Hosting

remote

Transport

Not documented

Endpoint

https://api.xero.com/mcp/v1

Authentication

OAuth 2.0. Xero recommends PKCE; user signs in, chooses organizations to share, and approves requested scopes. No separate MCP credentials are required.

Requirements

• Xero Developer account
• Xero Commercial app configured for PKCE
• Core plan or above for production organizations; Starter can use a demo organization
• MCP client with OAuth/remote server support
• Client-specific redirect URL

Setup steps

1. Create or open a Commercial app in Xero Developer and select PKCE; configure the redirect URL required by the chosen MCP client.
2. Add https://api.xero.com/mcp/v1 as a remote MCP server in the client.
3. Start the OAuth flow, sign in to Xero, select the organization(s), and approve only the required scopes.
4. Use get_connected_tenants as a read-only connection check, then identify the organization before requesting work.

Xero’s current GA reference enumerates exactly 39 tools, matching stored names. OAuth scopes gate each tool; create/update/authorise/void operations change accounting records, and Xero calls for explicit user confirmation before writes.

• list_invoices

  List invoices.

  01
• list_credit_notes

  List credit notes.

  02
• list_items

  List items.

  03
• list_quotes

  List quotes.

  04
• create_invoice

  Create an invoice.

  05
• update_invoice

  Update an invoice.

  06
• authorise_invoice

  Authorize an invoice.

  07
• void_invoice

  Void an invoice.

  08
• create_credit_note

  Create a credit note.

  09
• update_credit_note

  Update a credit note.

  10
• create_item

  Create an item.

  11
• update_item

  Update an item.

  12
• create_quote

  Create a quote.

  13
• update_quote

  Update a quote.

  14
• list_tracking_categories

  List tracking categories.

  15
• create_tracking_category

  Create a tracking category.

  16
• update_tracking_category

  Update a tracking category.

  17
• create_tracking_options

  Create tracking options.

  18
• update_tracking_options

  Update tracking options.

  19
• list_contacts

  List contacts.

  20
• create_contact

  Create a contact.

  21
• update_contact

  Update a contact.

  22
• list_bank_transactions

  List bank transactions.

  23
• create_bank_transaction

  Create a bank transaction.

  24
• update_bank_transaction

  Update a bank transaction.

  25
• list_payments

  List payments.

  26
• create_payment

  Create a payment.

  27
• list_manual_journals

  List manual journals.

  28
• create_manual_journal

  Create a manual journal.

  29
• update_manual_journal

  Update a manual journal.

  30
• list_profit_and_loss

  Get a profit and loss report.

  31
• list_report_balance_sheet

  Get a balance sheet report.

  32
• list_trial_balance

  Get a trial balance.

  33
• list_aged_payables_by_contact

  Get aged payables by contact.

  34
• list_aged_receivables_by_contact

  Get aged receivables by contact.

  35
• list_accounts

  List accounts.

  36
• list_tax_rates

  List tax rates.

  37
• list_organisation_details

  Get organisation details.

  38
• get_connected_tenants

  List connected Xero organisations; no scope required.

  39

• Read/write access is limited by OAuth scopes approved for the app.
• Each tool call acts on one organization; multi-organization users must explicitly select the target before changes.
• Data returned counts toward plan data-egress volume; API rate limits, connection limits, and egress metering apply.
• Starter apps can try only against a demo organization.
• Plus, Advanced and Enterprise app certification requirements remain; Advanced and Enterprise security assessments also remain.
• create_, update_, authorise_ and void_ tools change data; authorise_invoice and void_invoice change financial-record state and should require explicit user confirmation.

• official tool reference

  Xero’s current GA reference enumerates exactly 39 tools, matching stored names. OAuth scopes gate each tool; create/update/authorise/void operations change accounting records, and Xero calls for explicit user confirmation before writes.

• official documentation or source

  Xero’s current GA reference enumerates exactly 39 tools, matching stored names. OAuth scopes gate each tool; create/update/authorise/void operations change accounting records, and Xero calls for explicit user confirmation before writes.

Documentation checked 2026-10-28T14:15:00.000Z. Connection has not been runtime tested.