{
"markdown": "\n\n[](https://github.com/alexey-pelykh/qontoctl/actions/workflows/ci.yml)\n[](https://codecov.io/gh/alexey-pelykh/qontoctl)\n[](https://www.npmjs.com/package/qontoctl)\n[](https://www.npmjs.com/package/qontoctl)\n[](https://github.com/alexey-pelykh/qontoctl)\n[](LICENSE)\n\nCLI and MCP server for the [Qonto](https://qonto.com) banking API.\n\nThis project is brought to you by [Alexey Pelykh](https://github.com/alexey-pelykh).\n\n> **Unofficial project.** QontoCtl is independent and not affiliated with, endorsed by, or supported by Qonto. See the [Disclaimer](#disclaimer).\n\n## What It Does\n\nQontoCtl lets AI assistants (Claude, etc.) interact with Qonto through the [Model Context Protocol](https://modelcontextprotocol.io). It can:\n\n- **Organizations** — retrieve organization details and settings\n- **Accounts** — list, create, update, close bank accounts; download IBAN certificates\n- **Transactions** — list, search, filter bank transactions; manage transaction attachments\n- **Bank Statements** — list, view, and download bank statements\n- **Labels** — manage transaction labels and categories\n- **Memberships** — view team members, show current membership, invite new members\n- **SEPA Beneficiaries** — list, add, update, trust/untrust SEPA beneficiaries\n- **SEPA Transfers** — list, create, cancel transfers; download proofs; verify payees\n- **Internal Transfers** — create transfers between accounts in the same organization\n- **Bulk Transfers** — list, view, and create bulk SEPA transfer batches\n- **Recurring Transfers** — list, view, create, cancel recurring transfers\n- **International Transfers (SWIFT)** — create SWIFT transfers and manage international beneficiaries\n- **Cards** — list, create, update, lock/unlock, report lost/stolen, discard cards\n- **Teams** — list and create teams\n- **Webhooks** — create and manage webhook subscriptions\n- **Payment Links** — create, deactivate, and manage Stripe-backed payment links\n- **Insurance** — show, create, update insurance contracts and manage documents\n- **Terminals (POS)** — list Qonto Terminals and initiate terminal payments\n- **Products** — list catalogue products\n- **Clients** — list, create, update, delete clients\n- **Client Invoices** — full lifecycle: create, update, finalize, send, mark paid, cancel, upload files\n- **Quotes** — create, update, delete, send quotes\n- **Credit Notes** — list and view credit notes\n- **Supplier Invoices** — list, view, and bulk-create supplier invoices\n- **Requests** — list organization requests\n- **Attachments** — upload and view attachments\n- **E-Invoicing** — retrieve e-invoicing settings\n\n## QontoCtl and Qonto's official MCP\n\n_QontoCtl is an independent, unofficial project — not affiliated with or endorsed by Qonto._\n\nQonto ships its own [official MCP server](https://docs.qonto.com/mcp/overview) — hosted, free on every plan, and installable in a tap from Claude, ChatGPT, Cursor, and more. If you want to _talk to_ your finances — \"show my balances\", \"chart last month's spending\", \"draft an invoice\" — it's an excellent, well-made option.\n\nQontoCtl is built for a different job: **automating** Qonto, not just chatting with it.\n\nThe official MCP is a hosted assistant you log into as a user. QontoCtl is a local, open-source toolkit — a CLI, an MCP server, and a library — that runs on your own machine with your own credentials, including as a headless service account.\n\n| | Official MCP | QontoCtl |\n| ---------------------------------------------- | -------------------------- | ------------------------------------- |\n| Runs headless — CI, cron, scripts, no chat | Interactive only | ✅ CLI + MCP + library |\n| Authentication | OAuth, per-user | ✅ API key (service account) or OAuth |\n| Executes SEPA / internal / recurring transfers | Prepares approval requests | ✅ Yes, with SCA handled\\* |\n| API coverage | Curated subset | ✅ Comprehensive |\n| Self-hosted · your credentials · open source | Qonto-hosted | ✅ AGPL-3.0, local-first |\n\n_Comparison based on Qonto's public MCP documentation as of July 2026._\n\n\\* Transfers to untrusted payees still require your Strong Customer Authentication approval, as they must. QontoCtl handles the SCA continuation so scripted flows — to trusted beneficiaries and between your own accounts — complete without a human at the terminal.