Chasa

Name: Chasa
Author: docracy1

by docracy1version 1.0.0i★ –iRuns in the cloud

Registry nameio.github.docracy1/chasa

Install

Overview

Description from the maker (original English)

AI invoice follow-up emails for freelancers. Draft-only, never sends for you.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs in the cloud
Transport: Streamable HTTP
Category: Accounting, finance & tax

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
The registry lists no key to fill in.

You need

Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://api.chasa.io/mcp

Run this in your terminal

claude mcp add --transport http chasa https://api.chasa.io/mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "chasa": {
      "url": "https://api.chasa.io/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "chasa": {
      "type": "http",
      "url": "https://api.chasa.io/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://api.chasa.io/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account docracy1, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Accounting, finance & taxi

More stars than 0% of the other 1730 servers in this category
Published to the registry more recently than 34% of the other 1730 servers in this category
Basic checks equal to or better than 100% of the other 1730 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Chasa safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.0.0) reached the registry 3 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Finance Toolkit, SolidInvoice, Korea Tax Calculator

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Finance Toolkit

by JerBouma

500+ transparent financial methods calculated from raw statements, not third-party endpoints.

Computer or cloud★ 5,496MITUpdated today

Install

SolidInvoice

by SolidInvoice

Create and send invoices and quotes, manage clients, and track payments in SolidInvoice.

Runs in the cloud★ 981MITUpdated 8 days ago

Install

Korea Tax Calculator

by UpstageAI

Korean tax calculation and tax-audit judgment MCP: 96 tools with statutory citations.

Runs on your computer★ 97MITUpdated yesterday

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

docstoc

Paste your unpaid invoices. Get the follow-up email already written, in the right tone for how late it is.

docstoc never emails your clients for you — it drafts follow-ups you copy into Gmail, Outlook, or Apple Mail. Tone escalates with days overdue (friendly → firm → direct).

Live URLs

	URL
Marketing	https://docstoc.io/
App (Tool)	https://docstoc.io/app/
Login	https://docstoc.io/app/login
Connector	https://docstoc.io/app/connector
Admin	https://docstoc.io/app/admin
API	https://api.docstoc.io
MCP	https://api.docstoc.io/mcp — read-only tools public; `draft_chase_email` requires session or API key

Worker PUBLIC_APP_URL is https://docstoc.io (magic links, OAuth callbacks, Stripe return URLs, digest links).

Legacy chasa.io / api.chasa.io 301 to docstoc (Pages _middleware.ts + worker redirect). See scripts/oauth-redirect-uris.md for provider console URIs.

Go-live checklist

Attach docstoc.io on Cloudflare Pages project chasa and wait for Active.
www.docstoc.io → apex: handled by apps/web/functions/_middleware.ts (redeploy web).
chasa.io / www.chasa.io → docstoc.io: same middleware.
api.chasa.io → api.docstoc.io: worker middleware in apps/worker/src/lib/legacyHostRedirect.ts.
Register OAuth redirect URIs on api.docstoc.io — see scripts/oauth-redirect-uris.md.
Optional DMARC: ./scripts/dmarc-remove-rua.sh (removes rua= from _dmarc.docstoc.io).
Run ./scripts/go-live-verify.sh.

The order does not matter: browser-facing links are built from the origin the request came in on (see “App origin resolution” below), so pages.dev and chasa.io both keep working whichever is deployed first.

App origin resolution

Magic links, post-login redirects, Stripe return URLs and team invites use the origin the user is actually on, not PUBLIC_APP_URL. The Pages /api proxy forwards it as X-Docstoc-App-Origin, and the worker honours it only if it matches lib/appUrl.ts's allowlist (PUBLIC_APP_URL, docstoc.io, www.docstoc.io, legacy chasa.io hosts, *.pages.dev project/preview hosts, localhost). This keeps preview deploys self-contained and makes the domain cutover zero-downtime.

Requests that arrive without a trusted origin — provider OAuth callbacks hitting api.docstoc.io directly, and the digest cron — still fall back to PUBLIC_APP_URL.

Product specs

Plans & pricing

Plan	Price	AI drafts	Team seats	Notes
Free	$0	5 / month (server-enforced)	1 (owner only)	No signup required for drafts; sign in to upgrade
Pro	$14.99 / mo	Unlimited	5 (owner + invites)	Flat workspace fee — not per-seat; most popular
Business	$39.99 / mo	Unlimited	20	Smart reply, risk score, demand letters, cert branding, SSL automation

Stripe price IDs live in apps/worker/wrangler.toml as STRIPE_PRICE_SOLO (maps to Pro), STRIPE_PRICE_PRO / STRIPE_PRICE_ENTERPRISE (map to Business; non-secret). Billing portal and webhooks update accounts.plan and is_paid.

