MCP100 Assessment

Editorial verdict

Shortlist retained after reviewed Batch 1 re-audit: tool_contract_and_high_impact_operation_control_incomplete.

Reviewed September 23, 2026

Task Fit

Mapped

Specialized workflows

Trust

Status warning

tool_contract_and_high_impact_operation_control_incomplete

Maintenance

Activity observed

A dated repository or package update is available; editorial maintenance review is still pending.

Popularity

Signals available

Visible usage signals are shown for discovery only, not as proof of safety.

Best for

Accounting investigation and controlled bookkeeping workflows in Xero.

Not ideal for

Teams outside the publisher ecosystem or without least-privilege credentials

Avoid if

The connected identity is broader than the task requires
Tool calls cannot be reviewed before consequential mutations

Trade-offs

Accounting records and invoices are financially consequential and may contain personal or tax information.

Evidence scope

Evidence

Current source snapshot

Popularity

370 MCP repository stars

19.2k package downloads / 30 days

Repository identity: XeroAPI/xero-mcp-server

Package identity: @xeroapi/xero-mcp-server · version 0.0.16

@xeroapi/xero-mcp-server: 19,233 downloads / 30 days

Stars observed September 24, 2026 · Downloads observed September 8, 2026

Exact reviewed repository metric.

existing reviewed numeric value preserved pending package refresh

Maintenance

Publisher activity observed June 5, 2026

Current source snapshot

Trust review

Source relationship: First-party MCP

Reviewed September 23, 2026

Sources

GitHub repository ↗Publisher README ↗

Supporting evidence (3)

GitHub issue #209 ↗Source file: package.json ↗Source file: xero-client.ts ↗

Evidence-backed setup

Install & Agents

Choose your MCP client. A client connects to the MCP server; the language model is selected inside that client. Only stored, source-backed configurations are shown.

Claude Code

Local stdio

MCP100 logic checked

claude mcp add xero -e XERO_CLIENT_ID="YOUR_XERO_CLIENT_ID" -e XERO_CLIENT_SECRET="YOUR_XERO_CLIENT_SECRET" -e XERO_SCOPES="accounting.invoices accounting.contacts accounting.settings" -- npx "-y" "@xeroapi/xero-mcp-server@latest"

The publisher connection details were combined with this client's official MCP transport configuration; installation was not executed by MCP100.

Verify safely: Restart Claude Code, confirm xero tools are listed, and perform one read-only test with non-sensitive data.

Uninstall and revoke

Remove xero from Claude Code, restart the client, remove any separately installed package, and revoke dedicated credentials if used.

Evidence & methodology

Publisher-documented setup is not the same as MCP100 execution testing. “MCP100 logic checked” means the stored configuration shape was reviewed, not that third-party MCP software was run.

Evidence checked 2026-08-12

Evidence 1 ↗Evidence 2 ↗

Capability

What it does

Work with authorized Xero accounting contacts, accounts, invoices, and related records.

Finance & PaymentsFinancial Services & InvestingProfessional Services

Representative uses

Accounting investigation and controlled bookkeeping workflows in Xero.

Important limits

Teams outside the publisher ecosystem or without least-privilege credentials

Tools51 toolsView tools

Sales, Contacts & Products17 tools
Manage the customer-facing records that drive everyday accounting. Work with contacts, invoices, credit notes, items, quotes, and payments across both read and write operations as sales move from proposal to settlement.
Accounting & Financial Reports13 tools
Inspect and maintain the bookkeeping records behind financial reporting. Work with accounts, journals, bank transactions, tax rates, trial balance, profit and loss, balance sheet, and aged receivables or payables, then create or update accounting entries where supported.
Payroll & Timesheets14 tools
Run payroll-related time and leave workflows without switching to a separate surface. Inspect employees, global and employee-specific leave types, leave records, balances and periods; create or edit timesheets, approve or revert them, and manage individual timesheet lines.
Organization & Tracking7 tools
Understand the Xero organization and maintain the categories used to segment reporting. Inspect organization details, contact groups, and tracking categories, then create or update categories and options as reporting needs change.

