Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@ssomcp prepare the March 2025 contribution file"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An offline-first MCP server for preparing Thailand SSO monthly contribution filings (สปส.1-10). It exposes MCP prompts and tools over stdio, backed by private local employer, history, and encrypted employee-baseline stores. It does not yet contain a verified Playwright adapter, so live refresh, upload, verification, and submission are registered but deliberately fail closed.
MCP TypeScript SDK v2 stdio server with legacy protocol fallback
/ssomcp, /ssomcp-change, and /ssomcp-refresh prompts
Offline get_active_employer, change_active_employer, prepare_contribution, and
query_history tools
Fail-closed live filing tool placeholders that never touch the browser or credentials
Contribution calculation selected by Gregorian filing period
Floor/ceiling clamping and satang rounding
Tier-1 consistency and duplicate-ID validation
Data-driven 135-byte fixed-width TIS-620/Windows-874 TXT records
Buddhist Era conversion only at the TXT formatting boundary
Employer/employee delta comparison
Human-review XLSX generated from the same immutable calculation result as TXT
Unit tests for calculation, validation, encoding, widths, diffs, and XLSX/TXT total parity
Portal adapter contract with a deliberately disabled default implementation
One-attempt filing coordinator with duplicate-period guard
Fail-closed reconciliation against all five portal summary totals
Hard save-versus-submit boundary with per-run explicit confirmation
Atomic local employer registry with credential-field rejection
Totals-only JSONL filing history with no employee rows
Submitted-only baseline store encrypted with Windows DPAPI
Configurable baseline retention and previous-period lookup
Related MCP server: itr-mcp
npm install
npm run check
npm startNode.js 20 or newer is required. After npm run build, configure an MCP host to run the
compiled stdio entry. For example:
{
"mcpServers": {
"ssomcp": {
"command": "node",
"args": ["C:\\path\\to\\sso-mcp\\dist\\src\\index.js"]
}
}
}For an offline sample without an MCP host:
npm run prepare:sampleThe sample command writes out/sso110-sample.txt and
out/sso110-review-sample.xlsx.
Runtime state lives outside the repository under ~/.ssomcp/:
employers.json maps nicknames to employer account and branch records.
baseline/*.json.dpapi contains submitted-only employee baselines encrypted with Windows
DPAPI. prepare_contribution loads the latest baseline before the requested period unless
previousEmployees is supplied explicitly.
history.jsonl contains totals and statuses only; query_history never returns employee rows.
output/<account>-<branch>/<YYYY-MM>/ receives atomically written TXT and review XLSX files.
The employer refresh tool will populate employers.json once the portal adapter is implemented.
Until then, tests or trusted local setup code can populate it through EmployerStore; credentials
must never be placed in that file.
The 2026+ contribution wage floor, official rounding rule, field padding, prefix-code list,
and exact government sample-file behavior remain marked as confirmation items in PROJECT.md.
The generator emits a warning when a provisional ceiling rule is used. Do not use its output
for a live filing until those items have been checked against an official or accepted sample.
The live Playwright adapter remains intentionally absent until the current portal flow, selectors, duplicate lookup, and pre-submit summary are verified with a test employer.
Select a locally cached employer by nickname or accountNo:branch. Never authenticates.
