Stackin

io.github.stackin-io由 GitHub 账号 stackin-io 发布v1.0.0更新于 Oct 24, 2026

Issue and manage Brazilian fiscal documents: NF-e for goods, NFS-e for services.

已验证Streamable HTTP可网页运行金融商业与电商

概览

AI 生成的概览

托管式 MCP 服务器,通过 Stackin 开具和管理巴西税务单据(货物用 NF-e,服务用 NFS-e),并提供代码查询与 PDF 获取。

可以做什么
开具、重新开具并校验 NF-e 与 NFS-e 发票,对已授权的 NF-e 提交更正函,作废未使用的 NF-e 号段,并对收到的发票进行申报。按访问密钥查询发票状态,列出已开具和已收到的发票,查看每次提交记录以诊断税务机关的拒绝原因。带原因取消已授权发票。获取 DANFE 与 DANFSe 的 PDF。查询和搜索税务代码(NCM、CFOP、CEST),并按完整税号确认纳税人身份。
适用场景
适合巴西企业希望由助手起草、开具、更正、取消或排查电子发票,或在开票前核对税务代码和纳税人身份,同时无需在客户端处理 XML 签名或证书的场景。
运行要求
远程 streamable-http 端点,无需本地安装。认证方式为带 PKCE 和动态客户端注册的 OAuth 2.1,或以 Authorization Bearer 头传递的静态 API 密钥。需要 Stackin 账户,并在 app.stackin.io 一次性上传数字证书。环境(测试或生产)由密钥或已授权连接固定。开具发票会消耗额度。
安装前请注意
开具、重新开具、取消、提交更正函、作废号段和申报收到的发票都是对税务机关具有法律约束力且通常不可撤销的操作,调用前应先由人工确认。重新开具与新开一样消耗额度。取消原因会原样送达税务机关。纳税人登记库不是有效性校验,且对新注册企业有滞后。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Stackin,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable,通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体,或 SourceWeft 对话中。智能体会读取该服务器的安装指南,先向你展示发布者、端点和登录方式,经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.stackin-io%2Fstackin/install.md,并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前,先告诉我它的发布者、端点和登录方式,等我确认。不要把 API 密钥写进命令或我会提交的文件;问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "stackin": {
      "type": "http",
      "url": "https://mcp.stackin.io/mcp"
    }
  }
}

README

[Stackin — Brazilian fiscal documents over MCP]

Stackin MCP plugin — NF-e and NFS-e for ChatGPT, Claude Code, Codex and Cursor

Issue, consult, correct and cancel Brazilian electronic invoices (nota fiscal eletrônica) from any AI client that speaks the Model Context Protocol.

[MIT license] [MCP server] [Documentation] [Get an API key]


Ask in plain language — "issue an NFS-e for this service", "why was my last NF-e rejected?", "cancel invoice 1042 and tell me the reason code" — and the model does it through Stackin, against SEFAZ and the municipal NFS-e webservices.

Sixteen tools, nine skills, one hosted server. No SDK to install, no XML to sign, no certificate to juggle in the client.

  • 🧾 NF-e (goods) and NFS-e (services) — issue, consult, cancel
  • 🔎 Diagnose a rejection by the tax authority's own code, and choose reissue vs. correction
  • ✉️ Correction letter (CC-e) against an authorized NF-e
  • 📥 Received invoices — read and manifest documents other companies issued against yours
  • 🔢 Numbering invalidation for a reserved, never-used NF-e range
  • 📄 DANFE / DANFSe PDF straight out of the conversation
  • 🔎 Fiscal code lookup — resolve an NCM, CFOP or CEST instead of guessing one, and confirm who a CNPJ belongs to

Table of contents

Install in Claude Code

The repository is its own marketplace, so it installs straight from GitHub:

bash
claude plugin marketplace add stackin-io/stackin-mcp-pluginclaude plugin install stackin@stackin

The plugin brings the nine skills and points Claude Code at https://mcp.stackin.io/mcp. There is nothing to configure: the first tool call answers 401 with WWW-Authenticate, and Claude Code follows it — run /mcp in the session, authorize in the browser that opens, and the token is stored for you. The client registers itself through /oauth/register, so no client_id is handed out by anyone.

