Xero MCP Server (Gabriel Gallagher)
Xero accounting data management through the Model Context Protocol.
Data last scanned today · Reviewed today
Overview
This server bridges the gap between your AI assistant and Xero's business management platform. It leverages the Model Context Protocol to allow AI agents to interact directly with accounting data through structured API calls.
Our verdict
With a security score of 34/100, this server is classified as high-risk. Key contributing factors include the lack of an editorial review and the fact that it is a community-maintained project rather than an official Xero release. Users should be cautious, as critical aspects like authentication methods and read-only mode permissions have not yet been independently verified for security.
- Supports Xero OAuth2 authentication with custom connections
- Directly integrates with invoice and contact management features
- Limited supply-chain surface with only five direct dependencies
- Includes documentation for setting up demo company testing
- High-risk security score of 34/100
- Community-maintained rather than official vendor support
- No audit performed on authentication or read-only modes
- Last repository commit was 251 days ago
Setup
{
"mcpServers": {
"gabrielgallagher-xero-mcp-server": {
"args": [
"-y",
"@xeroapi/xero-mcp-server"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| list-accounts | Retrieve a list of accounts | low |
| list-contacts | Retrieve a list of contacts from Xero | low |
| list-credit-notes | Retrieve a list of credit notes | low |
| list-invoices | Retrieve a list of invoices | low |
| list-items | Retrieve a list of items | low |
| list-organisation-details | Retrieve details about an organisation | low |
| list-profit-and-loss | Retrieve a profit and loss report | low |
| list-quotes | Retrieve a list of quotes | low |
| list-tax-rates | Retrieve a list of tax rates | low |
| list-payments | Retrieve a list of payments | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What authentication methods does the Xero MCP server support?
The server supports two authentication modes: Custom Connections using a client ID and secret, or a Bearer Token. Note that if a bearer token is provided, it will take precedence over the client ID configuration.
›How can I prevent the MCP server from modifying my Xero data?
You can enable read-only mode by setting the environment variable XERO_READONLY to true. This enforces a limitation at the tool level, preventing the server from executing create, update, or delete operations.
›Are there specific regional requirements for payroll features?
Yes, to utilize payroll-specific queries, your Xero organisation must be based in either New Zealand or the UK.
›What are the environment prerequisites for running this server?
You must have Node.js version 18 or higher installed, along with either npm or pnpm.
›What should I do if I am using Node Version Manager (nvm) with Claude Desktop?
Instead of using 'npx' as the command, you should provide the absolute path to your nvm-installed npx executable in your claude_desktop_config.json file.
Changelog
- Improvedv0.0.14
2026-01-05
Badge
Maintain this server? Add the live badge to your README.