ksef-mcp

ksef_send_invoice

Destructive

Submit a locked, approved invoice to the KSeF system with encryption. Verifies approval and XML hash, then sends the invoice via the official API.

Instructions

Wyślij zablokowaną i zatwierdzoną fakturę do KSeF. Wymaga: aktywnej sesji KSeF, draftu w statusie 'locked', potwierdzonego approval z pasującym hashem XML. Szyfruje XML (AES-256-CBC + RSA-OAEP) i wysyła do API KSeF.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "draftId": "<draftId>"
    },
    "name": "ksef_send_invoice"
  }
}

Input Schema

Name	Required	Description	Default
`draftId`	Yes	ID draftu do wysłania (UUID)

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Aug 30, 2026

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

destructiveHint=true already flags the side-effecting nature, and the description adds value beyond it by disclosing the encryption pipeline (AES-256-CBC + RSA-OAEP), the state gating (locked/approved/hash match), and the fact that it submits to the external KSeF API. No contradiction with the annotation; the only missing behavior is post-send effects on the draft.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, front-loaded with the primary action, followed by gating requirements and then the technical encryption detail. Every sentence carries load-bearing information with zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, destructive external API call, the description covers the two most critical gaps: workflow prerequisites and transport encryption. What remains unsaid is post-send behavior (response contents, whether the draft becomes consumed/irreversible), but with a single well-documented parameter and a destructiveHint annotation, the remaining gap is small.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single draftId parameter is self-documenting as a UUID, so the baseline of 3 applies. The description adds marginal meaning by constraining which draftId is valid (must be locked and approved), but does not explain return values or side effects on the draft after sending.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Wyślij zablokowaną i zatwierdzoną fakturę do KSeF' (send a locked and approved invoice to KSeF). It is clearly distinguishable from the 28 siblings: it is the terminal send action in the draft lifecycle, distinct from ksef_draft_* (preparation), ksef_approval_* (gating), and ksef_invoices_query/get/status (read-only lookups).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly enumerates the conditions required before invocation: an active KSeF session, the draft in 'locked' status, and a confirmed approval with matching XML hash. This strongly implies the orchestration order (lock → approve → send) without naming sibling alternatives explicitly, so it earns a 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.