\n\nQontoCtl also supports multiple Qonto organizations from one setup via named profiles — handy for accountants, holding companies, and anyone running the books for several entities.\n\n**The official MCP talks to Qonto. QontoCtl automates it.** Many people will use both — the official MCP in a chat window, QontoCtl in a pipeline.\n\n## Prerequisites\n\n- **Node.js** >= 24\n- A **Qonto** business account with API access\n\n## Installation\n\n```sh\nnpm install -g qontoctl\n```\n\nOr run directly with npx:\n\n```sh\nnpx qontoctl --help\n```\n\nOr install via [Homebrew](https://brew.sh):\n\n```sh\nbrew install qontoctl/tap/qontoctl\n```\n\n## Quick Start\n\n```sh\n# 1. Install\nnpm install -g qontoctl\n\n# 2. Create a profile with your Qonto API credentials\nqontoctl profile add mycompany\n\n# 3. Test the connection\nqontoctl profile test --profile mycompany\n\n# 4. List your accounts\nqontoctl account list --profile mycompany\n```\n\n## MCP Integration\n\nQontoCtl implements the [Model Context Protocol](https://modelcontextprotocol.io) (MCP), letting AI assistants interact with your Qonto account through natural language.\n\n### MCP Client Configuration\n\n\nClaude Desktop
\n\nAdd to your Claude Desktop configuration (`claude_desktop_config.json`):\n\n```json\n{\n \"mcpServers\": {\n \"qontoctl\": {\n \"command\": \"npx\",\n \"args\": [\"qontoctl\", \"mcp\"]\n }\n }\n}\n```\n\n \n\n\nClaude Code
\n\n```sh\nclaude mcp add qontoctl -- npx qontoctl mcp\n```\n\n \n\n\nCursor
\n\nAdd to `.cursor/mcp.json` in your project root:\n\n```json\n{\n \"mcpServers\": {\n \"qontoctl\": {\n \"command\": \"npx\",\n \"args\": [\"qontoctl\", \"mcp\"]\n }\n }\n}\n```\n\n \n\n\nWindsurf
\n\nAdd to `~/.codeium/windsurf/mcp_config.json`:\n\n```json\n{\n \"mcpServers\": {\n \"qontoctl\": {\n \"command\": \"npx\",\n \"args\": [\"qontoctl\", \"mcp\"]\n }\n }\n}\n```\n\n \n\n#### Pointing MCP at a non-default config file\n\nThe MCP server has no CLI flags. To load credentials from a config file other than `~/.qontoctl.yaml`, set `QONTOCTL_CONFIG_FILE` in the host's `env` block:\n\n```jsonc\n{\n \"mcpServers\": {\n \"qontoctl\": {\n \"command\": \"npx\",\n \"args\": [\"qontoctl\", \"mcp\"],\n \"env\": {\n \"QONTOCTL_CONFIG_FILE\": \"/abs/path/to/qontoctl.yaml\",\n },\n },\n },\n}\n```\n\nThe path is captured at server startup. See [`docs/configuration.md`](docs/configuration.md) for the full resolution chain.\n\n### Available MCP Tools\n\n| Tool | Description |\n| ------------------------------- | --------------------------------------------------------------------- |\n| **Organization** | |\n| `org_show` | Show organization details including name, slug, and bank accounts |\n| **Accounts** | |\n| `account_list` | List all bank accounts for the organization |\n| `account_show` | Show details of a specific bank account |\n| `account_iban_certificate` | Download IBAN certificate PDF for a bank account |\n| `account_create` | Create a new bank account |\n| `account_update` | Update an existing bank account |\n| `account_close` | Close a bank account |\n| **Transactions** | |\n| `transaction_list` | List transactions for a bank account with optional filters |\n| `transaction_show` | Show details of a specific transaction |\n| `transaction_attachment_list` | List attachments for a transaction |\n| `transaction_attachment_add` | Attach a file to a transaction |\n| `transaction_attachment_remove` | Remove attachment(s) from a transaction |\n| **Statements** | |\n| `statement_list` | List bank statements with optional filters |\n| `statement_show` | Show details of a specific bank statement |\n| **Labels** | |\n| `label_list` | List all labels in the organization |\n| `label_show` | Show details of a specific label |\n| **Memberships** | |\n| `membership_list` | List all memberships in the organization |\n| `membership_show` | Show the current authenticated user's membership |\n| `membership_invite` | Invite a new member to the organization |\n| **SEPA Beneficiaries** | |\n| `beneficiary_list` | List SEPA beneficiaries in the