Codat MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.3 · published by io.usefulapi

MCP server for Codat — companies, connections, invoices, bills and financial statements.

Deletes · 4Changes · 1

Compare Registry entry

28 tools: 4 can delete or cancel things, 1 change things and 23 only read.

Scanned Oct 21, 2026

Deletes or cancels4Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things1Claude Code: ask: see these tools
Only reads23Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http codat https://codat.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warncodat_request
The server marks "codat_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true}; The name "codat_request" says "request": a word for a change.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

28 tools

Deletes or cancels 4Removes, cancels or revokes something.Claude Code: deny

codat_create_companyMUTATES Codat data — create a new company (a container for a customer's data connections).No findings
Why it is in this group
- The name "codat_create_company" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
MUTATES Codat data — create a new company (a container for a customer's data connections). Provide a name; optionally a description, tags, or other attributes via `fields`. Codat API: POST /companies. Returns the created company (incl. its id).
Annotations the server declares
- title: Create a company
- destructiveHint: true
codat_create_connectionMUTATES Codat data — create a new data connection on a company for a given source platform.No findings
Why it is in this group
- The name "codat_create_connection" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
MUTATES Codat data — create a new data connection on a company for a given source platform. Provide the platformKey (from codat_list_integrations, e.g. "gbol" for QuickBooks Online sandbox). The connection is created in a PendingAuth state; the customer completes authorization via the returned linkUrl. Codat API: POST /companies/{companyId}/connections. Returns the created connection.
Annotations the server declares
- title: Create a data connection
- destructiveHint: true
codat_refresh_all_dataMUTATES Codat state — queue a refresh of ALL data types for a company (Codat re-pulls from the connected source platforms).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
MUTATES Codat state — queue a refresh of ALL data types for a company (Codat re-pulls from the connected source platforms). Asynchronous: it enqueues pulls, it does not return the data. Use codat_get_data_status to track progress. Codat API: POST /companies/{companyId}/data/all.
Annotations the server declares
- title: Queue a full data refresh
- destructiveHint: true
codat_refresh_data_typeMUTATES Codat state — queue a refresh of ONE data type for a company (e.g.No findings
Why it is in this group
- The name "codat_refresh_data_type" says "type": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
MUTATES Codat state — queue a refresh of ONE data type for a company (e.g. "invoices", "bills", "chartOfAccounts", "balanceSheet"). Asynchronous: it enqueues a pull, it does not return the data. Codat API: POST /companies/{companyId}/data/queue/{dataType}.
Annotations the server declares
- title: Queue a single dataset refresh
- destructiveHint: true

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

codat_requestPower-user escape hatch: GET any Codat API path not wrapped by a dedicated tool.1 finding
Why it is in this group
- The name "codat_request" says "request": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "codat_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true}; The name "codat_request" says "request": a word for a change.
  What this check looks for
Description, as the server wrote it
Power-user escape hatch: GET any Codat API path not wrapped by a dedicated tool. READ-ONLY — only GET is allowed. Path starts with a slash (e.g. "/companies/{id}/data/taxRates", "/companies/{id}/reports/agedDebtor"). Codat API: GET {path}.
Annotations the server declares
- title: Raw read request
- readOnlyHint: true