Prefer a static key? Add the server by hand with a header instead of installing the plugin — see Authentication.

Install in ChatGPT and Codex

The same server is published as a ChatGPT app over Developer Mode. Enable developer mode, register https://mcp.stackin.io/mcp as a connector, and authorize — the full walkthrough, with video, is at docs.stackin.io/mcp.

Connect from Cursor or any MCP client

Any MCP client can use the server directly, without this plugin. Cursor reads .cursor/mcp.json in the project, or ~/.cursor/mcp.json. The interpolation syntax is not the same as Claude Code's: Cursor wants ${env:VAR}.

json
{  "mcpServers": {    "stackin": {      "url": "https://mcp.stackin.io/mcp",      "headers": { "Authorization": "Bearer ${env:STACKIN_API_KEY}" }    }  }}

Claude Code, by hand — ${VAR} expands from the environment:

bash
claude mcp add --transport http stackin https://mcp.stackin.io/mcp \  --header "Authorization: Bearer ${STACKIN_API_KEY}"
PropertyValue
Endpointhttps://mcp.stackin.io/mcp
Transportstreamable-http
AuthOAuth 2.1 with PKCE and dynamic client registration, or a static Bearer key
EnvironmentsHomologation and production, fixed on the key or on the authorized connection

Authentication: OAuth or API key

Two ways in, and they behave differently.

An API key. Generate one at app.stackin.io; it already carries the environment, so there is nothing to choose in the client. Send it as Authorization: Bearer <key>.

OAuth, with no key at all. Leave the header out: a tool call answers 401 with WWW-Authenticate pointing at /.well-known/oauth-protected-resource, which is what makes Claude Code offer to log in when you run /mcp. The server supports dynamic client registration (/oauth/register), so a client that registers itself gets a client_id without anyone being asked. Cursor can also hold static client credentials under an auth key instead of registering dynamically.

Verified on 2026-09-09, up to the browser: the server connects with no header at all, a tool call answers 401 with the resource_metadata challenge, the protected-resource document resolves, /oauth/register returns 201 and /oauth/authorize redirects to the consent screen. The browser leg itself has not been walked from Claude Code or Cursor — ChatGPT completed a real consent, those two have not. If one stops midway, look at the redirect_uri it uses: /oauth/authorize only accepts a URI the client registered.

Skills

A skill exists only where the order of operations, or a fiscal rule, adds something a tool description cannot carry on its own.

SkillWhat it carries
issue-invoiceWhich document the situation needs, and validating before issuing
consult-invoiceFinding a document, and which identifier each operation takes
cancel-invoiceConfirming before an irreversible act, and when a correction letter is the right tool instead
diagnose-invoiceReading the tax authority's own rejection code, and choosing between reissue and correction
correct-invoiceFiling a correction letter against an authorized NF-e, and what a CC-e may not change
invalidate-numberingDeclaring an NF-e numbering range reserved and never used
received-invoicesReading documents other companies issued against this one, and answering them
fiscal-lookupResolving an NCM, CFOP or CEST before issuing, instead of guessing one
taxpayer-lookupConfirming who a tax id belongs to, and why a 404 is not an invalid CNPJ

What is in this repository

This repository is the distribution layer: the manifests, the skills and the assets. The server itself lives at https://mcp.stackin.io/mcp and speaks the Model Context Protocol.

PathWhat it is
.codex-plugin/plugin.jsonPlugin identity, version, category, legal links
.app.jsonMaps the plugin to the registered MCP connection
.agents/plugins/marketplace.jsonLocal marketplace, for installing before publishing
.claude-plugin/plugin.jsonPlugin identity for Claude Code
.claude-plugin/marketplace.jsonThis repository as a marketplace Claude Code can add
.mcp.jsonThe hosted MCP server, for Claude Code
server.jsonThe MCP Registry entry
skills/The nine workflows that need more than a tool description
assets/Icon and logo

One plugin, three clients

The repo carries three manifests because three ecosystems look in three places, and each one fails silently when its file is missing:

ClientLooks forWhat it reads
ChatGPT / Codex.codex-plugin/plugin.json + .app.jsonthe app id and the hosted MCP
Codex marketplace.agents/plugins/marketplace.jsonthis repo as a source
Claude Code.claude-plugin/marketplace.json, .claude-plugin/plugin.json, .mcp.jsonthe skills and https://mcp.stackin.io/mcp

Adding the folder to Claude Code failed with "No marketplace manifest found … (expected .cursor-plugin/marketplace.json or .claude-plugin/marketplace.json)" until the third row existed. The skills are shared: all three point at skills/, so a skill written once is read by every client.