Feature matrix (by plan)

Feature	Free	Pro+
AI chase email drafts (tone by days overdue)	5/mo	Unlimited
15+ copy-paste email templates (`/free-templates/`)	✓	✓
CSV invoice upload (Tool)	✓	✓
Manual invoice list + aging board (Tool)	✓	✓
Rewrite softer / firmer / shorter	—	✓
Thank-you, reply-to-client, 3-step sequence, SMS/WhatsApp drafts	—	✓
Clients CRM + contact notes	—	✓
Aging sync (Tool → server)	—	✓
Reminder calendar (planned chase dates)	—	✓
Chase timeline + mark sent/paid	—	✓
Daily chase digest email (9 AM Eastern, approve-to-send)	—	✓
Reminder snooze + stop when marked paid	—	✓
Email open/click tracking on tracked HTML	—	✓
Default payment link (Stripe, PayPal, Venmo, Zelle…)	—	✓
Zapier templates (FreshBooks, Wave, Zoho Books)	—	✓
Smart reply classifier + promised pay date detection	—	Business
Client payment risk score	—	Business
Formal demand letter + collections evidence pack	—	Business
Custom certificate branding + SSL automation	—	Business
Custom branding (logo, late-fee hint)	—	✓ (admin role)
Outbound webhooks (`chase.drafted`, `chase.sent`, …) + HMAC signatures	—	✓ (admin)
Click tracking (tracked copy HTML)	—	✓
Team invites (admin / member roles)	—	✓
Cloud storage PDF import (Dropbox, OneDrive, Box)	—	✓
QuickBooks Online + Xero overdue import	—	✓
HTTP API + API keys (`/api/v1/chase/draft`)	—	✓
Zapier / Make via API key	—	✓

Workspace roles: owner is always admin. Invited members can use Pro+ features; admin-only actions: branding, webhooks, connector OAuth connect/import, API key CRUD, team invites.

App routes (`/app/*`)

Route	Purpose
`/`	Tool — invoice list, AI drafts, CSV/PDF import, multi-select batch
`/login`	Magic-link login + Cloudflare Turnstile
`/account`	Plan, billing portal, payment link
`/team`	Invite members, roles (Pro+)
`/clients`	Client CRM (Pro+)
`/branding`	Logo + late-fee hint (workspace admin)
`/webhooks`	Outbound webhook URLs (workspace admin)
`/connector`	Cloud storage + QBO/Xero OAuth + API keys
`/admin`	Internal admin dashboard (separate cookie)

All app routes except /login and /admin require a session. Unauthenticated users redirect to /login. SPA analytics require cookie consent (GDPR).

i18n (EN + ES)

Same path as Docracy: lightweight catalogs in apps/web/app/src/lib/i18n/ (no i18next). LocaleProvider + EN|ES switcher on login, sidebar, and More sheet. P1 covers login / shell / welcome; expand catalogs for the rest of the app next. Preference stored as chasa_locale. Marketing HTML stays English until a later pass.

Marketing & SEO (static HTML in `apps/web/public/`)

Homepage with pricing, FAQ JSON-LD, competitor comparison
SEO landing pages: /invoice-follow-up, /payment-reminder, /overdue-invoice, /chase-invoices, /freelancer-invoice-follow-up
/features/ (index, AI tone, templates), /docs/, /ai, /about
/blog/ (3 articles + dynamic post.html)
/free-templates/ — 15 generated template pages + index
Legal: /privacy, /terms, /imprint
sitemap.xml, robots.txt, 404.html, cookie consent, scroll-depth analytics
Self-hosted fonts (no Google Fonts); enforcing CSP via _headers

Regenerate free templates after editing apps/web/scripts/generate-free-templates.mjs:

npm run generate:templates --workspace apps/web

Architecture

Monorepo (npm workspaces):

Package	Stack	Deploy target
`apps/web`	React 18 + Vite + React Router	Cloudflare Pages (`chasa`)
`apps/worker`	Hono + Cloudflare Workers + D1 + Workers AI	`api.chasa.io`

apps/web/

app/ React SPA (/app/*) — lazy-loaded routes, AccountProvider src/pages/tool/ Tool module (components, CSV import, aging sync) src/pages/connector/ Connector module (OAuth, API keys) public/ Static marketing site + fonts + _headers scripts/ copy-fonts, generate-free-templates, validate-static-html

apps/worker/ src/routes/ HTTP handlers (auth, billing, emails, aging, mcp, …) src/lib/ auth, ai, billing, schemas (Zod), rate limits, webhooks migrations/ D1 SQL (0001–0011)

Data: Cloudflare D1 (chasa-db). OAuth tokens encrypted at rest (AES-GCM, TOKEN_SECRET). Sessions in sessions table; magic links single-use (atomic consume).

