Xero Remote MCP Goes GA: What It Opens for AI Agents

Xero made its Remote MCP server generally available on October 13, 2026, replacing the self-hosted-only setup that had been the sole way to connect Claude, Cursor or another agent to live Xero data. The practical change is simple: instead of running, patching and authenticating a local process per customer, a commercial app points its agent at a single hosted URL and signs in with standard OAuth. For ISVs and finance teams building on Xero, that collapses a deployment step that used to block every new customer rollout.

What changed when Xero Remote MCP went GA?

Before October 2026, the only official way to let an AI assistant read or write Xero data was XeroAPI/xero-mcp-server, a local server you ran yourself via npx, authenticated with a Custom Connection, and kept updated on your own machine. That local server still works, but it has a geographic limit worth knowing: Custom Connections are only available in the US, UK, Australia and New Zealand. Remote MCP removes that limit because it authenticates through a standard Xero app using PKCE sign-in instead, so it works everywhere Xero operates.

Xero Remote MCP is the same tool catalogue, moved to infrastructure Xero runs and patches for you. You add a URL, your user signs in once, and the server is always on the current version. For a developer shipping an app to hundreds of customer organizations, that is the difference between "write and maintain per-tenant deployment code" and "point at one endpoint."

What is Xero Remote MCP, exactly?

Xero Remote MCP is a hosted Model Context Protocol server, run and maintained by Xero, that lets any MCP-compatible AI client read and write live Xero accounting data over a single URL instead of a locally installed process. The hosted endpoint is https://api.xero.com/mcp/v1, and it works with any client that supports the MCP standard, including Claude Desktop, Claude Code, Cursor and VS Code.

Model Context Protocol itself is the open standard, originally published by Anthropic, that defines how an AI assistant discovers and calls external tools. An MCP server is effectively a menu of callable actions with instructions attached; point a client at one and the model can call list_invoices or create_contact the same way it would call any other function.

Local vs. remote, side by side:

	Local MCP server	Remote MCP server
Where it runs	Your machine, via npx	Hosted by Xero
Auth	Custom Connection (client ID/secret)	Standard Xero app, PKCE sign-in
Geographic availability	US, UK, Australia, New Zealand only	Everywhere
Updates	You patch it	Xero maintains it
Multi-org support	One organization per connection	Multiple organizations, per-user consent

How do you connect an AI agent to Xero Remote MCP?

Setup is a configuration, not a deployment. In Claude Code, for example, the whole thing is one command, documented by Xero:

Other clients follow the same shape: register a Xero Developer app with PKCE as the authorization method, point the client's remote-server setting at the hosted URL, and let the user complete the OAuth sign-in. There is nothing to install, nothing to keep patched, and no extra charge for commercial apps on the Core plan or above. Apps still on the Starter plan can try it against a demo organization before upgrading.

What can the 39 Remote MCP tools actually do?

Remote MCP launched at GA with 39 tools, the same catalogue that ran through the closed beta, grouped into four jobs:

• Invoicing basics - invoices, bank transactions, contacts, manual journals, accounts, tax rates, organization details
• Full accounting - credit notes, quotes, items, tracking categories
• Reporting - profit and loss, balance sheet, trial balance, aged receivables and payables
• Payments - creating and listing payments

That is a write surface, not a read-only reporting feed. An agent with Remote MCP access can draft an invoice or create a payment, not just summarize what already exists. That capability is exactly what makes the scope question below the one that matters.

What's the real integration catch: scope, not setup

Xero's own documentation is direct about what a Remote MCP session is: it uses the same OAuth 2.0 sign-in, permissions and rate limits as the rest of the Xero API. That means an agent connected through Remote MCP acts with the full scope the connected user consented to, not a reduced read-only slice by default. If the signed-in user can issue a credit note or record a payment by hand, an agent wired to that session can do the same thing, and it can do it in seconds, in bulk, without a human re-reading each line first.

Rate limits are the existing Xero API limits: 1,000 calls per day per organization on the Starter plan, and 5,000 per day per organization on Core and above. That is a real constraint for an agent doing high-frequency reconciliation work across many client organizations, and it is worth modeling before you commit an agent workflow to Remote MCP at scale, because you inherit the ceiling the human-facing API already has.

