Invoiso MCP server

Invoiso speaks the Model Context Protocol, so an MCP client — Claude, ChatGPT, or anything else that speaks it — can read and work with the invoices, bills, contacts, stock and reports in your invoiso workspace. This page is what you need to connect one.

The endpoint

https://www.invoiso.com/api/mcp

Transport   Streamable HTTP (POST, JSON-RPC 2.0)
Auth        OAuth 2.1 — see below
Server      invoiso 0.1.0
Protocol    2025-06-18, 2025-03-26, 2024-11-05

Most people only need the URL. Add it as a custom connector in ChatGPT or a remote MCP server in Claude, then sign in to invoiso as usual — no API key is needed. The client discovers how to authenticate on its own: an unauthenticated call answers 401 with a WWW-Authenticate header pointing at https://www.invoiso.com/.well-known/oauth-protected-resource, which names the authorization server and the scopes to ask for.

Connecting

1. Add https://www.invoiso.com/api/mcp to your client as a remote MCP server.
2. The client sends you to invoiso’s sign-in. Sign in as you normally would.
3. Approve the access the consent screen describes. It names the workspace you are connecting.
4. You are connected. Ask your client something about your books — “what did I invoice last month?” is a good first question, because it needs no permissions beyond reading.

The scopes requested are openid, email, profile and user:org:read. The last one is what tells us which workspace you are connecting; without it the server refuses rather than guessing — see below.

Which workspace you are connected to

You are connected to whichever workspace was active in your browser when you approved the connection. The consent screen names it. This is the same rule the browser follows — a session is in one workspace at a time — and it means that switching workspaces in invoiso does not switch what your MCP client sees.

To point a client at a different workspace: switch to that workspace in invoiso first, then remove and re-add the connection in your client. It will take you through consent again, and the new token carries the new workspace.

If the server cannot tell which workspace a token is for, it answers 403 with error="insufficient_scope" naming the scope to request, rather than picking one. Picking would be worse than refusing: the plausible wrong answer is your empty personal workspace, and you would conclude invoiso had lost your books.

What your plan can do

Everything is available to the assistant inside invoiso on every plan. What changes over an external MCP client is whether it may write.

A read-only connection is not a reduced client — it is every tool that only reports. Writing from an external client starts at Business. Ask a read-only connection to change something and it says so in a sentence and changes nothing, rather than failing obscurely.

What the tools do

There are 137 tools. 54 of them only report; the rest write. Every tool carries the three annotations MCP defines — readOnlyHint, destructiveHint and openWorldHint — so your client can ask you before it does anything irreversible. 12 of them can change something outside invoiso: send an email, publish a payment page, write into Xero or QuickBooks. Those are the ones worth having your client confirm.

Money is always stated twice

A workspace can hold documents in several currencies. Any tool returning an amount returns it in the document’s own currency andin the workspace’s reporting currency, converted at the rate pinned to that document. Only the second is comparable across documents, and the server’s instructions tell the model never to add two amounts in different currencies. Where no exchange rate covered a date, the reporting figure is null rather than zero.

Totals come from the reporting tool

run_reportanswers “how much” questions. Listing tools list; adding up a list is not the same arithmetic — drafts and credit notes are counted differently — and each tool’s description says which it is.

What the server reads, and what it keeps

A tool call reads and writes your workspace’s own data: your invoices, bills, contacts, products and settings. Responses carry the business records the tool was asked about — which for a contact means their name, and may mean an email address, a postal address or a tax registration number, because those are what appear on an invoice.

The server keeps no separate copy of a conversation, sends no tool response anywhere but back to the client that asked, and never returns credentials, API keys or OAuth tokens — yours or a connected service’s. What we do with data generally, including which third parties receive what, is in the privacy policy, and the terms apply to this connection as to any other.

Disconnecting

Remove the connection in your MCP client. That is enough: the token is the only thing that grants access, and nothing on our side keeps working without it. Deleting your invoiso account removes everything behind it — see the privacy policy for what that means and how long it takes.

Protocol details

The server negotiates 2025-06-18, 2025-03-26 and 2024-11-05, answering with the newest it and the client both understand. An unrecognised version is answered with the newest we support rather than refused, which is what the specification asks for.

Authorization follows OAuth 2.1 with PKCE. Discovery is RFC 9728 protected-resource metadata at https://www.invoiso.com/.well-known/oauth-protected-resource, and the authorization server publishes both RFC 8414 and OpenID Connect discovery documents. Clients register themselves through dynamic client registration (RFC 7591), which is why the steps above ask you for nothing but a URL. The registration endpoint is advertised on the RFC 8414 document only; a client that reads just the OpenID Connect one will not find it, and needs the predefined client id below.

If your client cannot register itself and asks for a client id, mail support@invoiso.com and we will give you one. Leave the client secret empty — the client is public and authenticates with PKCE.

Tokens are verified against our own instance’s JWKS and must carry our issuer and the scope that names your workspace. A token minted by another invoiso deployment, or by another Clerk instance, is refused. A token from a different application registered against this instance is not distinguishable from ours and is accepted — which is what open registration means, and why the consent screen naming the application asking is worth reading before you approve it.

If something is wrong

Mail support@invoiso.com with what your client asked and what came back. A 401 usually means the connection needs re-approving; a 403 naming a scope means the client did not ask for it; and a refusal that names your plan is the read-only gate above, not a fault.