organization |\n| `beneficiary_show` | Show details of a specific SEPA beneficiary |\n| `beneficiary_add` | Create a new SEPA beneficiary |\n| `beneficiary_update` | Update an existing SEPA beneficiary |\n| `beneficiary_trust` | Trust one or more SEPA beneficiaries |\n| `beneficiary_untrust` | Untrust one or more SEPA beneficiaries |\n| **SEPA Transfers** | |\n| `transfer_list` | List SEPA transfers with optional filters |\n| `transfer_show` | Show details of a specific SEPA transfer |\n| `transfer_create` | Create a SEPA transfer |\n| `transfer_cancel` | Cancel a pending SEPA transfer |\n| `transfer_proof` | Download SEPA transfer proof PDF |\n| `transfer_verify_payee` | Verify a payee (Verification of Payee / VoP) |\n| `transfer_bulk_verify_payee` | Bulk verify payees (VoP) |\n| **Internal Transfers** | |\n| `internal_transfer_create` | Create an internal transfer between two bank accounts |\n| **Bulk Transfers** | |\n| `bulk_transfer_list` | List bulk transfers |\n| `bulk_transfer_show` | Show details of a specific bulk transfer |\n| `bulk_transfer_create` | Create a bulk SEPA transfer (auto-resolves VoP via bulk_verify_payee) |\n| **Recurring Transfers** | |\n| `recurring_transfer_list` | List recurring transfers |\n| `recurring_transfer_show` | Show details of a specific recurring transfer |\n| **Terminals (POS)** | |\n| `terminal_list` | List Qonto Terminals linked to the organization |\n| `terminal_payment_create` | Initiate a payment on a terminal (returns 202 Accepted) |\n| **Products** | |\n| `product_list` | List catalogue products with optional pagination and sort |\n| **Clients** | |\n| `client_list` | List clients with optional pagination |\n| `client_show` | Show details of a specific client |\n| `client_create` | Create a new client |\n| `client_update` | Update an existing client |\n| `client_delete` | Delete a client |\n| **Client Invoices** | |\n| `client_invoice_list` | List client invoices with optional filters |\n| `client_invoice_show` | Show details of a specific client invoice |\n| `client_invoice_create` | Create a draft client invoice with client and line items |\n| `client_invoice_update` | Update a draft client invoice |\n| `client_invoice_delete` | Delete a draft client invoice |\n| `client_invoice_finalize` | Finalize a client invoice (assign number) |\n| `client_invoice_send` | Send a client invoice to the client via email |\n| `client_invoice_mark_paid` | Mark a client invoice as paid |\n| `client_invoice_unmark_paid` | Unmark a client invoice paid status |\n| `client_invoice_cancel` | Cancel a finalized client invoice |\n| `client_invoice_upload` | Upload a file to a client invoice |\n| `client_invoice_upload_show` | Show upload details for a client invoice |\n| **Quotes** | |\n| `quote_list` | List quotes with optional filters |\n| `quote_show` | Show details of a specific quote |\n| `quote_create` | Create a new quote with client and line items |\n| `quote_update` | Update an existing quote |\n| `quote_delete` | Delete a quote |\n| `quote_send` | Send a quote to the client via email |\n| **Credit Notes** | |\n| `credit_note_list` | List credit notes in the organization |\n| `credit_note_show` | Show details of a specific credit note |\n| **Supplier Invoices** | |\n| `supplier_invoice_list` | List supplier invoices with optional filters |\n| `supplier_invoice_show` | Show details of a specific supplier invoice |\n| `supplier_invoice_bulk_create` | Create supplier invoices by uploading files |\n| **Requests** | |\n| `request_list` | List all requests in the organization |\n| **SCA Sessions** | |\n| `sca_session_show` | Show the status of an SCA session (`waiting` / `allow` / `deny`) |\n| `sca_session_mock_decision` | Simulate an SCA decision in the Qonto sandbox (sandbox-only) |\n| **Attachments** | |\n| `attachment_upload` | Upload an attachment file (PDF, JPEG, PNG) |\n| `attachment_show` | Show details of a specific attachment |\n| **E-Invoicing** | |\n| `einvoicing_settings` | Retrieve e-invoicing settings for the organization |\n\n### Example Prompts\n\nOnce configured, you can ask your AI assistant things like:\n\n- \"Show my Qonto account balances\"\n- \"List recent transactions over 1000 EUR\"\n- \"What were last month's card payments?