
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@codespar/mcp-xero
Advanced tools
MCP server for Xero — global cloud accounting (UK/AU/NZ leader, expanding in US). Contacts, invoices, payments, items, accounts, reports.
MCP server for Xero — global cloud accounting for SMBs.
Xero is the #2 global SMB ERP and the leader in the UK, Australia, and New Zealand, with rapid expansion in the US. Paired with QuickBooks, the two platforms cover roughly 80% of global SMB accounting. For LatAm SaaS serving US/UK/AU/NZ customers or with international subsidiaries, Xero is the essential complement to our Brazil-native ERPs (Omie, Conta Azul, Bling, Tiny).
| Tool | Purpose |
|---|---|
create_contact | Create a Xero contact (customer or supplier — Xero uses one unified Contact object with IsCustomer/IsSuppli... |
get_contact | Retrieve a single Xero contact by ContactID (UUID). |
list_contacts | List Xero contacts. |
create_invoice | Create an invoice in Xero. |
get_invoice | Retrieve a single invoice by InvoiceID (UUID) or InvoiceNumber. |
list_invoices | List invoices with optional Xero where-clause filtering. |
email_invoice | Email an AUTHORISED invoice to the contact's email address on file. |
create_payment | Record a payment against an invoice or credit note. |
create_item | Create a Xero inventory/product item. |
list_items | List all items/products in the Xero tenant. |
list_accounts | List the Xero chart of accounts. |
update_contact | Update an existing Xero contact. |
archive_contact | Archive a Xero contact by setting ContactStatus=ARCHIVED. |
update_invoice | Update an existing invoice. |
void_invoice | Void an invoice by setting Status=VOIDED. |
get_payment | Retrieve a single payment by PaymentID. |
list_payments | List payments recorded in Xero. |
create_bank_transaction | Create a bank transaction (SPEND = money out, RECEIVE = money in) directly on a bank account — for transact... |
list_bank_transactions | List bank transactions (spend/receive entries on bank accounts). |
list_organisations | Retrieve the Xero organisation(s) the access token has access to — returns name, base currency, country, fi... |
list_tax_rates | List tax rates configured in the Xero tenant. |
create_credit_note | Create a credit note. |
list_credit_notes | List credit notes. |
get_balance_sheet | Retrieve the Balance Sheet report for the tenant. |
npm install @codespar/mcp-xero
XERO_ACCESS_TOKEN="..." # OAuth2 bearer access token (required, secret)
XERO_TENANT_ID="..." # Xero tenant/organization id (required)
Xero uses OAuth2. Every request includes:
Authorization: Bearer <XERO_ACCESS_TOKEN>
Xero-tenant-id: <XERO_TENANT_ID>
Accept: application/json
Content-Type: application/json
This server assumes a pre-issued access token. OAuth consent, refresh-token rotation, and tenant selection happen upstream (in your OAuth proxy or secrets layer). When the token expires, Xero returns 401 and the tool surfaces the error verbatim — refresh and retry.
# stdio (default — Claude Desktop, Cursor, etc)
npx @codespar/mcp-xero
# HTTP (server-to-server testing)
MCP_HTTP=true MCP_PORT=3000 npx @codespar/mcp-xero
Xero's list endpoints accept a where query param for server-side filtering. Examples:
Name.Contains("ACME")
IsCustomer==true
Status=="AUTHORISED" AND Type=="ACCREC"
Date>=DateTime(2026,1,1)
Contact.ContactID==guid("00000000-0000-0000-0000-000000000000")
Use Xero for companies headquartered or operating outside Brazil (or with international entities). Use the BR-native servers for the local market.
MIT
FAQs
MCP server for Xero — global cloud accounting (UK/AU/NZ leader, expanding in US). Contacts, invoices, payments, items, accounts, reports.
The npm package @codespar/mcp-xero receives a total of 16 weekly downloads. As such, @codespar/mcp-xero popularity was classified as not popular.
We found that @codespar/mcp-xero demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.