Pro · opt-in

Experi MCP for trusted AI agents

Give a compatible agent structured tools for business reporting, clients and invoices without sharing your Experi password. You choose every permission and can revoke access immediately.

Start a Pro trial Feature overview

Before you connect

Use a trusted client

Review the client's privacy and data retention terms before allowing it to read business records.

Choose exact access

Experi shows every requested scope. Clear permissions the client does not need before you approve.

Disconnect instantly

Disconnect one OAuth app or disable MCP to revoke every active app and manual credential.

Set up the connection

1Add the remote MCP endpoint below to a client that supports OAuth discovery and dynamic client registration.
2The client opens Experi sign-in and a permission screen. Approving enables MCP if it is currently off.
3Review the client name and clear any scope it does not need. Experi issues short-lived access tokens and rotates refresh tokens automatically.
4Ask the client to list tools before making changes. Review recipients, dates, totals and payment details before approving a write.

Remote MCP endpoint

https://www.experi.co.uk/api/mcp

{
  "mcpServers": {
    "experi": {
      "url": "https://www.experi.co.uk/api/mcp"
    }
  }
}

If a client does not support OAuth, Settings offers a manual scoped credential with a custom Authorization header. Never use an Experi REST API key at the MCP endpoint.

Available tools and scopes

Tool	Required scope	Behaviour
get_business_summary	`reporting:read`	Invoice, payment, overdue and client totals, grouped by currency.
list_clients	`clients:read`	Search and paginate clients.
get_client	`clients:read`	Read one client and recent invoice summaries.
create_client	`clients:write`	Create a client after approval.
update_client	`clients:write`	Update an existing client.
list_invoices	`invoices:read`	Filter and paginate invoices.
get_invoice	`invoices:read`	Read an invoice, line items and payment history.
create_invoice	`invoices:write`	Create a draft invoice; it is not sent.
send_invoice	`invoices:send`	Email a reviewed invoice to its stored client and billing addresses.
record_invoice_payment	`payments:write`	Record a confirmed full or part payment.

Safeguards

MCP is off by default for every account.
Only active Pro accounts can authenticate.
OAuth requires PKCE S256 and exact redirect matching.
Access tokens last 15 minutes and refresh tokens rotate on every use.
Refresh-token reuse revokes the whole connection.
Tools outside the approved scopes are not advertised.
Every read and write is tenant-scoped on the server.
Writes use durable idempotency receipts.
Create, send and payment tools require confirmation fields.
Requests have distributed rate limits and size limits.
Audit records do not store request bodies or plaintext tokens.
Disabling MCP revokes all connections.