Skip to content

Boxkite — Xero Backup & Export

by getboxkite.com · remote · no sign-in to list tools · v1.0.1 · published by com.getboxkite

Complete read-only backup and export of Xero accounting data as a ZIP plus a manifest.

Deletes · 1
CompareRegistry entry

7 tools: 1 can delete or cancel things and 6 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http xero-backup-export https://app.getboxkite.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

7 tools

Deletes or cancels 1Claude Code: deny
  • start_exportStarts a read-only export of one accounting organisation's data (Xero, Sage, Reckon, or QuickBooks).No findings

    Why it is in this group

    • The name "start_export" says "start": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Starts a read-only export of one accounting organisation's data (Xero, Sage, Reckon, or QuickBooks). Costs $39 per organisation: when payment is outstanding the response is status 'awaiting_payment' with a Stripe checkoutUrl for the user to complete in a browser, and the export begins once that payment settles. This is not a status endpoint: it reports only the state at creation, and repeat calls return the existing export for that organisation rather than creating or charging for a second one. Export progress is reported by get_export_status, and newly created exports appear in list_exports. A typical export runs for hours, and pauses whenever it meets a provider rate limit or Boxkite's egress budget — anything from under a minute to the next UTC day. get_export_status reports when it resumes.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Only reads 6Claude Code: allow
  • get_download_urlReturns a short-lived signed URL for the export ZIP, valid within the export's 7-day retention window, along with byteSize (the archive's size in bytes, null if unavailable) and fi…No findings

    Why it is in this group

    • The name "get_download_url" says "get": a word for reading.
    Description, as the server wrote it
    Returns a short-lived signed URL for the export ZIP, valid within the export's 7-day retention window, along with byteSize (the archive's size in bytes, null if unavailable) and fileCount. These archives range from a few MB to several GB. The archive contains the exported files plus manifest.json (every file with its sha256) and Info/ (the file-to-Xero-object mapping).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_export_manifestSee what an IN-PROGRESS export contains so far (entities included, per-entity record/file counts, and per-file checksums), growing as discovery and downloading proceed.No findings

    Why it is in this group

    • The name "get_export_manifest" says "get": a word for reading.
    Description, as the server wrote it
    See what an IN-PROGRESS export contains so far (entities included, per-entity record/file counts, and per-file checksums), growing as discovery and downloading proceed. The per-file list is paged: check filesPage.hasMore and pass fileOffset to walk it. Once the export finishes, this returns status 'complete' with a pointer instead of a list, because the full manifest travels inside the ZIP as manifest.json: get a download URL, then read manifest.json from the archive.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_export_mappingFor an IN-PROGRESS export, get the mapping of each file discovered so far to the accounting object it represents or is attached to (e.g.No findings

    Why it is in this group

    • The name "get_export_mapping" says "get": a word for reading.
    Description, as the server wrote it
    For an IN-PROGRESS export, get the mapping of each file discovered so far to the accounting object it represents or is attached to (e.g. which invoice a receipt PDF belongs to). Paged (default 200 files, max 500): check filesPage.hasMore and pass fileOffset for the next page; the `objects` map covers only the files on the current page. Once the export finishes, this returns status 'complete' with a pointer instead: the full mapping ships under Info/ inside the ZIP, so download the archive and read Info/files.json from it.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_export_statusReports the state of one export: status (queued | running | ready | failed) and whether its download is available yet.No findings

    Why it is in this group

    • The name "get_export_status" says "get": a word for reading.
    Description, as the server wrote it
    Reports the state of one export: status (queued | running | ready | failed) and whether its download is available yet. Also returns progress {discovered, transferred, percent}; parkedUntil; and pollAfterSeconds, the interval after which this status is expected to have changed. A large export runs for hours, so pollAfterSeconds can be a long interval. parkedUntil is a timestamp, present whenever work on the organisation is paused and expected to resume. How long varies by cause and is not worth guessing at: hitting Xero's per-minute limit pauses for under a minute, approaching its daily quota pauses for about an hour, and exhausting the daily quota or Boxkite's own egress budget pauses until the next UTC day. Wait until the timestamp (or pollAfterSeconds, which already accounts for it) rather than describing a cause to the user.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_exportsList one-off exports (newest first), optionally for one organisation.No findings

    Why it is in this group

    • The name "list_exports" says "list": a word for reading.
    Description, as the server wrote it
    List one-off exports (newest first), optionally for one organisation. Use this to find an export after payment and to poll its status until it is 'ready'. Side-effect free: it never starts a new export or charges anything. Each entry carries progress, parkedUntil and pollAfterSeconds.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_organisationsList the accounting organisations (Xero, Sage, Reckon, or QuickBooks) connected to the authenticated Boxkite account.No findings

    Why it is in this group

    • The name "list_organisations" says "list": a word for reading.
    Description, as the server wrote it
    List the accounting organisations (Xero, Sage, Reckon, or QuickBooks) connected to the authenticated Boxkite account.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http xero-backup-export https://app.getboxkite.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__xero-backup-export__list_organisations",
      "mcp__xero-backup-export__list_exports",
      "mcp__xero-backup-export__get_export_status",
      "mcp__xero-backup-export__get_export_manifest",
      "mcp__xero-backup-export__get_export_mapping",
      "mcp__xero-backup-export__get_download_url"
    ],
    "ask": [],
    "deny": [
      "mcp__xero-backup-export__start_export"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as xero-backup-export. Review it before you use it.