| Name | Required | Description | Default |
|---|---|---|---|
| employer | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds a behavioral detail not present in the annotations: it never authenticates. This helps set expectations about side effects. However, it does not explicitly mention that it changes the active employer state, though this is implied by the tool name. The annotations (readOnlyHint=false, destructiveHint=false) are not contradicted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no redundant information. The description is clear and to the point, effectively conveying the tool's purpose and a key behavioral note.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple selection operation. It does not specify output/return values, but this is not typically critical for a mutating action. The lack of an output schema is acceptable, and the description covers the primary purpose and parameter format. Minor gap: does not mention any error cases or side effects beyond authentication.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though the schema provides no description for the 'employer' parameter, the tool description explicitly explains that it can be specified by nickname or accountNo:branch. This fully covers the parameter's meaning and format, exceeding the schema's minimal definition (type string, minLength 1).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: selecting a locally cached employer by nickname or accountNo:branch. The verb 'Select' combined with the tool name 'change_active_employer' unambiguously indicates setting the active employer, and it is easily distinguished from sibling tools like get_active_employer or refresh_employers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives, but the 'Never authenticates' note provides a useful constraint that signals this is a lightweight local operation. The purpose is clear enough from the name and description for an agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return the active cached employer and available cached employers. Never authenticates.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already indicates no side effects, and the description adds that it never authenticates and returns cached data. This gives useful behavioral context beyond the annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and to the point, using two short sentences with no unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is no output schema, the description adequately conveys what the tool returns. It could specify the output format more explicitly, but the core information is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the description does not need to explain parameter semantics. The schema coverage is complete for an empty parameter set.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns the active cached employer and available cached employers, with a specific verb and resource. It is easily distinguished from siblings like change_active_employer and refresh_employers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies read-only usage by stating 'Never authenticates' and by the readOnlyHint, but it does not explicitly say when to use this tool versus alternatives such as change_active_employer or refresh_employers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Load the cached employer and encrypted prior baseline, calculate contributions, and atomically write review XLSX and upload TXT files. No network access.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| payDate | Yes | Gregorian date in YYYY-MM-DD format | |
| employer | No | Cached nickname or accountNo:branch; defaults to active employer | |
| employees | Yes | ||
| previousEmployees | No | Optional explicit baseline; otherwise load latest submitted baseline before this period |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate mutation (readOnlyHint=false) and idempotency. The description adds context about atomic file writing, loading cached data, and network isolation, which goes beyond annotations and helps the agent understand side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that packs the core action, inputs, outputs, and a key constraint (no network). No wasted words, and the most critical behavioral detail is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (nested objects, 5 params) and lack of output schema, the description covers the main flow but omits details like error conditions, post-conditions, or how the produced files are consumed. It is adequate for a basic understanding but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 60%, with descriptions for payDate, employer, and previousEmployees. The description does not add parameter-specific meaning, and the remaining 40% (period, employees) rely solely on schema structure. This is adequate but not enhanced by the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (prepare) and resource (contribution files), and outlines the process: load cached employer and prior baseline, calculate contributions, write XLSX and TXT files. This clearly distinguishes it from siblings like upload_contribution or submit_contribution by focusing on the preparation step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies it's the offline preparation step before upload/submit, but does not explicitly state when to use it versus alternatives. The 'No network access' note hints at its role, but no direct guidance on when to choose this over sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Read the local totals-only audit history. This is not proof of current e-Service state.
| Name | Required | Description | Default |
|---|---|---|---|
| period | No | ||
| employer | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly annotation, the description reveals that the data is local, totals-only, and not proof of current e-Service state, giving useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler; each sentence adds meaning, and the caveat is included without clutter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple read-only nature, the description is adequate, but it lacks any detail about the returned history structure or how the parameters affect the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides no parameter descriptions, and the description does not explain 'period' or 'employer'. The names are somewhat self-explanatory, but format, defaults, and semantics are left unspecified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and resource ('local totals-only audit history'), and adds a clear caveat that it is not proof of current e-Service state, which distinguishes its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for reviewing local audit totals and warns against treating it as current state, but does not explicitly mention when to prefer or avoid it relative to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Unavailable until the verified live portal adapter is implemented.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description honestly discloses that the tool is not yet implemented, which is a key limitation. However, it does not describe what the tool would do if available or what happens upon invocation, leaving behavior largely opaque.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no wasted words. It directly communicates the unavailability status without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lacks any context about the tool's intended function, such as what 'refreshing employers' entails or how it fits into the overall workflow. While the unavailability is stated, the missing purpose leaves the tool's role unclear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty schema, so there is nothing to describe. The baseline score applies because the description adds no parameter-related information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description only states that the tool is unavailable; it does not convey what the tool does or its intended purpose. An agent cannot determine what 'refresh employers' means or when it would be relevant.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool, other than the implicit instruction that it cannot be used yet. There is no mention of alternatives or conditions for future use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Final submission requires explicit per-run confirmation and a verified live portal adapter.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| employer | Yes | ||