\"\n- \"Show all team members in my organization\"\n- \"List bank statements for January 2026\"\n- \"Create a summary of this week's debits\"\n\n### SCA Continuation\n\nSome Qonto write operations — creating a transfer, modifying a card, approving a request — require **Strong Customer Authentication (SCA)**: the user has to approve the request in the Qonto mobile app before it executes. QontoCtl wraps every SCA-gated MCP write tool with a continuation flow so the LLM client never has to reimplement polling.\n\n#### How a wrapped write tool behaves\n\nWhen an SCA-gated tool (e.g. `transfer_create`, `card_create`, `beneficiary_trust`, `request_approve`) hits a 428 SCA challenge, the wrapper polls the SCA session inline. If the user approves within the polling window, the tool returns the operation's success result transparently — the LLM never sees the SCA round-trip. If polling times out (or polling is disabled), the tool returns a structured **SCA-pending response** carrying the session token and instructions to continue.\n\nEvery wrapped tool exposes two optional input fields for this flow:\n\n- `wait` — maximum seconds to poll inline before falling back to the pending response.\n- `sca_session_token` — bind a previously approved SCA challenge to a retry.\n\n#### The `wait` knob\n\n| Value | Behavior |\n| ---------------- | ------------------------------------------------------------------------------------ |\n| `30` _(default)_ | Poll for up to 30 seconds, then fall back to the structured pending response. |\n| `1`–`120` | Poll for the specified number of seconds (capped at 120). |\n| `0` or `false` | Skip polling entirely. Return the SCA-pending response immediately on the first 428. |\n\nThe `120` upper bound is the hard ceiling enforced via Zod at the input boundary. The practical ceiling is your MCP host's request timeout — Claude Desktop hardcodes ≈ 60 s and Cursor's effective limit is ≈ 30 s, so values above those will surface as host-side timeouts before the wrapper resolves. Use a small `wait` (e.g. `5`-`10`) when the LLM expects the user to be present and willing to approve immediately. Use `wait: false` (or `wait: 0`) for **pure two-step flows** where the LLM and the user converse out-of-band between the SCA challenge and the retry.\n\n#### Two-step fallback (out-of-band continuation)\n\nWhen polling does not resolve, the SCA-pending response carries:\n\n- A user-facing message: `\"SCA required. The user must approve this operation on their Qonto mobile app.\"`\n- A `Session token: ` line (token validity: 15 minutes from issuance).\n- Step-by-step instructions to continue.\n\nThe LLM (or the user) can then:\n\n1. **Poll session status** with the `sca_session_show` tool, passing the captured token. It returns `waiting`, `allow`, or `deny`.\n2. **Retry the original tool** once the status is `allow`, passing the _same parameters_ plus `sca_session_token: \"\"`. The wrapper invokes the operation exactly once with the token bound — no second poll happens.\n\n> **PSD2 dynamic linking.** The SCA session token is bound to the _original_ request parameters (amount, payee). Reusing a token against a different operation is rejected by Qonto. Reissue an SCA challenge by calling the original tool again whenever the parameters need to change.\n\n#### Caller-supplied retry (`sca_session_token`)\n\nWhen `sca_session_token` is set on a wrapped write tool, the wrapper:\n\n- Invokes the operation exactly once.\n- Skips polling entirely.\n- Forwards the token via the `X-Qonto-Sca-Session-Token` header.\n\nThis is the path used by step (2) of the two-step fallback. It is also useful when the LLM client implements its own polling cadence and only needs the wrapper to retry with an already-captured approval.\n\n#### Sandbox testing\n\nSandbox accounts cannot enroll a real paired device, so SCA challenges in sandbox use a `mock` flow. After receiving a pending response, simulate the user's decision with the `sca_session_mock_decision` tool (sandbox-only — refuses to run when no staging token is configured). See [`docs/sandbox-testing.md`](docs/sandbox-testing.md) for the full sandbox setup.