Pop MCP server

<!-- mcp-name: io.github.popapidev/pop-mcp -->

pop-mcp

MCP (Model Context Protocol) server for POP — enabling LLMs to generate, submit, and manage Italian e-invoices (FatturaPA/SdI), Peppol, KSeF, ZUGFeRD/Factur-X, and PDF invoices directly from AI assistants.

npm: @getpopapi/pop-mcp · Remote: https://mcp.popapi.io/mcp

Remote MCP (HTTP) — fastest way to get started

Don't want to install anything? pop-mcp runs as a hosted, multi-tenant MCP server at:

https://mcp.popapi.io/mcp

Head to popapi.io to grab a license key, then point any MCP-speaking client at that URL with your key as a Bearer token. No local install, no POPAPIKEY env var, no build step — this is the recommended way to try pop-mcp for most people. Use the local stdio setup below only if you specifically need a Claude Desktop config running a process on your own machine.

How it works

This endpoint speaks MCP 2026-07-28, which is fully stateless: there is no initialize handshake and no session to open or track. Every request is self-contained — it names its own protocol version and capabilities — and the server answers it independently. Because of that, this is a multi-tenant endpoint: it never reads a fixed POPAPIKEY from its own environment. Every request must carry your own POP license key as a Bearer token:

Authorization: Bearer <your_license_key>

A missing or malformed Authorization header returns a 401 with errorcode: "unauthorizeduser" before any POP API call is made. An invalid-but-well-formed key is passed straight through to POP's API and surfaces whatever error POP returns (unauthorizeduser, insufficientlevel, etc.) — the server does not re-validate keys itself.

Any modern MCP HTTP client can connect: Claude (remote connector), the OpenAI Responses API, n8n, MCP Inspector, or a custom integration — not just Claude Desktop. All invoice, status, advanced, and onboarding tools are available; onboarding tools use their own onboarding_token per call and don't require the Bearer key.

Example with curl

Discover the server's supported protocol versions and capabilities (optional — clients can also just call tools/list or tools/call directly and handle a version-negotiation error inline):

curl -X POST https://mcp.popapi.io/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your_license_key_here" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: server/discover" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "server/discover",
    "params": { "_meta": { "io.modelcontextprotocol/protocolVersion": "2026-07-28", "io.modelcontextprotocol/clientCapabilities": {} } }
  }'

List the available tools — every request is self-contained, so _meta (protocol version + client capabilities) travels on every call, not just the first one:

curl -X POST https://mcp.popapi.io/mcp \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your_license_key_here" \
  -H "MCP-Protocol-Version: 2026-07-28" \
  -H "Mcp-Method: tools/list" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/list",
    "params": { "_meta": { "io.modelcontextprotocol/protocolVersion": "2026-07-28", "io.modelcontextprotocol/clientCapabilities": {} } }
  }'

The tool catalog is identical for every license key, so tools/list and server/discover responses carry a one-hour public cache hint (ttlMs: 3600000, cacheScope: "public") — clients and gateways may cache them across tenants.

Shortened. The full README is on GitHub.