Enterich

[Enterich's logo: a drake in a cap, holding a microphone, with an MCP chain]

Enterich

An MCP server for ERPNext with hard limits: a short, fixed list of tools, tokens from an external OAuth authorization server, and only the rights of one ERPNext user.

Status: Every operation is tested against a model of ERPNext v16's API, and weekly against a real ERPNext v16 site. The changelog lists the releases.

What it is

• A separate service, not a Frappe app. It calls ERPNext's REST API with the API key of a dedicated agent user and holds no other ERPNext credential. Whatever the service does, ERPNext's role for that user is the upper limit.
• A resource server for the MCP authorization spec. It serves the protected resource metadata, answers a missing token with 401, and checks every access token itself (issuer, audience, client, subject). Sign-in happens at an external authorization server such as Keycloak.
• A fixed list of operations, each with its own purpose and input schema, read and write separated. No generic document access, method calls or file access.
• Client-neutral. It speaks plain MCP (Streamable HTTP) and doesn't rely on any client asking before a write.

What it is not

• Not a general ERPNext API bridge: tools that take a DocType, report name, method name, field list, filter expression or file path as input are out of scope.
• Not a way to post: no tool submits, cancels, amends, deletes or discards a document. The agent prepares drafts; a person reviews and submits them in ERPNext (reviewing drafts).
• Not affiliated with or endorsed by Frappe Technologies. ERPNext and Frappe are their trademarks.

Tools

Enterich offers 37 tools. A deployment may offer fewer (ENTERICH_TOOLS); every tool works on one company, within the rights ERPNext gives the agent user.

Master data (REQ-003)

Items.

Order to cash (REQ-004)

Customers, sales invoices, receivables.

Procure to pay (REQ-005)

Suppliers, purchase invoices, payables.

Record to report (REQ-006)

Accounts, cost centres, journal entries, ledger, trial balance.

Bank and cash (REQ-007)

Bank accounts, bank transactions, payments.

Scope

Enterich is maintained for our own use. Contributions are welcome (contributing); support isn't promised. Report vulnerabilities privately, as the security policy describes.

Documentation

Start at docs/README.md. The most important parts:

• Requirement specifications: the core, and the operations by accounting area
• Architecture and decisions
• Configuration

Licence

Apache-2.0. Why: ADR-006.