AI: Cloudflare Workers AI (@cf/meta/llama-3.1-8b-instruct-fp8). Prompts wrap user content in delimiters to reduce injection.

API surface (worker)

Prefix	Purpose
`/api/auth`	Magic link request/verify, logout, Turnstile config
`/api/account`	Profile, branding
`/api` (emails)	`generate-email`, `rewrite-email`, `generate-thank-you`, `generate-reply`, `generate-sequence`, `generate-sms`
`/api/billing`	Stripe checkout, portal, webhook
`/api/aging`	Aging board CRUD + atomic batch sync
`/api/clients`	Client CRM
`/api/reminders`	Chase reminder calendar
`/api/team`	Workspace members + invites
`/api/webhooks`	Outbound webhook CRUD
`/api/connector`	Legacy API key CRUD
`/api/account/connectors`	Cloud + accounting OAuth
`/api/tracking`	Tracked copy + click stats
`/api/analytics`	Event track + pageview aggregates
`/api/v1/chase/draft`	Public HTTP API (Bearer `chasa_…` key)
`/api/admin`	Admin dashboard API
`/api/blog`	Public blog posts from D1
`/api/csp-report`	CSP violation reports
`/mcp`	MCP JSON-RPC (draft tools, template list)
`/api/t/:id`	Click redirect (allowlisted URLs only)

Security & compliance (implemented)

Free-tier quota: 5 AI drafts/month enforced in D1 (ai_usage), not client-side
Rate limits: AI drafts, MCP, analytics, admin login (D1 buckets)
Turnstile: fail-closed in production HTTPS when secret is set; 60s magic-link cooldown per email
HKDF token purposes: separate keys for session, magic-link, API key, admin, invite, OAuth state, webhook signing (legacy hash fallback on lookup)
Session rotation: prior sessions invalidated on magic-link login; admin sessions cleared on admin login
Session cleanup: daily cron purges expired sessions, magic links, rate-limit buckets
RBAC: workspace admin for branding, webhooks, connector OAuth, API keys, team invites
Input validation: Zod schemas on all JSON API routes (auth, emails, clients, team, webhooks, billing, admin, MCP draft args)
Stripe webhooks: event-id deduplication (stripe_events)
Outbound webhooks: X-Chasa-Signature: sha256=… HMAC
Click tracking: redirects only to URLs stored when the tracked email was created
Webhook URLs: SSRF checks (no localhost / private IPs)
OAuth state: timing-safe HMAC compare
CSP: enforcing policy on Pages with a nonce per page instead of 'unsafe-inline' (apps/web/functions/lib/csp.ts, applied in functions/_middleware.ts); report-uri → /api/csp-report. The API worker sends the same header set (apps/worker/src/lib/securityHeaders.ts).
GDPR: cookie consent gates SPA analytics; no visitor IDs on page views (aggregate only)
Secrets: never committed — wrangler secret put …

Local development

npm install

npm run dev:worker # wrangler dev --local, http://127.0.0.1:8787 npm run dev:web # vite, http://localhost:5173 (proxies /api to worker)

Without RESEND_API_KEY, magic links log to the worker console — copy the URL into your browser.

Quality checks

npm run lint          # ESLint (web app + worker)

npm run test # Vitest (schemas, crypto, dates) npm run typecheck # tsc worker + vite build web

CI (.github/workflows/ci.yml) runs lint → test → static HTML validation → typecheck on every PR; auto-deploys worker + web on push to `main` when CLOUDFLARE_API_TOKEN is set.

Deploy manually

npm run deploy:worker

npm run deploy:web # builds (copies fonts) then pages deploy, pings IndexNow, submits the sitemap to Google

The Google step (apps/web/scripts/gsc-sitemap.mjs) needs the service account key at ~/.config/docstoc/gsc-service-account.json (never in the repo) and the service account as a Full user of the docstoc.io Search Console property. Without the key it prints a note and exits 0.

After schema changes:

cd apps/worker

wrangler d1 migrations apply chasa-db --local # dev wrangler d1 migrations apply chasa-db --remote # p

Only the beginning is shown; read the rest in the repo

Chasa

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Accounting, finance & taxi

Common questions

Alternatives

Finance Toolkit

SolidInvoice

Korea Tax Calculator

README from the maker

docstoc

Live URLs

App origin resolution

Product specs

Plans & pricing

Feature matrix (by plan)

App routes (/app/*)

i18n (EN + ES)

Marketing & SEO (static HTML in apps/web/public/)

Architecture

API surface (worker)

Security & compliance (implemented)

Local development

Quality checks

Deploy manually

App routes (`/app/*`)

Marketing & SEO (static HTML in `apps/web/public/`)