Only reads 23Looks things up and changes nothing.Claude Code: allow

codat_get_balance_sheetGet a company's balance sheet, broken into periods.No findings
Why it is in this group
- The name "codat_get_balance_sheet" says "get": a word for reading.
Description, as the server wrote it
Get a company's balance sheet, broken into periods. periodLength (months per period) and periodsToCompare are BOTH required by Codat. Codat API: GET /companies/{companyId}/data/financials/balanceSheet.
Annotations the server declares
- title: Get balance sheet
- readOnlyHint: true
codat_get_cash_flow_statementGet a company's cash flow statement, broken into periods.No findings
Why it is in this group
- The name "codat_get_cash_flow_statement" says "get": a word for reading.
Description, as the server wrote it
Get a company's cash flow statement, broken into periods. periodLength and periodsToCompare are BOTH required by Codat. Codat API: GET /companies/{companyId}/data/financials/cashFlowStatement.
Annotations the server declares
- title: Get cash flow statement
- readOnlyHint: true
codat_get_companyFetch a single company by id (name, platform, dataConnections, created/lastSync).No findings
Why it is in this group
- The name "codat_get_company" says "get": a word for reading.
Description, as the server wrote it
Fetch a single company by id (name, platform, dataConnections, created/lastSync). Codat API: GET /companies/{companyId}.
Annotations the server declares
- title: Get a company
- readOnlyHint: true
codat_get_connectionFetch a single data connection by id (platformKey, status, sourceType, lastSync).No findings
Why it is in this group
- The name "codat_get_connection" says "get": a word for reading.
Description, as the server wrote it
Fetch a single data connection by id (platformKey, status, sourceType, lastSync). Codat API: GET /companies/{companyId}/connections/{connectionId}.
Annotations the server declares
- title: Get a data connection
- readOnlyHint: true
codat_get_data_infoGet a company's accounting metadata (base currency, supported data types, etc.).No findings
Why it is in this group
- The name "codat_get_data_info" says "get": a word for reading.
Description, as the server wrote it
Get a company's accounting metadata (base currency, supported data types, etc.). Codat API: GET /companies/{companyId}/data/info.
Annotations the server declares
- title: Get accounting metadata
- readOnlyHint: true
codat_get_data_statusGet the freshness/status of each accounting data type for a company (lastSuccessfulSync, currentStatus, dataType).No findings
Why it is in this group
- The name "codat_get_data_status" says "get": a word for reading.
Description, as the server wrote it
Get the freshness/status of each accounting data type for a company (lastSuccessfulSync, currentStatus, dataType). Use this to check whether a dataset has been pulled before reading it. Codat API: GET /companies/{companyId}/dataStatus.
Annotations the server declares
- title: Get data status
- readOnlyHint: true
codat_get_invoiceFetch a single AR invoice by id (full object incl.No findings
Why it is in this group
- The name "codat_get_invoice" says "get": a word for reading.
Description, as the server wrote it
Fetch a single AR invoice by id (full object incl. lineItems, paymentAllocations). Codat API: GET /companies/{companyId}/data/invoices/{invoiceId}.
Annotations the server declares
- title: Get an invoice
- readOnlyHint: true
codat_get_profileFetch the authenticated Codat account's profile (organization name, redirect URLs, features) — a quick way to verify the API key works.No findings
Why it is in this group
- The name "codat_get_profile" says "get": a word for reading.
Description, as the server wrote it
Fetch the authenticated Codat account's profile (organization name, redirect URLs, features) — a quick way to verify the API key works. Codat API: GET /profile.
Annotations the server declares
- title: Get account profile
- readOnlyHint: true
codat_get_profit_and_lossGet a company's profit and loss (income statement), broken into periods.No findings
Why it is in this group
- The name "codat_get_profit_and_loss" says "get": a word for reading.
Description, as the server wrote it
Get a company's profit and loss (income statement), broken into periods. periodLength and periodsToCompare are BOTH required by Codat. Codat API: GET /companies/{companyId}/data/financials/profitAndLoss.
Annotations the server declares
- title: Get profit & loss
- readOnlyHint: true
codat_list_account_transactionsList a company's account transactions (bank/GL transactions) for a data connection.No findings
Why it is in this group
- The name "codat_list_account_transactions" says "list": a word for reading.
Description, as the server wrote it
List a company's account transactions (bank/GL transactions) for a data connection. NOTE: this endpoint is CONNECTION-scoped. Codat API: GET /companies/{companyId}/connections/{connectionId}/data/accountTransactions. Returns the paged envelope.
Annotations the server declares
- title: List account transactions
- readOnlyHint: true
codat_list_accountsList a company's chart of accounts (id, name, nominalCode, type, status, currency, currentBalance).No findings
Why it is in this group
- The name "codat_list_accounts" says "list": a word for reading.
Description, as the server wrote it
List a company's chart of accounts (id, name, nominalCode, type, status, currency, currentBalance). Codat API: GET /companies/{companyId}/data/accounts. Returns the paged envelope.
Annotations the server declares
- title: List chart of accounts
- readOnlyHint: true
codat_list_bill_paymentsList a company's bill payments (money paid out to suppliers) — id, supplierRef, date, currency, totalAmount, lines.No findings
Why it is in this group
- The name "codat_list_bill_payments" says "list": a word for reading.
Description, as the server wrote it
List a company's bill payments (money paid out to suppliers) — id, supplierRef, date, currency, totalAmount, lines. Codat API: GET /companies/{companyId}/data/billPayments. Returns the paged envelope.
Annotations the server declares
- title: List bill payments
- readOnlyHint: true
codat_list_billsList a company's accounts-payable bills (id, reference, supplierRef, issueDate, dueDate, currency, totalAmount, amountDue, status, lineItems).No findings
Why it is in this group
- The name "codat_list_bills" says "list": a word for reading.
