Mcp Xero

io.github.codesparPublished by GitHub account codesparv0.2.2Updated Oct 24, 2026

MCP server for Xero — global cloud accounting: contacts, invoices, payments, items, reports

VerifiedSTDIODesktop onlyFinanceBusiness & Commerce

Overview

AI-generated overview

Local MCP server that connects an assistant to Xero cloud accounting to manage contacts, invoices, payments, items and reports.

What you can do
Create, read, update and archive contacts, including customers and suppliers, and list organisations and tax rates or the chart of accounts. Create, read, update and void invoices, and email an authorised invoice to the contact's address on file. Record and list payments, credit notes, items and bank transactions. Retrieve the balance sheet report for the tenant. Filter list results with Xero where-clause expressions.
When to use it
Useful when an assistant should work with Xero accounting data for a business operating outside Brazil or with international entities, for example drafting invoices, recording payments or pulling a balance sheet without leaving the chat.
Requirements
Runs locally as an npm package over stdio (Node.js required). Needs a pre-issued Xero OAuth2 access token in XERO_ACCESS_TOKEN and a tenant or organisation id in XERO_TENANT_ID. OAuth consent, refresh-token rotation and tenant selection must be handled upstream; expired tokens return 401 and must be refreshed.
Before you install
The access token is a secret granting access to the organisation's accounting data; keep it out of logs and rotate it on expiry. Many tools write to live accounting records, including creating invoices, payments, credit notes and bank transactions, voiding invoices, archiving contacts and emailing invoices to customers. Review write actions before running them.

Installation

In SourceWeft

  1. Open Mcp Xero in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@codespar/mcp-xero

MCP server for Xero — global cloud accounting for SMBs.

Xero is the #2 global SMB ERP and the leader in the UK, Australia, and New Zealand, with rapid expansion in the US. Paired with QuickBooks, the two platforms cover roughly 80% of global SMB accounting. For LatAm SaaS serving US/UK/AU/NZ customers or with international subsidiaries, Xero is the essential complement to our Brazil-native ERPs (Omie, Conta Azul, Bling, Tiny).

Tools (24)

ToolPurpose
create_contactCreate a Xero contact (customer or supplier — Xero uses one unified Contact object with IsCustomer/IsSuppli...
get_contactRetrieve a single Xero contact by ContactID (UUID).
list_contactsList Xero contacts.
create_invoiceCreate an invoice in Xero.
get_invoiceRetrieve a single invoice by InvoiceID (UUID) or InvoiceNumber.
list_invoicesList invoices with optional Xero where-clause filtering.
email_invoiceEmail an AUTHORISED invoice to the contact's email address on file.
create_paymentRecord a payment against an invoice or credit note.
create_itemCreate a Xero inventory/product item.
list_itemsList all items/products in the Xero tenant.
list_accountsList the Xero chart of accounts.
update_contactUpdate an existing Xero contact.
archive_contactArchive a Xero contact by setting ContactStatus=ARCHIVED.
update_invoiceUpdate an existing invoice.
void_invoiceVoid an invoice by setting Status=VOIDED.
get_paymentRetrieve a single payment by PaymentID.
list_paymentsList payments recorded in Xero.
create_bank_transactionCreate a bank transaction (SPEND = money out, RECEIVE = money in) directly on a bank account — for transact...
list_bank_transactionsList bank transactions (spend/receive entries on bank accounts).
list_organisationsRetrieve the Xero organisation(s) the access token has access to — returns name, base currency, country, fi...
list_tax_ratesList tax rates configured in the Xero tenant.
create_credit_noteCreate a credit note.
list_credit_notesList credit notes.
get_balance_sheetRetrieve the Balance Sheet report for the tenant.

Install

bash
npm install @codespar/mcp-xero

Environment

bash
XERO_ACCESS_TOKEN="..."   # OAuth2 bearer access token (required, secret)XERO_TENANT_ID="..."      # Xero tenant/organization id (required)

Authentication

Xero uses OAuth2. Every request includes:

Authorization: Bearer <XERO_ACCESS_TOKEN>Xero-tenant-id: <XERO_TENANT_ID>Accept: application/jsonContent-Type: application/json

This server assumes a pre-issued access token. OAuth consent, refresh-token rotation, and tenant selection happen upstream (in your OAuth proxy or secrets layer). When the token expires, Xero returns 401 and the tool surfaces the error verbatim — refresh and retry.

Run

bash
# stdio (default — Claude Desktop, Cursor, etc)npx @codespar/mcp-xero
# HTTP (server-to-server testing)MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-xero

Where clause

Xero's list endpoints accept a where query param for server-side filtering. Examples:

Name.Contains("ACME")IsCustomer==trueStatus=="AUTHORISED" AND Type=="ACCREC"Date>=DateTime(2026,1,1)Contact.ContactID==guid("00000000-0000-0000-0000-000000000000")

Positioning in the CodeSpar ERP catalog

  • Brazil-native: Omie, Conta Azul, Bling, Tiny — NF-e, Simples Nacional, local tax.
  • Global SMB: Xero + QuickBooks — US/UK/AU/NZ/global accounting.

Use Xero for companies headquartered or operating outside Brazil (or with international entities). Use the BR-native servers for the local market.

Docs

Enterprise

Need governance, budget limits, and audit trails for agent payments? CodeSpar Enterprise adds policy engine, payment routing, and compliance templates on top of these MCP servers.

License

MIT

Source: packages/erp/xero/README.md at commit d0a519a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts