Accounting MCP Accounting MCP

MCP Server

Accounting MCP exposes workspace connector tools through the Model Context Protocol (MCP).

  • Endpoint: https://accounting-mcp.com/mcp
  • Transport: Streamable HTTP with JSON-RPC 2.0, stateless
  • Authentication: OAuth 2.0 Bearer token or workspace API key
  • OAuth scope: profile:read

For the customer setup flow, follow Connect Claude or any MCP client. This page documents the server contract and current tool surface.

Authentication and workspace binding

Remote clients can discover the OAuth server from the MCP URL, dynamically register, and complete an authorization-code flow with PKCE. During consent, the user chooses a workspace. The issued token is bound to both that workspace and the canonical MCP resource, so it cannot be replayed against a different workspace or audience.

The only advertised OAuth scope is profile:read. Connector access is enforced separately and evaluated live for every tool listing and call.

Tool visibility and grants

The tool list combines two sources:

  1. The static workspace identity registry, currently whoami.
  2. Connector tools, published as connector__tool with a double underscore.

For a user-authorized token, a connector tool appears only when:

  • The connector is enabled for the workspace.
  • The tool's tier is in the union of the member's direct grant and every active group grant, or the member is an active owner with all tiers.
  • A credential-based connector has an active provider account.

The gateway diagnostics connector is built in and always available. Grant and connector changes take effect on the next request; an existing OAuth token does not preserve old access.

Workspace API keys have no individual member. For compatibility, they receive all tiers for enabled connectors without a member grant. Credential-based calls still require an active provider account. This contract must be revisited before the first destructive tool is registered so workspace-token tier configuration is an explicit decision.

If several active accounts exist for a connector, Accounting MCP routes a user call using only grants that confer the called tool's tier: the qualifying direct grant's account, then each qualifying active group grant's account, then the workspace's oldest active account. The resolved account is injected on the server and is not exposed as a client argument.

Current tool inventory

Tool Tier Availability Purpose and client arguments
whoami Read Every valid workspace token Return the connected workspace id, name, slug, application, and token scopes. No arguments.
gateway__status Read Every valid workspace token Confirm that the gateway can authorize calls for the bound workspace. No arguments.
elevenlabs__initiate_call Write Enabled ElevenLabs connector and active account; user OAuth also requires write from owner/direct/group access Start an outbound Conversational AI call. Arguments: to_number in E.164 format and flat dynamic_variables.
elevenlabs__download_transcript Read Enabled ElevenLabs connector and active account; user OAuth also requires read from owner/direct/group access Retrieve a normalized transcript for a call. Argument: conversation_id.
freeagent__list_bank_accounts Read Enabled FreeAgent connector and active account; user OAuth also requires read from owner/direct/group access List FreeAgent bank accounts. Arguments: bounded page and per_page.
freeagent__list_bank_transactions Read Same as above List transactions for a bank account id. Arguments: bank_account_id, optional ISO date range, and bounded pagination.
freeagent__list_invoices Read Same as above List invoices. Arguments: optional ISO updated_since timestamp and bounded pagination.
freeagent__list_bills Read Same as above List bills. Arguments: optional ISO date range and bounded pagination.
freeagent__get_profit_and_loss Read Same as above Return a profit and loss summary. Arguments: required ISO from_date and to_date.

This table includes every tool from the static tool registry and every registered connector. No current tool is destructive. Provider connection ids are internal and are stripped from the client-facing schemas.

Naming contract

Connector implementations use local names such as initiate_call. The public server prefixes each name with the connector slug and a double underscore:

connector__tool
elevenlabs__initiate_call

Clients should use the names returned by tools/list rather than constructing names themselves.

API key fallback

For scripts or clients that cannot complete OAuth but can send a Bearer header, a workspace owner can create a long-lived key under API Keys. Configure the client with:

{
  "mcpServers": {
    "accounting-mcp": {
      "url": "https://accounting-mcp.com/mcp",
      "headers": {
        "Authorization": "Bearer REPLACE_WITH_API_KEY"
      }
    }
  }
}

The key is shown once. Store it as a secret and revoke it from API Keys if it is exposed. User OAuth is the better choice when the connection must follow per-person grants.

OAuth discovery endpoints

An unauthenticated /mcp response includes a WWW-Authenticate Bearer challenge whose resource_metadata points to the protected resource metadata document.

Protocol behavior

  • POST /mcp handles MCP JSON-RPC requests.
  • GET /mcp returns 405 Method Not Allowed; SSE streaming is not supported in stateless mode.
  • DELETE /mcp returns 204 No Content because there is no server-side session to remove.
  • The server reports accounting-mcp version 1.0.0.
  • Rate limits are shared with the REST API: 60 requests per minute and 500 requests per hour per token.

Every tools/*, resources/*, or prompts/* dispatch writes a metadata-only activity event. Classified tool calls include the access tier. Tool arguments and provider payloads are never logged.

Next steps