ANAF SPV

ANAF SPV MCP server

Read and keep what ANAF posts to your Spațiul Privat Virtual (pfinternet.anaf.ro) from your AI assistant: decisions, summonses, notifications, payment confirmations and answers. It also requests documents, writes to ANAF through SPV's contact form (a dry run unless you say otherwise), validates declarations and files a D212. Nothing here moves money; the one money tool, submit_declaration, files a declaration, and your client asks you before each call.

You need an SPV account for a person ("persoană fizică") that signs in with a user name and password, not a qualified certificate; its password in a file or a vault MCP server; and a mail MCP server that reads the mailbox SPV sends sign-in codes to (without one, someone types each code). Validating a declaration also needs Java 8 or newer. ANAF has no API for such an account, so the server reads SPV's web pages.

What you can ask

• "Is there anything new from ANAF in my SPV?"
• "Download the decision ANAF posted last week into my 2026-10 folder."
• "Ask ANAF for my Obligatii de plata statement and save it when it arrives."
• "Save every SPV document I have not saved yet."
• "Check the D300 for September in d300-2026-09.xml with ANAF's validator. How much VAT does it make payable?"
• "What is the status of the filing INTERNT-123456789-2026?"

Install

%2C%20every%20sign-in%20asks%20you%20for%20the%20code.%22%7D%2C%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22anaf_spv_mail_mcp_token_file%22%2C%22description%22%3A%22Optional.%20Path%20of%20a%20file%20holding%20that%20mail%20server's%20bearer%20token%2C%20if%20it%20wants%20one.%22%7D%2C%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22anaf_spv_mail_mcp_command%22%2C%22description%22%3A%22Optional.%20Instead%20of%20a%20URL%3A%20a%20mail%20MCP%20server%20to%20start%20over%20stdio%2C%20as%20a%20JSON%20array%20such%20as%20%5B%5C%22npx%5C%22%2C%5C%22-y%5C%22%2C%5C%22some-mail-mcp%5C%22%5D.%22%7D%5D&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40foreverworks%2Fmcp-anaf-spv%22%5D%2C%22env%22%3A%7B%22ANAF_SPV_USERNAME%22%3A%22%24%7Binput%3Aanaf_spv_username%7D%22%2C%22ANAF_SPV_PASSWORD_FILE%22%3A%22%24%7Binput%3Aanaf_spv_password_file%7D%22%2C%22ANAF_SPV_MAIL_MCP_URL%22%3A%22%24%7Binput%3Aanaf_spv_mail_mcp_url%7D%22%2C%22ANAF_SPV_MAIL_MCP_TOKEN_FILE%22%3A%22%24%7Binput%3Aanaf_spv_mail_mcp_token_file%7D%22%2C%22ANAF_SPV_MAIL_MCP_COMMAND%22%3A%22%24%7Binput%3Aanaf_spv_mail_mcp_command%7D%22%7D%7D)

With Claude Code:

claude mcp add anaf-spv -- npx -y @foreverworks/mcp-anaf-spv

Claude Desktop (Settings, Developer, Edit Config) and most other clients read the same command as JSON:

{

"mcpServers": { "anaf-spv": { "command": "npx", "args": ["-y", "@foreverworks/mcp-anaf-spv"] } } }

Each runs the published package on Node 22.19 or newer. VS Code and the Claude Desktop bundle ask for each setting as they add the server; leave an optional one empty. Cursor reads each from your environment instead (${env:ANAF_SPV_USERNAME} and so on), so set them before you start Cursor. Every setting is optional; Configuration says which ones you need for which tools.

From a clone

git clone https://github.com/foreverworks/mcps.git && cd mcps

npm ci && npm run build claude mcp add anaf-spv -- node "$PWD/servers/anaf-spv/dist/index.js"

In a JSON configuration, the command is node and its one argument the full path of servers/anaf-spv/dist/index.js. To share one running copy between several clients over HTTP, see docs/deploying.md.

A complete configuration, with this repository's bitwarden and google servers over HTTP as the vault and the mailbox:

claude mcp add anaf-spv \

-e ANAF_SPV_VAULT_MCP_URL=http://127.0.0.1: /mcp \ -e ANAF_SPV_VAULT_MCP_TOKEN_FILE= \ -e ANAF_SPV_VAULT_ITEM= \ -e ANAF_SPV_MAIL_MCP_URL=http://127.0.0.1: /mcp \ -e ANAF_SPV_MAIL_MCP_TOKEN_FILE= \ -e ANAF_SPV_MAIL_ACCOUNT= \ -- npx -y @foreverworks/mcp-anaf-spv

docs/onboarding.md walks through the setup, with other vault and mail servers or with codes typed by hand. Over HTTP, one running copy holds one session for every client, so fewer code e-mails go out.

Configuration

Every variable is optional for the server to start: a tool that needs one says which, and health lists what is missing.

Where the password comes from

A vault or a file. Prefer a vault: the password then lives in one place, and a rotation is a change there and nothing else.

Where the e-mailed code comes from

A mail MCP server, read by a driver chosen at each sign-in (The mail drivers). Without one, every sign-in waits for complete_login.

Everything else

A file a tool takes (a declaration's XML, an attachment) goes in byte for byte, by path only, from the server's file roots (MCP_FILE_ROOTS). Files come out into the outbox at mode 0640, whole or not at all, and never over a file holding other bytes (that one gets the next numbered name); a save_dir must be a folder inside it. Under MCP_EGRESS_ALLOW, allow pfinternet.anaf.ro, formularespv-pf.anaf.ro, static.anaf.ro, stare.anaf.ro and the vault and mail servers' hosts. The variables every server shares are in docs/configuration.md.

Getting the SPV account ready

1. Check that the account signs in at pfinternet.anaf.ro with a user name and password. A person registers one on anaf.ro, online with an identity document or at an ANAF office.
2. Find the mailbox SPV sends codes to (the address in SPV's "Editare profil"): it holds "Cod de siguranta" mails from Autentificare.SpatiuPrivat@anaf.ro.
3. Have the account holder put the user name and password in a vault item, or the password in a file only the server's user can read, rather than