\n\n#### Migration note\n\nEarlier QontoCtl builds (pre-`@qontoctl/mcp` SCA continuation) returned a free-form text response on 428 with no continuation hooks. Callers parsing that response should adopt the structured flow:\n\n| Before | After |\n| ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Free-form text mentioned the SCA endpoint but offered no MCP-exposed way to continue. | The SCA-pending response is still text content but its shape is stable: `Session token: ` is the canonical line; `sca_session_show` is the polling API. |\n| Polling required driving the Qonto HTTP API directly. | Use the `sca_session_show` MCP tool. |\n| Re-running the operation orphaned the prior approval. | Retry the original tool with the captured `sca_session_token` parameter — the prior approval is bound to that retry. |\n| No way to opt-in to inline polling — every 428 was a dead end. | Pass `wait: ` (1-120) to poll inline; tools default to 30s. Pass `wait: false` for the explicit two-step flow. |\n\nThe pending response's textual format is stable, so callers that need to extract the token programmatically can match against the `Session token:` line — but using `sca_session_show` directly avoids relying on the response prose.\n\n## CLI Usage\n\n> **First command to try when something doesn't work**: [`qontoctl diagnose`](docs/troubleshooting.md) — a read-only healthcheck across config, credentials, scopes, organization metadata, and host routing.\n\n### Commands\n\n| Command | Description |\n| --------------------------------------------- | ---------------------------------------------------------------------------------- |\n| `diagnose` | Read-only healthcheck (see [troubleshooting](docs/troubleshooting.md)) |\n| `org show` | Show organization details |\n| `account list` | List bank accounts |\n| `account show ` | Show bank account details |\n| `account iban-certificate ` | Download IBAN certificate PDF |\n| `account create` | Create a new bank account |\n| `account update ` | Update a bank account |\n| `account close ` | Close a bank account |\n| `transaction list` | List transactions with filters |\n| `transaction show ` | Show transaction details |\n| `transaction attachment list ` | List attachments for a transaction |\n| `transaction attachment add ` | Attach a file to a transaction |\n| `transaction attachment remove [att-id]` | Remove attachment(s) from a transaction |\n| `statement list` | List bank statements |\n| `statement show ` | Show statement details |\n| `statement download ` | Download statement PDF |\n| `label list` | List all labels |\n| `label show ` | Show label details |\n| `membership list` | List organization memberships |\n| `membership show` | Show current user's membership |\n| `membership invite` | Invite a new member |\n| `beneficiary list` | List SEPA beneficiaries |\n| `beneficiary show ` | Show beneficiary details |\n| `beneficiary add` | Create a new beneficiary |\n| `beneficiary update ` | Update a beneficiary |\n| `beneficiary trust ` | Trust one or more beneficiaries |\n| `beneficiary untrust ` | Untrust one or more beneficiaries |\n| `transfer list` | List SEPA transfers |\n| `transfer show ` | Show SEPA transfer details |\n| `transfer create` | Create a SEPA transfer |\n| `transfer cancel ` | Cancel a pending SEPA transfer |\n| `transfer proof ` | Download SEPA transfer proof PDF |\n| `transfer verify-payee` | Verify a payee (VoP) |\n| `transfer bulk-verify-payee` | Bulk verify payees from CSV |\n| `internal-transfer create` | Create an internal transfer |\n| `bulk-transfer list` | List bulk transfers |\n| `bulk-transfer show ` | Show bulk transfer details |\n| `bulk-transfer create` | Create a bulk SEPA transfer from JSON |\n| `recurring-transfer list` | List recurring transfers |\n| `recurring-transfer show ` | Show recurring transfer details |\n| `terminal list` | List Qonto Terminals (POS) |\n| `terminal payment create ` | Initiate a payment on a terminal |\n| `product list` | List catalogue products |\n| `client list` | List clients |\n| `client show ` | Show client details |\n| `client create` | Create a new client |\n| `client update ` | Update a client |\n| `client delete ` | Delete a client |\n| `client-invoice list` | List client invoices |\n| `client-invoice