MCP Registry

server.json describes the hosted server for the official MCP Registry as a remote entry — io.github.stackin-io/stackin, streamable-http, no package to install.

Publishing is automated: pushing a v* tag runs .github/workflows/publish-mcp.yml, which stamps the version from the tag, authenticates with GitHub OIDC (no stored token — the workflow's own identity is what grants the io.github.stackin-io/* namespace) and publishes.

bash
git tag v1.0.0 && git push origin v1.0.0

The registry lists the public repository, which is why the entry lives here and not beside the server's own source.

FAQ

Do I need a digital certificate (A1/A3) in the client? No. The certificate is uploaded once at app.stackin.io and stays server-side.

Does it work in production, or only homologation? Both. The environment is fixed on the API key, or on the connection you authorized over OAuth — there is nothing to pick per call.

Which municipalities are supported for NFS-e? The ones Stackin covers; consult docs.stackin.io. NF-e is nationwide through SEFAZ.

Can I use the server without this plugin? Yes — it is a plain MCP server. The plugin only adds the skills and saves you the manual configuration.

Is it free? Issuing consumes credits from your Stackin account. Consulting and cancelling do not.

The code lookups answered 403 and now they do not. What changed? Until 2026-09-10 those four routes carried no OAuth scope, so an authorized app was refused whatever it had been granted. They now need invoice:read, which every connection already holds — a connection made before that date works without being remade.

A CNPJ I know is valid comes back 404 from lookup_taxpayer. Is it wrong? Probably not. That registry reloads monthly from the Receita Federal's dump, so a company registered in the last few weeks is not in it yet. It is not a validity check, and nothing should block an invoice over it.

Maintainer notes

app_id in .app.json was filled on 2026-09-06, once mcp.stackin.io was registered in OpenAI Developer Mode and a real connector completed the OAuth authorisation. It was left empty until then on purpose — it is the one value that cannot be prepared ahead of time.

A stale tool list was fixed by creating a new app, not by rescanning. The first app (asdk_app_6a9d458d…) had been scanned before the NFS-e restriction and kept advertising the old surface. .app.json now names the second one; if a third is ever created, this file is the thing to update, and nothing warns you when it is wrong.

NF-e came back on 2026-09-07, in two steps. First document_type widened to accept nfe on the existing eight tools — a change the count could not reveal. Then the four NF-e-only operations came back: correct_invoice, invalidate_numbering, list_received_invoices and manifest_received_invoice. Twelve tools then, seven skills.

The four lookup tools landed on 2026-09-10: lookup_fiscal_code, search_fiscal_codes, list_fiscal_kinds and lookup_taxpayer, with the fiscal-lookup and taxpayer-lookup skills. Sixteen tools now, nine skills. They shipped refusing every OAuth token, because their routes carried no scope at all; invoice:read was granted to them on the same day, so nothing has to be reconnected.

The connector caches the tool list from the moment it was scanned. The app was authorized at 10:48 on 2026-09-06 and the NFS-e restriction went live at 12:00, so ChatGPT kept advertising eleven tools — including three the server no longer has. Publishing a new plugin version and running Scan Tools is what refreshes it; the fix is not on the server, which was already correct. Check the count before testing anything: the server is the truth, and scripts/check_skills.py reads it live.

Read the identifier off the connector page, not out of the URL. The address is chatgpt.com/plugins/plugin_asdk_app_…, and plugin_ there is part of the route, not of the id. The page's own "App ID" field is the value that belongs here — asdk_app_…. Getting that wrong is silent: nothing validates it until a submission fails.

mcp.authentication was bearer, written before the server spoke OAuth. The connector page now reports Authorization used: OAuth, so it says oauth. The enum for that field is not in OpenAI's published documentation — developers.openai.com/codex/plugins/apps.md redirects to a 404 — so this is the honest description rather than a verified value. If the submission rejects it, that is where to look first.

