposits stored with a received date in that month, so deposit_delete gives the
slot straight back: a deposit typed in twice or with the wrong amount costs nothing but the id.
deposit_record also refuses a deposit that matches one already stored on client, amount, currency,
kind, received date and reference, names that id and stores nothing, so the same money is never held
twice and no free slot is spent on a retry.
Get Pro: https://mcp.zovo.one/buy/deposits ($19 one-time for this server, $39 for the bundle).
A measured thing
The invoice server's own payment tool SETS the amount paid, so routing a deposit through it erases
the payment that came before. Measured against servers/invoice/dist/index.js on a EUR 1,000.00
invoice: invoice_mark_paid {amount: 200} for a bank transfer, then invoice_mark_paid {amount: 300} for the deposit, leaves paid_minor at 30000 and the reply reads "balance due EUR 700.00". The
EUR 200.00 that actually arrived is gone from the record, and the client gets chased for it.
deposit_apply writes the same three fields on the same record, paid_minor, paid_date,
status, but ADDS: the same two payments leave paid_minor at 50000 and a balance due of EUR
500.00. Asserted in test/unit.test.mjs, "a second application ADDS to paid_minor, it does not
replace it".
The general form: a store shared between two servers is safe to write only if you have read how the owning server writes it. The field names matching is not the contract; the arithmetic on them is.
Privacy
All data stays local: ${XDG_DATA_HOME:-~/.local/share}/mcp-servers/deposits/. No account, no API
key, no network call, ever. Licence keys are verified offline.
Built by theluckystrike. Support: [email protected]
Use these docs as an MCP server
Any MCP client (Claude, Cursor, Windsurf, VS Code) can read this repository's documentation directly via GitMCP - no install:
- Docs MCP URL: https://gitmcp.io/theluckystrike/mcp-deposits
Source: servers/deposits/README.md at commit 6535b33
Tools
0Version history
3- v0.22.6LatestOct 14, 2026
- v0.22.1Sep 26, 2026
- v0.21.0Sep 16, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts