# Jithox E-Invoice Readiness

> Read-only preflight evidence over MCP.

This is an **MCP server**, not a website. An AI agent connects to it directly
and calls its tools; a human reads https://mcp.jithox.com/docs.

## Connect

- MCP endpoint: https://mcp.jithox.com/mcp
- Transports: Streamable HTTP and the legacy HTTP+SSE transport, both on that one URL
- Protocol revisions served: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26
- Auth: OAuth 2.1 (discovery at https://mcp.jithox.com/.well-known/oauth-protected-resource, PKCE S256),
  or send the workspace access key directly as `Authorization: Bearer <key>`
  (or `X-Jithox-Api-Key`) when a browser callback is impossible. Never both.
- Free and unauthenticated: `initialize`, `server/discover`, `tools/list`,
  `/healthz`, `/readyz`, and every document linked below.

## Tools (5, all read-only)

- `validate_invoice` — Structurally validate a draft EU invoice and report machine-readable issues (schema problems, VAT-id format, date sanity, BIS 3.0 completeness, computed totals).
- `validate_vat_number` — Deterministic structure/checksum validation of an EU VAT number (incl.
- `verify_vat_vies` — Check a VAT number's ACTIVE status against the official EU VIES source.
- `lookup_peppol_participant` — Check whether a receiver is registered on the Peppol network and accepts BIS Billing 3.0 invoices, via the official SML/SMP discovery route when enabled (otherwise an honest mock that says so).
- `get_einvoice_readiness` — Readiness snapshot for YOUR canary workspace: one plain state, what is ready, what is missing, and the next safe step.

There is no write, send, order or payment tool on this server. `send_peppol_invoice`
is absent by construction and answers 404 with the reason.

## What an answer is, and is not

Every accepted call returns a uniform decision envelope (status, evidence,
provenance with the source and the moment it was read, limitations) plus an
Ed25519-signed receipt anyone can verify offline against
https://mcp.jithox.com/receipts/public-key.pem. A refusal, a rate limit, an unavailable
source or an incomplete question costs nothing and is never dressed as an
answer. "Unavailable" is a truthful state, never a negative verdict.

## Who this is for, and where you can be

No geographic restriction, no EU company required, no EU address, no VAT
number needed to connect. These servers encode EUROPEAN RULES, and European
rules bind whoever sells into, ships to or invoices the EU — wherever they
are. An exporter in the United States, a manufacturer in China, a marketplace
seller in India and a SaaS billing EU customers all face the same checks, and
all of them can call these servers today.

Payment does not require a euro account, a card, or a Jithox account at all:
the x402 lane settles in USDC on Base from any wallet, anywhere. The prepaid
balance is priced in EUR; the machine lane is not.

## Cost

25 accepted calls free (14 days from key creation), then a
prepaid balance charged per ACCEPTED call. The current per-accepted-call price
for THIS product (and its non-chargeable error states — failures, refusals and
unavailable sources cost nothing) is machine-readable at
https://jithox.com/api/pricing/v1 under per_product; sign-up and trial
activation at https://jithox.com/sign-up. Accountless machine payment is also
possible on the products that enable it — see https://mcp.jithox.com/x402/quickstart.json.

## Machine-readable

- https://mcp.jithox.com/.well-known/jithox-capability.json — this server's identity and tools
- https://mcp.jithox.com/.well-known/oauth-protected-resource — auth discovery
- https://jithox.com/api/capabilities/v1 — offer status of every Jithox capability
- https://jithox.com/api/pricing/v1 — the pricing contract (per_product = per-accepted-call terms)
- https://mcp.jithox.com/x402/products — the cross-product index (only products announced for discovery)
- https://mcp.jithox.com/x402/quickstart.json — how to pay per call without an account
- https://mcp.jithox.com/agents — the long-form briefing for agent runtimes
- https://mcp.jithox.com/docs — the human developer guide

## Boundaries

- Preflight evidence only.

No independent penetration test has been performed. Public self-service, and no
compliance certification of any kind is claimed or implied.