License

MIT — see LICENSE.

来源:README.md,提交 ba22cb6

工具

16

issue_invoice

Issue a Brazilian fiscal document: NFS-e or NF-e. This produces a legal fiscal document. Confirm the data with the user before calling when you inferred any field. Every item needs a price: unit_price is what one unit costs and amount is the line's gross total. Send unit_price with quantity when the user quotes a price per unit, amount when they quote the line. Sending both asserts they agree and is refused if they do not. document_type nfse is a service invoice: each item needs a description and a price, the recipient address is optional, and service_code (LC 116/2003 item.subitem) falls back to the company's fiscal profile when omitted. document_type nfe is for goods, and the SEFAZ rejects a partial one: every item needs ncm and cfop, and recipient_address is required with street, number, neighborhood, city, state, zip_code and city_code all filled. Call validate_invoice_payload first when any of that was inferred rather than given. Pass idempotency_key when a retry is possible: repeating the same key with the same payload replays the first answer instead of issuing a second document. Without one, a retry after a lost response issues again — another credit, another number burned, and undoing it means cancelling, which has a deadline. Nothing generates the key for you; use one per business event, not per call.

输入参数items必填numberseriestax_id必填client_name必填document_type必填idempotency_keyrecipient_address

consult_invoice

Look up an invoice's current status by its access key. Read-only: it never changes the document.

输入参数access_key必填document_type必填

cancel_invoice

Cancel an authorized invoice. Legal cancellation, with fiscal and accounting effect, inside a window the NFS-e authorizer enforces for the municipality. Ask the human to confirm before calling; never call it speculatively. The reason reaches the tax authority verbatim and must be at least 15 characters. Pass idempotency_key to make a retry safe: repeating the same key with the same access key and reason replays the first answer instead of cancelling a second time. Reuse the key only when retrying that exact call; a genuinely new cancellation needs a new key, or none. Nothing generates one for you — two calls without a key are two cancellations.

输入参数reason必填access_key必填document_type必填idempotency_key

get_invoice_pdf

Return the printable rendering of a document, as a PDF. Works for both types — a DANFE for nfe, a DANFSe for nfse. The PDF comes back base64-encoded in content_base64; the XML, not this, is the legally valid document. A 502 from here means the authorizer is unavailable, not that the invoice is wrong.

输入参数access_key必填document_type必填

reissue_invoice

Retry a rejected invoice after the data that caused the rejection was fixed. Takes the local invoice_id, not the access key: a rejected document never got one. Consumes a credit like a new issuance, so it takes an idempotency_key for the same reason issue_invoice does. An authorized invoice is corrected or cancelled, never reissued.

输入参数invoice_id必填idempotency_key

correct_invoice

File an electronic correction letter (CC-e) against an NF-e. NF-e only: there is no correction letter for an NFS-e, where a wrong document is cancelled and issued again. It corrects wording and non-fiscal fields only. It cannot change values, taxes, the recipient or the products — those still require cancelling and issuing again, and telling the user a CC-e will fix an amount is wrong in a way they only discover at an audit. Each letter supersedes the previous one and the SEFAZ keeps at most 20 per document. The text reaches the tax authority verbatim.

输入参数access_key必填correction必填

invalidate_numbering

Declare an NF-e numbering range reserved but never used. NF-e numbering has to be continuous, so a gap left by a failed issuance is explained to the SEFAZ with this — not with a new document. Irreversible: a number declared unused can never be used. Only for numbers that were never authorized. An authorized document is cancelled, never invalidated. Confirm the range with the user and read it back before calling: the range is inclusive, and one digit wrong burns numbers the company still needs. The SDK refuses a backwards range and a reason outside 15-255 characters before anything is transmitted.

