# GCC e-Invoice Preflight Oracle

> Validate UAE PINT AE and Saudi ZATCA e-invoices: UBL, official Schematron, QR, fix hints.

- name: tech.noahsarch/einvoice-preflight
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 82/100 flags: no-repository
- quality: 94/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/tech.noahsarch%2Feinvoice-preflight
- tools: https://api.protogrid.dev/v1/servers/tech.noahsarch%2Feinvoice-preflight/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "einvoice-preflight": {
      "type": "http",
      "url": "https://einvoice.noahsarch.tech/mcp",
      "headers": {
        "X-API-Key": "${X_API_KEY}"
      }
    }
  }
}
```

Placeholders to fill: `${X_API_KEY}`.

## Trust

- hygiene: 80
- liveness: 98
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-96% +updated-7d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 94/100 (new)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 7 of 7 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 2,194 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool history recorded for 6 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 7, about 2,194 tokens to load them all
- tool set hash: 6705b47ae507020e7af8f0ad95dc60de
- badge: [![protogrid quality](https://protogrid.dev/badge/tech.noahsarch/einvoice-preflight.svg)](https://protogrid.dev/servers/tech.noahsarch/einvoice-preflight)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://einvoice.noahsarch.tech/mcp (streamable-http, auth none, reachable true, uptime30d 0.96153843)

## Packages

_none_

## Tools (7)

- `check_trn`: Format check of a UAE Tax Registration Number (15 digits) and derivation of the TIN / Peppol participant identifier (scheme 0235 = first 10 digits). Free. Example: trn '100 1234 5670 0003'. Response: result with verdict (ACCEPTED | ACCEPTED_WITH_WARNINGS | REJECTED), findings[] (id, severity, message, fields, location, fix_hint, source = xsd | schematron | preflight), counts, ruleset version and timings, plus data_confidence, estimated_items[], sources[], data_version, warnings[] and a disclaimer. Documents are validated in memory and never stored or logged.
- `extract_summary`: Seller/buyer (names, TRN, endpoint, legal registration, emirate), dates, currency, totals, VAT breakdown, line count, payment means, attachments and the detected rule set — without validating. Free. Response: result with verdict (ACCEPTED | ACCEPTED_WITH_WARNINGS | REJECTED), findings[] (id, severity, message, fields, location, fix_hint, source = xsd | schematron | preflight), counts, ruleset version and timings, plus data_confidence, estimated_items[], sources[], data_version, warnings[] and a disclaimer. Documents are validated in memory and never stored or logged.
- `list_rules`: Rule ids, severities and texts from the installed PINT AE Schematron (shared PINT rules and the -ae jurisdiction rules), filterable by severity or text, with fix hints where we have them. Free. Example: contains 'TaxPointDate'. Response: result with verdict (ACCEPTED | ACCEPTED_WITH_WARNINGS | REJECTED), findings[] (id, severity, message, fields, location, fix_hint, source = xsd | schematron | preflight), counts, ruleset version and timings, plus data_confidence, estimated_items[], sources[], data_version, warnings[] and a disclaimer. Documents are validated in memory and never stored or logged.
- `readiness_report`: Batch preflight for a go-live check or an ERP regression suite: per-document verdicts, readiness percentage, the most frequent rejection rules across the batch, optional printable HTML. Charged per document. Response: result with verdict (ACCEPTED | ACCEPTED_WITH_WARNINGS | REJECTED), findings[] (id, severity, message, fields, location, fix_hint, source = xsd | schematron | preflight), counts, ruleset version and timings, plus data_confidence, estimated_items[], sources[], data_version, warnings[] and a disclaimer. Documents are validated in memory and never stored or logged.
- `validate_invoice`: Full preflight of one UBL Invoice or CreditNote: XML well-formedness, UBL 2.1 XSD, the official PINT AE Schematron (≈300 rules incl. the UAE jurisdiction overlay) or the ZATCA pre-check, plus advisory cross-checks. Returns a verdict and every finding with rule id, severity, fields, location and fix hint. Example: xml '<Invoice …>', jurisdiction 'auto'. Response: result with verdict (ACCEPTED | ACCEPTED_WITH_WARNINGS | REJECTED), findings[] (id, severity, message, fields, location, fix_hint, source = xsd | schematron | preflight), counts, ruleset version and timings, plus data_confidence, estimated_items[], sources[], data_version, warnings[] and a disclaimer. Documents are validated in memory and never stored or logged.
- `zatca_qr_decode`: Decode the base64 TLV of a Saudi e-invoice QR into seller name, VAT number, timestamp, totals, hash, signature and key tags, with phase detection and format issues. Free. Response: result with verdict (ACCEPTED | ACCEPTED_WITH_WARNINGS | REJECTED), findings[] (id, severity, message, fields, location, fix_hint, source = xsd | schematron | preflight), counts, ruleset version and timings, plus data_confidence, estimated_items[], sources[], data_version, warnings[] and a disclaimer. Documents are validated in memory and never stored or logged.
- `zatca_qr_encode`: Encode the five phase-1 fields (plus optional phase-2 hash/signature/key tags) into the base64 TLV string that goes into the QR image and the UBL QR reference. Free. Response: result with verdict (ACCEPTED | ACCEPTED_WITH_WARNINGS | REJECTED), findings[] (id, severity, message, fields, location, fix_hint, source = xsd | schematron | preflight), counts, ruleset version and timings, plus data_confidence, estimated_items[], sources[], data_version, warnings[] and a disclaimer. Documents are validated in memory and never stored or logged.