show ` | Show client invoice details |\n| `client-invoice create` | Create a draft client invoice |\n| `client-invoice update ` | Update a draft client invoice |\n| `client-invoice delete ` | Delete a draft client invoice |\n| `client-invoice finalize ` | Finalize client invoice and assign number |\n| `client-invoice send ` | Send client invoice to client via email |\n| `client-invoice mark-paid ` | Mark client invoice as paid |\n| `client-invoice unmark-paid ` | Unmark client invoice paid status |\n| `client-invoice cancel ` | Cancel a finalized client invoice |\n| `client-invoice upload ` | Upload a file to a client invoice |\n| `client-invoice upload-show ` | Show upload details for a client invoice |\n| `quote list` | List quotes |\n| `quote show ` | Show quote details |\n| `quote create` | Create a new quote |\n| `quote update ` | Update a quote |\n| `quote delete ` | Delete a quote |\n| `quote send ` | Send quote to client via email |\n| `credit-note list` | List credit notes |\n| `credit-note show ` | Show credit note details |\n| `supplier-invoice list` | List supplier invoices |\n| `supplier-invoice show ` | Show supplier invoice details |\n| `supplier-invoice bulk-create` | Create supplier invoices from files |\n| `einvoicing settings` | Show e-invoicing settings |\n| `request list` | List all requests |\n| `attachment upload ` | Upload an attachment file |\n| `attachment show ` | Show attachment details |\n| `auth setup` | Configure OAuth client credentials |\n| `auth login` | Start OAuth login flow |\n| `auth status` | Display OAuth token status (focused; for whole-integration health, use `diagnose`) |\n| `auth refresh` | Refresh the OAuth access token |\n| `auth revoke` | Revoke OAuth consent and clear tokens |\n| `profile add ` | Create a named profile |\n| `profile list` | List all profiles |\n| `profile show ` | Show profile details (secrets redacted) |\n| `profile remove ` | Remove a named profile |\n| `profile test` | Test credentials |\n| `completion bash` | Generate bash completions |\n| `completion zsh` | Generate zsh completions |\n| `completion fish` | Generate fish completions |\n| `mcp` | Start MCP server on stdio |\n\n### Global Options\n\n| Option | Description |\n| ----------------------- | --------------------------------------------------------------------------------- |\n| `--config ` | Explicit path to a config file (overrides `--profile` and `QONTOCTL_CONFIG_FILE`) |\n| `-p, --profile ` | Configuration profile to use |\n| `-o, --output ` | Output format: `table` (default), `json`, `yaml`, `csv` |\n| `--page ` | Fetch a specific page of results |\n| `--per-page ` | Results per page |\n| `--no-paginate` | Disable auto-pagination |\n| `--verbose` | Enable verbose output |\n| `--debug` | Enable debug output (implies `--verbose`) |\n\n## Configuration\n\nQontoCtl supports two authentication methods:\n\n- **API Key** — production-only access using your organization slug and secret key. Supports the endpoints listed as \"API key ✔\" in the [Qonto auth table](https://docs.qonto.com/get-started/business-api/authentication/introduction) (most reads plus many writes — internal transfers, clients, attachments, …). Cannot be used against the Qonto sandbox.\n- **OAuth 2.0** — full access including OAuth-only endpoints (cards, teams, webhooks, e-invoicing, payment links, insurance, international transfers, recurring transfers, SCA flows) and the Qonto sandbox via staging-token; see the [OAuth App Setup Guide](docs/oauth-setup.md).\n\n### Profile Format\n\nAll configuration files use the same YAML format:\n\n```yaml\n# API Key authentication\napi-key:\n organization-slug: acme-corp-4821\n secret-key: your-secret-key\n\n# OAuth 2.0 authentication (see docs/oauth-setup.md)\noauth:\n client-id: your-client-id\n client-secret: your-client-secret\n```\n\n### Resolution Order\n\nThe CLI resolves the config **file** in this order (highest priority first):\n\n1. `--config ` flag\n2. `QONTOCTL_CONFIG_FILE` env var\n3. `~/.qontoctl/{name}.yaml` (when `--profile ` is given)\n4. `~/.qontoctl.yaml` (home default)\n\nWhen `--config` is supplied alongside `QONTOCTL_CONFIG_FILE` or `--profile` and the resolved paths disagree, `--config` wins and a warning is emitted on stderr so the override is visible.