输入参数reason必填series必填number_end必填number_start必填

list_invoices

List the invoices this company issued, newest first. One document type at a time: pass nfse for services or nfe for goods. A company that issues both has to be asked twice. Use it for "my last invoices", "what was rejected today", and to find a document whose access key the user does not have at hand. Read-only. An authorized document is stored as issued, which is the value the rows carry; authorized is accepted as a synonym and asks for the same thing. Every row carries both identifiers the other tools need: id, which reissue_invoice takes, and access_key, which consult_invoice, cancel_invoice and get_invoice_pdf take. A rejected row has an id and no access key — the authorizer never assigned one.

输入参数limitoffsetstatusdocument_type

get_invoice_submissions

Show every attempt made for one invoice and what came back. This is the tool that answers "why was it rejected". consult_invoice gives the status; this gives the tax authority's own code, its message, and the request and response exactly as they went over the wire. Read-only. It takes the invoice_id, like reissue_invoice — a rejected document has no access key to look it up by. Get the id from list_invoices. The rows are attempts, not documents: a reissued invoice has more than one, oldest first, and only the last describes the current state. Quote the authority's message rather than paraphrasing it; the code is what the user will search for.

输入参数invoice_id必填

validate_invoice_payload

Check invoice data against the field rules without issuing anything. Nothing is sent to the tax authority and no document is created. The SDK models check field formats, and for nfe the rules the SEFAZ refuses a document over: ncm and cfop on every item, and a complete recipient address. Worth calling before issue_invoice whenever a field was inferred rather than given. This does not replace issuing: the authorizer's cross-field and fiscal rules are only checked when the document is transmitted.

输入参数items必填document_type必填recipient_address

list_received_invoices

List NF-e documents other companies issued against this one. The mirror of list_invoices: that one shows what this company issued, this one what it received. Read-only. It reads what the API already collected and never calls the tax authority, which caps how often a company may ask per day. Each row carries the issuer, the amount and, once one was filed, the manifestation. Before a manifestation the authority sends a summary only; the full document arrives after one.

输入参数limitoffset

manifest_received_invoice

Declare this company's position on a document issued against it. Legally binding and irreversible once the tax authority accepts it — ask the human to confirm before calling, and read back which document and which of the four positions is being filed. Denying a document (210220) or declaring the operation did not happen (210240) is an accusation against whoever issued it. Never pick either because the user sounds unsure — ask. 210200 confirms the operation happened, 210210 acknowledges the document exists, 210220 denies knowing it, and 210240 states the operation was not carried out. Only 210240 takes a reason, and it requires one; the others are refused if a reason is sent.

输入参数reasonaccess_key必填manifestation必填

lookup_fiscal_code

Resolve one code of one classification, when you know both. Use this to confirm a code before putting it on a document — an NCM that does not exist is rejected by the tax authority after issuing, which costs a cancellation. A code that is not there answers 404. That means the code is wrong, not that the lookup failed; do not retry it. `metadata` differs per kind and is passed through as published: utrib on an NCM, ncm_code on a CEST, tax_type on a CST, and nothing at all on an ISS service.

输入参数code必填kind必填country

search_fiscal_codes

Find a code from a description, or page through a table. This is the tool for "what NCM is a keyboard" — the one the user actually asks. Prefer it over guessing a code from memory: the tables change, and a plausible wrong code is worse than a lookup. Leaving `kind` unset searches every classification of that country at once, which is the most expensive call here. Set it whenever the question already names one. Rows come back ordered by kind then code; there is no sort argument, and asking for one changes nothing.

输入参数kindtermlimitoffsetcountry

list_fiscal_kinds

Which classifications this country has data for, right now. Ask this before assuming a classification exists. The answer grows as the source data does, so a name absent here is absent today rather than absent forever.

输入参数country

lookup_taxpayer

Look up one taxpayer by exact tax id, to confirm who it is. Use it to check a recipient's name before issuing against them. It takes the id exactly — punctuation is fine, but there is no search by name, by prefix or by state, and there will not be: the registry holds the names and addresses of real people. A 404 does not mean the company does not exist. The registry reloads monthly from the RFB's dump, so a recently registered CNPJ is simply not in it yet. Say that to the user rather than reporting the tax id as invalid, and never turn a 404 here into a validation rule.

输入参数tax_id必填country

版本历史

1
  1. v1.0.0最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分