Xero shipped a parallel signal of intent the same week: a connected app for Google Gemini that brings live Xero data into Gemini conversations, alongside existing integrations with Claude, Claude for Small Business and ChatGPT. In that Gemini app specifically, Xero requires explicit user confirmation before any operation that modifies financial data, such as issuing an invoice or sending a payment reminder. That confirm-before-write pattern is a product decision Xero built into the Gemini app's UX, not a property of the Remote MCP protocol itself, which is exactly why teams building directly on Remote MCP need to design their own approval gate rather than assume one is enforced for them.

How should ISVs and SMEs gate agent permissions on Xero data?

Treat a Remote MCP connection the way you would treat handing a new bookkeeper full login access: define the approval boundary before the agent runs, not after something posts to the ledger.

• Scope the connecting app's permissions to the job. If the agent only needs to read aged receivables, don't authorize an app with payment-creation scopes. Xero inherits the same granular OAuth scopes as its REST API, so the agent should request the narrowest set that does the job.
• Put a human or a rules check between "draft" and "post." Nothing in Remote MCP enforces a confirmation step for third-party clients the way Xero built one into its own Gemini app. If your agent can create a payment, your application layer, not Xero's server, is where you add the "does this match a known vendor and PO" check before it executes.
• Use the demo organization to prove the agent's behavior first. Starter-plan apps already get this for free; Core-plan teams should still stand up a sandbox org and run the agent against it before pointing it at a live customer ledger.
• Log every write, not just every read. Reporting tools are low risk; invoicing and payment tools change money. Audit trail discipline on the write path matters more than on the read path, and it is the part teams skip when a feature ships as "just add a URL."

This is the same governance pattern we've written about for connecting AI agents to Docusign through MCP: a hosted MCP endpoint removes the deployment friction, but it hands the agent the same permission ceiling a human user has, so the approval layer has to live in how you scope and supervise the agent, not in the transport. The teams already running Claude agents against the Docusign MCP in production learned this the hard way on the agreement side; the same lesson now applies on the finance side.

Xero Remote MCP vs. the Gemini connected app: two doors, one ledger

Xero now has at least two live ways for AI to touch an organization's books: a general-purpose MCP server any client can connect to, and a purpose-built connected app inside Google Gemini's interface. They read from and write to the same Xero data, but they are not interchangeable integration choices.

Remote MCP is the developer surface: you pick the client, you control the scopes you request, and you own whatever confirmation workflow your application adds. The Gemini app is a packaged consumer experience: Xero has already decided the confirmation UX for you. If you are building a custom agent for your own tooling or for customers, Remote MCP is the one you integrate against. If your users are already working inside Gemini and just want a faster way to check cash position, the connected app is the better fit, and it needs no integration work at all.

FAQ

Is Xero Remote MCP free to use? Yes, for commercial apps on the Core plan or above, Remote MCP access is included at no extra charge. Data pulled through it counts toward the app's existing API data egress volume, the same as regular Xero API calls.

What is the Xero Remote MCP server URL? https://api.xero.com/mcp/v1, documented by Xero as the single endpoint any MCP-compatible client connects to after a PKCE sign-in.

Does Xero Remote MCP replace the local MCP server? No. The local, self-hosted xero-mcp-server still exists and is still useful where a Custom Connection to a single organization is enough. Remote MCP is the option when you need multi-organization, no-maintenance, globally available access.

What are the rate limits on Xero Remote MCP? The same as the Xero API: 1,000 calls per day per organization on the Starter plan, 5,000 per day per organization on Core and above.

Can a Remote MCP agent write data, or is it read-only? It can write. The 39-tool catalogue includes creating invoices, credit notes, contacts, manual journals and payments, not just reporting tools. Any write scope the connected user has, the agent can exercise.

What this means for your Xero integration roadmap

Xero Remote MCP going GA is a real deployment win: one URL and an OAuth flow instead of a per-customer local process to build, ship and patch. The part that deserves your attention before you connect an agent to production data is scope, not setup: the agent inherits the full permission set of whoever signed in, and Xero's own confirm-before-write pattern lives inside its Gemini app, not inside the protocol. If you are weighing where an agent-driven Xero integration fits alongside a broader Docusign IAM or agreement automation rollout, see how fluidlabs implements agentic integrations in production or browse the Docusign IAM resources library for the governance patterns we use on the agreement side today.