\n\n> **No current-directory discovery.** The CLI does not scan the working directory for `.qontoctl.yaml`. For repo-local config, use a `direnv` shim that exports `QONTOCTL_CONFIG_FILE=\"$PWD/.qontoctl.yaml\"`, or pass `--config ./.qontoctl.yaml` explicitly per invocation.\n\n**Per-field overrides** apply on top of the loaded file:\n\n- Without `--profile`: `QONTOCTL_*` env vars override file values\n- With `--profile acme`: `QONTOCTL_ACME_*` env vars override file values\n\nFor the full reference (precedence rules per entry point, profile semantics, migration from CWD discovery), see [`docs/configuration.md`](docs/configuration.md).\n\n### Environment Variables\n\nEnvironment variables override file values. They carry **inputs** (static configuration) the tool reads but never writes back; runtime-mutable state (refresh tokens, token expiry, granted scopes) lives in the file only. See the note on `QONTOCTL_ACCESS_TOKEN` below.\n\nWithout `--profile`:\n\n| Variable | Description |\n| ---------------------------- | ------------------------------------------ |\n| `QONTOCTL_ORGANIZATION_SLUG` | Organization slug |\n| `QONTOCTL_SECRET_KEY` | API secret key |\n| `QONTOCTL_CLIENT_ID` | OAuth client ID |\n| `QONTOCTL_CLIENT_SECRET` | OAuth client secret |\n| `QONTOCTL_ACCESS_TOKEN` | OAuth access token (read-only — see below) |\n| `QONTOCTL_ENDPOINT` | Custom API endpoint |\n| `QONTOCTL_STAGING_TOKEN` | Staging token (activates sandbox URLs) |\n\nWith `--profile `, prefix becomes `QONTOCTL_{NAME}_` (uppercased, hyphens replaced with underscores). For example, `--profile acme` reads `QONTOCTL_ACME_ORGANIZATION_SLUG`.\n\n> **`QONTOCTL_ACCESS_TOKEN` semantics**: when set, the env-supplied bearer is used for the current invocation only. Proactive token refresh is not attempted, and refreshed tokens are not persisted to disk (mirrors `AWS_SESSION_TOKEN`). If the token has expired the API surfaces a `401`; re-issue the token externally.\n>\n> **`QONTOCTL_REFRESH_TOKEN` is intentionally not supported.** Refresh tokens are runtime-mutable state — every refresh produces a new value the tool must write back somewhere — and env vars carry inputs, not state. Use file-based credentials (`~/.qontoctl.yaml` or a profile) for OAuth flows that need refresh, or stick with API-key env vars in CI.\n\n## Debug Mode\n\nThe `--verbose` and `--debug` flags enable wire-level logging to stderr:\n\n```sh\nqontoctl --verbose transaction list # request/response summaries\nqontoctl --debug transaction list # full headers and response bodies\n```\n\n> **Security note:** `--debug` logs full API response bodies. Known sensitive fields\n> (IBAN, BIC, balance) are automatically redacted, but responses may still contain\n> other financial data. Do not use `--debug` in shared environments or pipe debug\n> output to files accessible by others.\n\n## Disclaimer\n\n`qontoctl` is an **independent project** not affiliated with, endorsed by, or officially connected to **Qonto**. It runs on your own machine with your own credentials.\n\n\"Qonto\" and the Qonto logo are trademarks of Olinda SAS (the company operating Qonto); `qontoctl` uses the name only to describe the service it interoperates with.\n\n## License\n\n[AGPL-3.0-only](LICENSE)\n\n### What AGPL means for you\n\n- **Using qontoctl as a CLI tool or MCP server** does not make your code AGPL-licensed.\n Running the tool, scripting around it, or connecting it to your applications is normal\n use — no license obligations arise.\n- **Using `@qontoctl/core` as a library** (importing it into your code) means your combined\n work is covered by AGPL-3.0. If you distribute that combined work, you must make its\n source available under AGPL-compatible terms.\n- **Modifying and distributing qontoctl itself** requires you to share your changes under\n AGPL-3.0.\n- **Commercial licensing** is available if AGPL does not fit your use case — contact the\n maintainer.\n",
"bytes": 44133,
"sha": "82a4936a45ab46ceb22299fddfc6771f4c677015e66795420490a717cefc361b",
"repo_slug": "alexey-pelykh/qontoctl",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_alexey_pelykh_qontoctl_6efc4cb9/readme"
}