View tool names (51)

list-contacts
list-credit-notes
list-invoices
list-items
list-quotes
list-payments
create-contact
create-credit-note
create-invoice
create-item
create-payment
create-quote
update-contact
update-invoice
update-item
update-quote
update-credit-note
list-accounts
list-manual-journals
list-profit-and-loss
list-tax-rates
list-trial-balance
list-bank-transactions
list-report-balance-sheet
list-aged-receivables-by-contact
list-aged-payables-by-contact
create-bank-transaction
create-manual-journal
update-bank-transaction
update-manual-journal
list-payroll-employees
list-payroll-employee-leave
list-payroll-employee-leave-balances
list-payroll-employee-leave-types
list-payroll-leave-periods
list-payroll-leave-types
list-timesheets
create-payroll-timesheet
update-payroll-timesheet-line
approve-payroll-timesheet
revert-payroll-timesheet
add-payroll-timesheet-line
delete-payroll-timesheet
get-payroll-timesheet
list-organisation-details
list-contact-groups
list-tracking-categories
create-tracking-category
create-tracking-option
update-tracking-category
update-tracking-options

Context Footprint

~10.2K estimated schema tokens

Context impact: High

Estimated token footprint of the MCP tool schemas exposed to the agent.

Approx. estimate

Current official 51-command source surface; payroll availability and OAuth scopes vary by region/account.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: The official server uses Xero OAuth credentials and organization selection.
Permissions: Xero organization permissions and OAuth scopes govern accounting data and mutations.
Data handling: Authorized service data and tool results pass through the MCP server to the connected AI client. Review the publisher and client data policies before using sensitive finance & payments information.
Cost: The MCP integration has no separately verified MCP100 price conclusion. Publisher subscriptions, API usage, compute, storage, and AI-client charges may apply.
Risk and cautions: Accounting records and invoices are financially consequential and may contain personal or tax information. Use a test environment where practical, least-privilege credentials, narrowly enabled tools, and explicit confirmation for mutations. MCP100 did not execute third-party server code during this documentation review.

Related reviewed MCPs

Other options

Stripe MCP

MCP100 Recommended

Use Stripe's remote MCP endpoint for supported payment workflows.

Choose this instead if

Choose Stripe MCP instead if searching Stripe documentation and support knowledge from an MCP client.

Use Stripe's remote MCP endpoint for supported payment workflows.

Compare with Xero MCP Server View Stripe MCP details

PayPal MCP

MCP100 Recommended

Use supported PayPal developer capabilities through MCP.

Choose this instead if

Choose PayPal MCP instead if querying invoices, orders, subscriptions, disputes, and shipment information.

Use supported PayPal developer capabilities through MCP.

Compare with Xero MCP Server View PayPal MCP details

Shopify Storefront MCP

MCP100 Recommended

Connect shopping agents to a Shopify store's public catalog, cart, and policy tools.

Choose this instead if

Choose Shopify Storefront MCP instead if searching and comparing products from a specific Shopify storefront.

Connect shopping agents to a Shopify store's public catalog and policy tools; use UCP Cart MCP for cart workflows.

Compare with Xero MCP Server View Shopify Storefront MCP details

Read publisher documentation

Publisher documentation

MCP100 source-backed summary

A concise MCP100 summary built from the reviewed publisher sources. It is not a publisher README; use the original link for the latest full documentation.

View original documentation ↗

Xero MCP Server

Work with authorized Xero accounting contacts, accounts, invoices, and related records.

What it can help with

Accounting investigation and controlled bookkeeping workflows in Xero.

Important limits

Teams outside the publisher ecosystem or without least-privilege credentials

Loading optional publisher documentation…

FAQ

What can Xero MCP do?

Work with authorized Xero accounting contacts, accounts, invoices, and related records.

Can Xero MCP read or update invoices and accounting records?

Yes, for the accounting objects and write operations exposed by the reviewed Xero MCP toolset. The connected Xero tenant and OAuth scopes determine which organizations and records the agent can read or change.

Does Xero MCP work with Codex?

Yes. MCP100 reviewed an evidence-backed setup for Codex, but has not independently verified it with a live runtime test.

How does Xero MCP authenticate to an accounting organization?

The official server uses Xero OAuth credentials and organization selection.

What are the risks of giving an AI agent access to Xero?

Accounting records and invoices are financially consequential and may contain personal or tax information. Use a test environment where practical, least-privilege credentials, narrowly enabled tools, and explicit confirmation for mutations. MCP100 did not execute third-party server code during this documentation review.

Is this an official MCP?

Xero is listed as First-party MCP in MCP100’s current evidence.

Current official resources: