Factuarea MCP

Factuarea is an invoicing and management platform for businesses and freelancers in Spain. This is its official Model Context Protocol server — the same service the Factuarea team runs in production, not a wrapper built on top of it. Whatever you can do in the Factuarea dashboard or through its REST API, your agent can do in conversation: from issuing a VeriFactu invoice to checking who clocked in this morning.

Connect

The server lives at https://mcp.factuarea.com. Add it to your client and sign in with your Factuarea account — no installation, no key to copy. On the consent screen you pick the company, the environment (live or test) and exactly which permissions to grant.

MCP access is included in every Factuarea plan, also during the trial.

Create a key under Settings → Developers → API keys, choosing its scopes, and send it as a bearer token:

claude mcp add --transport http factuarea https://mcp.factuarea.com \
  --header "Authorization: Bearer fact_test_xxxxxxxxxxxxxxxxxxxxxxxx"

fact_test_… keys operate on the sandbox; fact_live_… keys on the real company.

@factuarea/mcp is a small stdio server that forwards every request to https://mcp.factuarea.com with your API key. It is the setup for the Claude Desktop configuration file, agent frameworks and any client without remote-server support. Node 20 or later.

{
  "mcpServers": {
    "factuarea": {
      "command": "npx",
      "args": ["-y", "@factuarea/mcp"],
      "env": { "FACTUAREA_API_KEY": "fact_test_xxxxxxxxxxxxxxxxxxxxxxxx" }
    }
  }
}

The package contains no business logic of its own: tools, rules and permissions are always the server's, so the local and the remote connection behave the same. Versions are published from CI with npm provenance.

Related MCP server: MCP FacturaScripts

Ask it things like

"Invoice Talleres Ruiz for yesterday's delivery note and email it to them."

"Which invoices from this quarter are still unpaid? Send each customer a reminder."

"Turn quote 2026-014 into an invoice, but move the due date to the 30th."

"Register this supplier invoice and mark it as paid by bank transfer."

"Raise every price in the wholesale price list by 5 %."

"Prepare the Modelo 303 workbook for the third quarter."

"Why didn't WooCommerce order #1042 produce an invoice?"

"Who on the team hasn't clocked in today?"

What it covers

Every tool, its domain and the permission it needs: docs.factuarea.com/mcp/tools.

Alongside the tools, the server publishes 9 fiscal guides as resources (factuarea://guardrails/…: issuing, voiding versus rectifying, invoice types, lines and amounts, VAT regime keys, series, buyer identification, VeriFactu prerequisites, multiple companies) and 5 guided workflows as prompts: issuing an invoice, fixing a failed one, registering a customer by tax ID, connecting an online store and tracing an order that was never invoiced.

Designed for an agent that handles real money

It will not break the fiscal record. Some mistakes cannot be undone once an invoice exists for the tax agency: deleting an issued invoice instead of voiding it, editing one that is no longer a draft, annulling a rectificativa. The server refuses those calls before anything runs, and the refusal (mcp_guardrail_violation) names the broken rule (rule_id) and the guide that explains the right path (guardrail_uri), so the agent can correct course on its own.

A retry never creates a second invoice. Operations that cannot be undone accept an idempotency_key. If the agent repeats the call after a timeout, it gets the original result back, marked as a replay, instead of a duplicate document.

It only sees what you allowed. Each credential lists only the tools its scopes permit, and every call is checked again. Third-party apps connected through OAuth get a curated catalog; the most sensitive operations — VeriFactu writes, GDPR erasure, payments, API keys and managed companies — need the owner's own API key. No credential reaches data of a company it was not granted.

Practise on a copy first. A test credential works on a sandbox twin of your company that inherits its plan: nothing is sent to the AEAT, no email reaches your customers, no webhook leaves, and FACe submissions are simulated.

Security and privacy

OAuth 2.1 with PKCE and rotating refresh tokens; API keys shown once, stored hashed, with optional expiry and IP allowlist; connected apps can be revoked from the dashboard. Privacy policy: factuarea.com/privacidad. Vulnerabilities: please follow SECURITY.md.

More from Factuarea for developers

• Documentation — REST API reference, guides, error codes and llms.txt

• SDKs — TypeScript and PHP

• CLI — the API from your terminal

• Claude Code plugins — this server plus skills for building an integration

• Integrations — n8n and WooCommerce

Questions

No. Connect the server in Claude or ChatGPT and ask in plain language. The API key and npm package are only for automated setups.

They are the same invoices you would create in the dashboard. If VeriFactu is enabled for your company, Factuarea registers them with the AEAT exactly as it does for any other invoice.

Yes: choose test on the consent screen or use a fact_test_ key. The agent then works on an isolated sandbox company.

Only the one you chose when connecting. To work with another company, connect again and select it.

Open an issue — it is the right place even when the problem is in the hosted server. For account questions, contact support.

Contributing

This repository holds the npm package and the registry manifests; the server itself runs on Factuarea's platform. Read CONTRIBUTING.md to set up the project (and AGENTS.md if you work with a coding agent), and the Code of Conduct before taking part. Changes are listed in the CHANGELOG.

License

The code in this repository is MIT. Using the hosted server and Factuarea is subject to Factuarea's terms of service.