Server data from the Official MCP Registry
MCP server for Xero accounting — contacts, invoices, payments, accounts, and financial reports.
MCP server for Xero accounting — contacts, invoices, payments, accounts, and financial reports.
The Xero MCP server is well-structured with proper authentication mechanisms and reasonable permission scoping for its financial accounting purpose. However, there are notable concerns with input validation and error handling that could expose sensitive information or enable API abuse. The gateway authentication mode is a significant security strength, but credential handling in stdio mode lacks validation. Code quality issues around input sanitization and error messages should be addressed before production use. Supply chain analysis found 2 known vulnerabilities in dependencies (1 critical, 0 high severity).
7 files analyzed · 12 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: XERO_TENANT_ID
Environment variable: XERO_ACCESS_TOKEN
Environment variable: MCP_TRANSPORT
Environment variable: AUTH_MODE
Environment variable: LOG_LEVEL
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-wyre-technology-xero-mcp": {
"env": {
"AUTH_MODE": "your-auth-mode-here",
"LOG_LEVEL": "your-log-level-here",
"MCP_TRANSPORT": "your-mcp-transport-here",
"XERO_TENANT_ID": "your-xero-tenant-id-here",
"XERO_ACCESS_TOKEN": "your-xero-access-token-here"
},
"args": [
"-y",
"@wyre-technology/xero-mcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
Model Context Protocol (MCP) server for the Xero Accounting API. Enables Claude and other MCP-compatible clients to manage Xero contacts, invoices, payments, accounts, and reports.
npm install
npm run build
XERO_ACCESS_TOKEN=your-access-token XERO_TENANT_ID=your-tenant-id npm start
MCP_TRANSPORT=http XERO_ACCESS_TOKEN=your-access-token XERO_TENANT_ID=your-tenant-id npm start
The server listens on http://0.0.0.0:8080/mcp by default.
docker build -t xero-mcp .
docker run -p 8080:8080 \
-e MCP_TRANSPORT=http \
-e XERO_ACCESS_TOKEN=your-access-token \
-e XERO_TENANT_ID=your-tenant-id \
xero-mcp
| Variable | Required | Default | Description |
|---|---|---|---|
XERO_ACCESS_TOKEN | Yes (env mode) | — | Xero OAuth2 access token |
XERO_TENANT_ID | Yes (env mode) | — | Xero tenant ID (organisation) |
MCP_TRANSPORT | No | stdio | Transport type: stdio or http |
MCP_HTTP_PORT | No | 8080 | HTTP server port |
MCP_HTTP_HOST | No | 0.0.0.0 | HTTP server bind address |
AUTH_MODE | No | env | Auth mode: env or gateway |
When AUTH_MODE=gateway, credentials are passed per-request via HTTP headers instead of environment variables:
X-Xero-Access-Token — OAuth2 access tokenX-Xero-Tenant-Id — Xero tenant IDThis allows a gateway/proxy to manage multi-tenant credentials.
Tools are organized into domains. Use xero_navigate to select a domain, then use the domain-specific tools.
xero_navigate — Select a domain (contacts, invoices, payments, accounts, reports)xero_back — Return to domain selectionxero_contacts_list — List contacts with pagination and optional filteringxero_contacts_get — Get detailed contact information by IDxero_contacts_create — Create a new contact (customer or supplier)xero_contacts_search — Search contacts by namexero_invoices_list — List invoices with optional status and type filtersxero_invoices_get — Get detailed invoice information by IDxero_invoices_create — Create a new invoice (sales or bill)xero_invoices_update_status — Update invoice status (submit, authorise, void)xero_payments_list — List payments with optional status filterxero_payments_get — Get detailed payment information by IDxero_payments_create — Record a payment against an invoicexero_accounts_list — List chart of accounts with optional type/class filterxero_accounts_get — Get detailed account information by IDxero_reports_profit_and_loss — Profit and Loss (income statement) for a date rangexero_reports_balance_sheet — Balance Sheet as of a specific datexero_reports_aged_receivables — Aged Receivables by contactxero_reports_aged_payables — Aged Payables by contactApache-2.0
Be the first to review this server!
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption