Model Context Protocol (MCP) Server + Xero OAuth

What is Model Context Protocol (MCP) Server + Xero OAuth?

A reference MCP server that supports remote connections and integrates Xero OAuth, deployable to Cloudflare Workers. It acts as an OAuth server for MCP clients and an OAuth client for Xero, allowing developers to build authenticated MCP tools linked to a user’s Xero account.

How to use Model Context Protocol (MCP) Server + Xero OAuth?

Clone the repository, install dependencies (npm install), create a Xero OAuth app, and set secrets via Wrangler (XERO_CLIENT_ID, XERO_CLIENT_SECRET, COOKIE_ENCRYPTION_KEY). Set up a KV namespace, then deploy with wrangler deploy. Test the remote server using the MCP Inspector at https://mcp-xero-oauth.<your-subdomain>.workers.dev/sse. Configure clients (e.g., Claude Desktop) using the command npx mcp-remote <SSE endpoint>. Local development instructions are also provided.

Key features of Model Context Protocol (MCP) Server + Xero OAuth

• Remote MCP connections with built-in Xero OAuth authentication
• Acts as OAuth server for MCP clients and client for Xero
• Deployed on Cloudflare Workers using durable objects and KV storage
• Automatic token refresh (Xero tokens expire after 30 minutes)
• Multi-tenant support for Xero organizations
• Role-based tool access (e.g., “generateImage” restricted to allowed users)

Use cases of Model Context Protocol (MCP) Server + Xero OAuth

• Letting users sign in with Xero to access accounting tools via MCP clients
• Providing a template for integrating any OAuth provider with a remote MCP server
• Restricting sensitive tools (e.g., image generation) to specific Xero users
• Deploying a production-grade, self-hosted MCP server with authentication

FAQ from Model Context Protocol (MCP) Server + Xero OAuth

What runtime and dependencies are required?

The server runs on Cloudflare Workers using Durable Objects and a KV namespace. You must have a Cloudflare account and install wrangler. The MCP remote client (mcp-remote) is used for clients that do not support HTTP+SSE natively.

How is user authentication handled?

Users authenticate via Xero’s OAuth flow. The server securely stores tokens and authentication state in KV storage. All authenticated Xero users can access basic tools; the “generateImage” tool is restricted to email addresses listed in ALLOWED_USERS.

Are there any known limitations with MCP clients?

Claude Desktop does not yet fully support remote MCP servers and may show error messages, but tools remain available. Cursor supports HTTP+SSE but not authentication, so you must use mcp-remote to wrap the connection. Other clients like Windsurf can be configured with the same JSON used for Claude.

What Xero scopes are requested by default?

The default development configuration requests scopes: openid, profile, email, accounting.settings, accounting.transactions, and accounting.contacts.

Where is authentication data stored?

OAuth tokens and session state are stored in a Cloudflare Workers KV namespace created during setup. The COOKIE_ENCRYPTION_KEY secret encrypts cookies used in the OAuth flow.