MCP server

​

Authentication

• OAuth — for hosted clients like claude.ai and ChatGPT. Add the endpoint URL in your assistant’s connector settings; it walks you through signing in with your normal LAC portal account (Google) and authorizing. On the authorize page you pick which business the connection is for — accounts with access to multiple businesses choose one business per connection — and on the consent screen that follows, the access level (read only, or read and write). OAuth connections act with operator access: they can read the books and statements, upload documents, draft and send invoices, and message Björn — never approve payroll, change company settings, or manage access or keys, no matter your own portal role.
• Portal API key — for clients that send custom headers (Claude Code, Cursor, VS Code, the OpenAI Responses API, anything speaking streamable HTTP). Create one in Settings → API access (see getting started) and send it as a bearer token. Like OAuth connections, keys are minted per business. The tools you see follow the key’s scope: read-scope keys see only the read tools; write-scope keys see the full tool set.

​

Connect a client

​

Claude (web and Desktop)

https://api.app.lastaccountingcompany.com/mcp

​

ChatGPT (web)

​

Claude Code

claude mcp add --transport http lac \
  https://api.app.lastaccountingcompany.com/mcp \
  --header "Authorization: Bearer lac_sk_..."

​

Cursor

{
  "mcpServers": {
    "lac": {
      "url": "https://api.app.lastaccountingcompany.com/mcp",
      "headers": {
        "Authorization": "Bearer lac_sk_..."
      }
    }
  }
}

​

VS Code

{
  "servers": {
    "lac": {
      "type": "http",
      "url": "https://api.app.lastaccountingcompany.com/mcp",
      "headers": {
        "Authorization": "Bearer lac_sk_..."
      }
    }
  }
}

​

OpenAI API (Responses)

response = client.responses.create(
    model="gpt-5",
    tools=[{
        "type": "mcp",
        "server_label": "lac",
        "server_url": "https://api.app.lastaccountingcompany.com/mcp",
        "authorization": "lac_sk_...",
        "require_approval": "always"
    }],
    input="Which invoices are overdue, and by how much?"
)

​

Generic JSON

{
  "mcpServers": {
    "lac": {
      "type": "streamable-http",
      "url": "https://api.app.lastaccountingcompany.com/mcp",
      "headers": {
        "Authorization": "Bearer lac_sk_..."
      }
    }
  }
}

​

Tool reference

​

Read tools (all keys)

​

Write tools (write-scope keys)

​

Security

• Use read-only keys for analysis agents. A key with read scope exposes only read tools — the agent cannot send an invoice or delete a document.
• Invoice approval stays human. A company can require that a draft sales invoice is approved before it goes out. An agent can write the invoice and ask for approval (request_invoice_approval), and get_invoice shows where it stands, but approving and rejecting are not MCP tools at all: they need an interactive admin or approver session. An agent able to approve its own invoice would not be a gate. While a draft is unapproved, send_invoice and finalize_invoice refuse it.
• Partner onboarding stays fail-closed. A write credential can prepare a draft seller profile. It cannot approve its own evidence, activate the profile, or change an active profile. A company admin must review the legal identity, address, partner-owned IBAN, bookkeeping email, signed mandate, and KYC evidence in the portal. The tenant’s own identity or IBAN is refused.
• Keep a human in the loop for destructive tools. Invoice issue, send, retry, credit-note, invoice-draft-delete, and document-delete tools are annotated destructive; configure your client to require confirmation.
• Mind prompt injection when combining servers. If an agent has the LAC server alongside other MCP servers or web access, content fetched from elsewhere could try to steer it into calling LAC write tools. Prefer read-only keys in mixed-tool setups, and review write actions.
• Revoke instantly. Keys are revoked in the portal under Settings → API access; a revoked key loses MCP access immediately. OAuth connections end when you disconnect the connector in the client.
• API keys are company credentials, not personal ones — they keep working if the person who created them leaves. Revoke or rotate keys in Settings → API access when an admin departs.
• Tenant isolation and audit. Every tool call is scoped to the key’s company and audited, like every REST request.

​

What’s deliberately not exposed

• Payroll entirely (read and write) — payroll data and actions require an admin/approver in the portal UI.
• Company settings changes.
• Invoice approval decisions.
• Partner seller activation and active-profile changes.
• Member and access management — inviting people, changing roles.
• API key management — a key can never mint or revoke keys.