Xero MCP Server: Connect Xero to Claude

Xero is the dominant accounting platform for Australian SMBs, used by over 1 million businesses. Connecting it to Claude via MCP transforms it from a data entry system into an active business intelligence layer — one your team can query in plain English without exporting spreadsheets or waiting for month-end reports.

What is Xero?

Xero is a cloud-based accounting platform widely adopted across Australia and New Zealand. It covers invoicing, bank reconciliation, payroll, expense claims, and financial reporting. Xero is the de facto accounting standard for Australian SMBs, accounting firms, and many mid-market businesses.

What is MCP and why does it matter for Xero users?

The Model Context Protocol (MCP) is an open standard created by Anthropic that defines how AI models connect to external tools and data sources. Where traditional integrations are point-to-point (a Zapier zap moves data from A to B on a fixed schedule), MCP is agent-native: Claude decides when to query Xero, what to ask for, and how to use the response — based on your natural language instructions.

For Xero users, this means you can ask Claude questions like:

• “Summarise our outstanding invoices over 30 days and draft a follow-up email for each client”
• “What was our gross margin last quarter compared to the same period last year?”
• “Which expense categories are trending up this month?”

And receive answers drawn directly from live Xero data — no exports, no manual lookups.

The key difference from other integration approaches: MCP maintains a persistent connection that Claude can query multiple times within a single conversation. Ask a follow-up, drill into a specific client, cross-reference with another data source — the context stays intact throughout.

Current state of Xero + Claude integration

As of April 2026, there is no official Xero MCP server. Xero has not announced one on their developer roadmap. Community-built servers exist on GitHub — the most maintained is the xero-mcp-server project — but most lack production-grade features: proper OAuth token refresh handling, rate limiting that respects Xero’s 60 req/min cap, structured error responses Claude can interpret, and monitoring.

Lightning Ventures maintains a tested fork with all of the above, plus Australian-specific endpoint coverage for GST, BAS-relevant tax types, and multi-currency support common in AU/NZ businesses.

How it works

The Xero + Claude integration runs on your own infrastructure via a locally-deployed MCP server. Lightning Ventures handles setup end-to-end: OAuth 2.0 configuration with the correct read-only scopes, token refresh handling, rate limiting to stay within Xero’s 60 req/min cap, monitoring, and an Australian Privacy Act compliance review. Once deployed, Claude has live access to your Xero data with no copy-paste, no exports, and no third-party system in the middle.

Typical deployment timeline is 3 business days for a standard read-only setup, or 2–3 weeks for a Custom Build with write-back workflows, multi-entity support, or payroll coverage.

Security and compliance considerations

Data flow: Your Xero data travels from Xero’s OAuth-secured servers → to your locally-run MCP server → to Claude’s context window within a single query. The MCP server does not store or cache Xero data between sessions.

OAuth scopes: Request only the scopes your use case requires. Read-only access is sufficient for reporting, summarisation, and analysis. Never grant write scopes unless you have a specific workflow that requires them — and if you do, implement approval gates before any write operation executes.

Australian Privacy Act (APP 8): The locally-hosted architecture means no overseas disclosure of Xero data occurs during normal MCP operation. Claude’s API calls do send query context (which may include financial figures and client names) to Anthropic’s US-based servers. If your Xero data contains personal information about Australian residents, review Anthropic’s data processing agreements against your Privacy Policy obligations. Lightning Ventures recommends data minimisation — only query the specific data fields needed for each use case.

Token storage: Store refresh tokens in environment variables or a secrets manager (AWS Secrets Manager, 1Password Secrets Automation). Never commit .env files or .xero-tokens.json to source control.

Network security: For production deployments, run the MCP server behind your firewall or on a private VPC. The server should not be publicly accessible on the internet.