| explicitConfirmation | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already indicate destructiveHint=true, and the description adds context about explicit confirmation and a live portal adapter. However, it does not explicitly disclose that the action is final, irreversible, or that it will submit data to an external system.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence and is not bloated. It loses some value by being cryptic, but it is appropriately short and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and only three required parameters, the description should explain what happens on success or failure, what the return value is, and how prerequisites like the live portal adapter are checked. It provides almost none of this context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation of employer, period, or explicitConfirmation. Although parameter names are somewhat self-explanatory, the description adds no meaning beyond the schema's basic type and constraint information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Final submission requires explicit per-run confirmation and a verified live portal adapter,' which only states prerequisites rather than clearly describing the action as 'submit a contribution to the portal.' The tool's purpose must be inferred from the title and context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no clear guidance on when to use this tool versus sibling tools such as prepare_contribution or upload_contribution. It mentions a requirement for a verified live portal adapter but does not explain how to satisfy it or when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Unavailable until the verified live portal adapter is implemented.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| txtPath | Yes | ||
| employer | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description gives no information about side effects, required permissions, persistence, or failure modes. Annotations indicate readOnlyHint=false and destructiveHint=false, but the placeholder text reveals no actual behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short but not because it is concise—it is empty of substance. It does not serve as a functional tool description and lacks any structural value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is effectively unusable as documented. There is no output schema, no examples, no error semantics, and no indication of what 'upload and save' entails. The placeholder status makes it incomplete for any real agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has zero description coverage; only field names suggest meaning (employer, period with month/year, txtPath). The nested period structure is present but unexplained, leaving ambiguity about formats and constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is a placeholder stating unavailability, not an explanation of what the tool does. It fails to name any action, resource, or result, leaving the purpose entirely unknown.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives. The sibling tools include similar actions like submit_contribution and prepare_contribution, but no distinction is made.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Unavailable until the verified live portal adapter is implemented.
| Name | Required | Description | Default |
|---|---|---|---|
| period | Yes | ||
| employer | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool is unavailable until an adapter is implemented, which is a behavioral trait beyond the readOnlyHint annotation. However, it does not describe any other behavior or side effects, so it is only partially transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence and is concise, but it lacks the substance needed for a functional tool description. It is short but not appropriately informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (nested objects, required parameters) and lack of output schema, the description provides almost no context. It does not help an agent understand the tool's role or constraints.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not explain any of the parameters (employer, period) and the schema has 0% coverage in the description. The agent is left without any semantic understanding of the inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the tool is unavailable and provides no indication of what the tool does when implemented. The title hints at verifying a summary, but the description itself lacks a clear purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when or how to use this tool. The only information is that it is unavailable, which does not help an agent decide to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0change_active_employerget_active_employerprepare_contributionquery_historyrefresh_employerssubmit_contributionupload_contributionverify_summaryTools are mostly distinct by action (query, upload, verify, submit, get, change, prepare, refresh), but upload_contribution, verify_summary, submit_contribution, and refresh_employers are all described as unavailable/blocked, which could blur their intended roles until implemented.
Names mostly follow a verb_noun pattern (query_history, upload_contribution, get_active_employer, change_active_employer, prepare_contribution, refresh_employers). Minor inconsistency: verify_summary uses 'summary' rather than 'contribution', though it likely refers to the same workflow.
Eight tools is a reasonable count for a contribution-preparation workflow, though several are explicitly unavailable, making the effective toolset smaller and slightly padded.
The set covers local employer selection, contribution preparation, and submission intent, but lacks authenticated portal actions (real submission, verification, employer refresh) which are marked as unavailable; this makes the workflow incomplete for end-to-end use.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Malaysian SME accounting, e-Invoice and payroll for your AI. 63 tools; writes are approved drafts.
Governed HR records and confirmed time-off actions for UK SMEs.
ZATCA-compliant Saudi invoicing and accounting: invoices, receivables, VAT, ledger, payroll.
Privacy-first work tracking with summaries, reports, coaching, and AI-ready long-term memory.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/riniort/sso-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
