Skip to main content
Glama
mcp-india-stack

mcp-india-stack

verify_einvoice_qr

Read-onlyIdempotent

Verify Indian GST B2B e-invoice QR codes to confirm authenticity by validating the NIC RSA signature, internal claims, and IRN hash against supplier GSTIN and invoice details.

Instructions

Verify cryptographically signed QR code from Indian GST B2B e-invoices (A3 Authenticity).

Validates the NIC RSA digital signature against bundled public trust anchors, verifies internal claims, and cross-checks the 64-char Invoice Reference Number (IRN) against SHA-256(SupplierGSTIN + DocTyp + DocNo + FinYr).

Input Schema

NameRequiredDescriptionDefault
qr_textYesSigned JWT string extracted from GST B2B e-invoice QR code
expected_irnNoOptional expected 64-character hex IRN
expected_gstinNoOptional expected supplier GSTIN

Output Schema

NameRequiredDescriptionDefault

No arguments

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.8.0

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and closed-world, so the safety profile is covered; the description still adds real substance by naming the NIC RSA signature, the bundled public trust anchors, internal claim verification, and the SHA-256 IRN derivation. It does not say what a failed verification produces (error vs. structured result), which is the remaining behavioral gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short lines, front-loaded with purpose and followed by the mechanics of verification; every clause carries information and there is no filler or restatement of the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations, full schema coverage, and an output schema, the description only needs to explain the verification logic, which it does thoroughly including the trust-anchor source and IRN formula. It stops just short of describing failure semantics and the effect of the optional cross-check parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both qr_text and the two optional expected_* parameters are already documented in the schema, making 3 the baseline. The description adds useful meaning about the IRN (64-char, SHA-256 of SupplierGSTIN + DocTyp + DocNo + FinYr), but it never explains how expected_irn and expected_gstin change the verification behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Verify cryptographically signed QR code from Indian GST B2B e-invoices') plus the standard it targets (A3 Authenticity), so the agent immediately knows the operation and domain. No sibling in the list handles e-invoice QR verification, so the scope is unambiguous without needing an explicit negative comparison to validate_gstin or verify_aadhaar_offline_artifact.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The scope implies when to reach for it (you have a signed QR payload from a GST B2B e-invoice), but there is no explicit statement about when to use this instead of validate_gstin or verify_aadhaar_offline_artifact, and no guidance on when the optional expected_* cross-checks should be supplied. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools