# Overview > What the Tabba MCP server is, and what an agent can and cannot do with it. Source: https://www.tabba.io/developers/mcp Tabba speaks [MCP](https://modelcontextprotocol.io). Point an AI client at one URL and it reads Tabba Sales as you: your customers, invoices, recurring series, registered work and revenue recognition. It can also plan changes to them. Nothing is written until you confirm a plan. ``` https://www.tabba.io/api/mcp ``` ## What it is [#what-it-is] A remote MCP server over streamable HTTP, and stateless: every call is one `POST` that carries its own credential and is answered in JSON. There is no session to keep alive and no local process to run. `GET` and `DELETE` answer `405`, so a client that insists on opening an event stream first cannot use it. The server names itself `tabba`. Its tools describe themselves over `tools/list`, and the list is built for each request from two things: the scope of your token and your role in the company. Ask your client what it can do and the answer is the catalogue you actually have. The server reaches Sales. Nothing of Finance is on it: no tool reads a voucher, a bank transaction or an approval. ## One way to connect: OAuth [#one-way-to-connect-oauth] Every client below connects the same way. Give it the URL, sign in to Tabba in the browser it opens, pick the company it will reach, and approve. The client keeps the token and refreshes it. You never handle a secret, and nothing you put in a config file is one. The consent page is also how the server learns who you are, which is what lets it answer "my customers" with your customers and not the company's. See [Auth and scopes](/developers/mcp/auth). > [!WARNING] > **There is no path without a browser** > > A connection starts on the consent page, which takes a signed-in browser > session. There is no key, flag or grant that skips it, and an API key is > not accepted at `/api/mcp`. Work that runs unattended (CI, a scheduled job, > your own backend) belongs on the [REST API](/developers/api) at `/api/v1`, > which authenticates with a key and has no consent step. ## What an agent can do [#what-an-agent-can-do] Three kinds of tool, each behind a scope of the token. Which of them you are offered also follows your role in the company. Of the five roles, the organisation admin, the admin and the bookkeeper act as an admin here; the auditor reads as an admin and writes nothing; the standard user works on their own lines. | Tools | Token scope | Admin | Auditor | Standard user | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ----- | ----------- | -------------------------- | | Read your own work: `get_my_work` | `mcp:read` | Yes | Yes | Yes | | Read customers, invoices, recurring series and credit notes: `list_customers`, `get_customer`, `list_invoices`, `get_invoice`, `list_series`, `get_series`, `get_series_occurrences`, `list_credit_notes`, `get_credit_note` | `mcp:read` | Yes | Yes | Yes, within their own work | | Read revenue recognition, yourself and the configuration: `get_recognition`, `get_user`, `get_config` | `mcp:read` | Yes | Yes | Yes | | Read the product catalog, the people of the company and a month-end accrual entry: `list_products`, `get_product`, `list_users`, `get_accruals` | `mcp:read` | Yes | Yes | Not offered | | Plan a work registration: `plan_register_work` | `mcp:write` | Yes | Not offered | Yes, their own work | | Plan customers, products, draft invoices and recurring series: `plan_upsert_customer`, `plan_upsert_product`, `plan_create_invoice`, `plan_delete_invoice`, `plan_create_series`, `plan_cancel_series`, `plan_setup_from_contract` | `mcp:write` | Yes | Not offered | Not offered | | Plan what books and sends: `plan_issue_invoice`, `plan_issue_occurrence`, `plan_create_credit_note` | `mcp:issue` | Yes | Not offered | Not offered | | Apply a confirmed plan: `commit` | `mcp:write` | Yes | Not offered | Yes | A tool that is not offered is not in `tools/list` and cannot be called. That gives these catalogue sizes: | Token scope | Admin | Auditor | Standard user | | ----------- | -------- | -------- | ------------- | | `mcp:read` | 17 tools | 17 tools | 13 tools | | `mcp:write` | 26 tools | 17 tools | 15 tools | | `mcp:issue` | 29 tools | 17 tools | 15 tools | > [!NOTE] > **Names, not ids** > > A tool takes the reference a person would use: a bare name such as > `Bredgade ApS`, `ext:your-id`, or the id. For a person it also takes > `email:someone@example.com` and `me`, which is you. A name that matches > several records is answered `AMBIGUOUS_REFERENCE` with the candidates, never > a guess. A recurring series and a credit note have no name: a series is > found by its customer and a credit note by its invoice. ## Your work is the default answer [#your-work-is-the-default-answer] A read answers from the work you hold a place on, not from the whole company. `get_my_work` returns your open lines in one call, grouped by customer or recurring series and ranked by what needs attention. The lists of customers, invoices, recurring series and credit notes take a `scope` argument that defaults to `mine`, and every scoped answer opens by naming the view that produced it. Widening is yours to ask for, and what you may ask for follows your role. An admin and an auditor may ask for `all`, the whole company. A standard user reads within their own work on every tool: a record outside it is answered as not found. Connecting a client gives it no more than you already have in Tabba. ## Beyond tools [#beyond-tools] Three more MCP surfaces come with the connection. Clients expose them differently, often as slash commands or as context you attach. * **Two prompts.** `setup_invoicing_from_contract` turns a contract into the invoicing it calls for. `monthly_close` starts from the work you still have outstanding and reviews what is due this period. Each is worded from the tools your connection has, so neither sends the agent to a tool you are not offered. Where the connection cannot plan a step, the prompt says that nothing is written from there and ends with what is left for a person to do. * **A resource.** `tabba://config` carries the company's name, its base currency and the ledger accounts the month-end accrual moves. It is the same answer as `get_config`. * **A form.** The contract plan, an admin's tool, can ask its open questions as a form in a client that renders MCP Apps. See [Plan and commit](/developers/mcp/propose-commit). ## What it cannot do [#what-it-cannot-do] * Write anything without a separate `commit` of a plan. See [Plan and commit](/developers/mcp/propose-commit). * Exceed the scope of the token or your role. Issuing, which books in the accounting system and sends to a customer, takes `mcp:issue` and an admin. * Run without a person. Every request is made as one. * Register a colleague's work for a standard user. An admin may, by naming a person who holds a place on the line. * Change the lines of a recurring series that exists, skip or restore an occurrence, or make a draft series active. No plan does these. They are done in Tabba. * Invite a user, change a role, connect a company or create an API key. No tool does these either. ## Connect your client [#connect-your-client] - [claude.ai](/developers/mcp/claude-ai): Add Tabba as a custom connector. - [Claude Code](/developers/mcp/claude-code): One CLI command, then the OAuth flow from /mcp. - [ChatGPT](/developers/mcp/chatgpt): A custom MCP connector, added by its URL. - [Cursor](/developers/mcp/cursor): A short mcp.json entry, per project or per user. To write the integration yourself, or to run it unattended, use the [REST API](/developers/api).