Description, as the server wrote it
List a company's accounts-payable bills (id, reference, supplierRef, issueDate, dueDate, currency, totalAmount, amountDue, status, lineItems). Codat API: GET /companies/{companyId}/data/bills. Returns the paged envelope.
Annotations the server declares
- title: List bills
- readOnlyHint: true
codat_list_companiesList the companies in your Codat account.No findings
Why it is in this group
- The name "codat_list_companies" says "list": a word for reading.
Description, as the server wrote it
List the companies in your Codat account. A company represents one of your customers' businesses and holds its data connections. Codat API: GET /companies. Returns the paged envelope { results, pageNumber, pageSize, totalResults, _links }.
Annotations the server declares
- title: List companies
- readOnlyHint: true
codat_list_connectionsList a company's data connections (each links the company to one source platform, e.g.No findings
Why it is in this group
- The name "codat_list_connections" says "list": a word for reading.
Description, as the server wrote it
List a company's data connections (each links the company to one source platform, e.g. QuickBooks, Xero). Codat API: GET /companies/{companyId}/connections. Returns the paged envelope.
Annotations the server declares
- title: List data connections
- readOnlyHint: true
codat_list_credit_notesList a company's credit notes (id, creditNoteNumber, customerRef, issueDate, currency, totalAmount, remainingCredit, status).No findings
Why it is in this group
- The name "codat_list_credit_notes" says "list": a word for reading.
Description, as the server wrote it
List a company's credit notes (id, creditNoteNumber, customerRef, issueDate, currency, totalAmount, remainingCredit, status). Codat API: GET /companies/{companyId}/data/creditNotes. Returns the paged envelope.
Annotations the server declares
- title: List credit notes
- readOnlyHint: true
codat_list_customersList a company's customers (id, customerName, contactName, emailAddress, addresses, status, defaultCurrency).No findings
Why it is in this group
- The name "codat_list_customers" says "list": a word for reading.
Description, as the server wrote it
List a company's customers (id, customerName, contactName, emailAddress, addresses, status, defaultCurrency). Codat API: GET /companies/{companyId}/data/customers. Returns the paged envelope.
Annotations the server declares
- title: List customers
- readOnlyHint: true
codat_list_direct_costsList a company's direct costs (point-of-sale purchases: card/cash spend, refunds) for a data connection.No findings
Why it is in this group
- The name "codat_list_direct_costs" says "list": a word for reading.
Description, as the server wrote it
List a company's direct costs (point-of-sale purchases: card/cash spend, refunds) for a data connection. NOTE: this endpoint is CONNECTION-scoped. Codat API: GET /companies/{companyId}/connections/{connectionId}/data/directCosts. Returns the paged envelope.
Annotations the server declares
- title: List direct costs
- readOnlyHint: true
codat_list_integrationsList the accounting/commerce/banking platforms (integrations) Codat supports, with their platformKey.No findings
Why it is in this group
- The name "codat_list_integrations" says "list": a word for reading.
Description, as the server wrote it
List the accounting/commerce/banking platforms (integrations) Codat supports, with their platformKey. Codat API: GET /integrations. Returns the paged envelope.
Annotations the server declares
- title: List integrations
- readOnlyHint: true
codat_list_invoicesList a company's accounts-receivable invoices (id, invoiceNumber, customerRef, issueDate, dueDate, currency, totalAmount, amountDue, status, lineItems).No findings
Why it is in this group
- The name "codat_list_invoices" says "list": a word for reading.
Description, as the server wrote it
List a company's accounts-receivable invoices (id, invoiceNumber, customerRef, issueDate, dueDate, currency, totalAmount, amountDue, status, lineItems). Codat API: GET /companies/{companyId}/data/invoices. Returns the paged envelope. Tip: filter with query, e.g. "status=Submitted&&amountDue>0".
Annotations the server declares
- title: List invoices
- readOnlyHint: true
codat_list_journal_entriesList a company's journal entries (id, postedOn, createdOn, journalLines with accountRef/netAmount/currency).No findings
Why it is in this group
- The name "codat_list_journal_entries" says "list": a word for reading.
Description, as the server wrote it
List a company's journal entries (id, postedOn, createdOn, journalLines with accountRef/netAmount/currency). Codat API: GET /companies/{companyId}/data/journalEntries. Returns the paged envelope.
Annotations the server declares
- title: List journal entries
- readOnlyHint: true
codat_list_paymentsList a company's payments received (money in against invoices) — id, customerRef, date, currency, totalAmount, lines/allocations.No findings
Why it is in this group
- The name "codat_list_payments" says "list": a word for reading.
Description, as the server wrote it
List a company's payments received (money in against invoices) — id, customerRef, date, currency, totalAmount, lines/allocations. Codat API: GET /companies/{companyId}/data/payments. Returns the paged envelope.
Annotations the server declares
- title: List payments
- readOnlyHint: true
codat_list_suppliersList a company's suppliers/vendors (id, supplierName, contactName, emailAddress, addresses, status, defaultCurrency).No findings
Why it is in this group
- The name "codat_list_suppliers" says "list": a word for reading.
Description, as the server wrote it
List a company's suppliers/vendors (id, supplierName, contactName, emailAddress, addresses, status, defaultCurrency). Codat API: GET /companies/{companyId}/data/suppliers. Returns the paged envelope.
Annotations the server declares
- title: List suppliers
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.16.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http codat https://codat.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__codat__codat_get_profile",
      "mcp__codat__codat_list_companies",
      "mcp__codat__codat_get_company",
      "mcp__codat__codat_list_connections",
      "mcp__codat__codat_get_connection",
      "mcp__codat__codat_get_data_status",
      "mcp__codat__codat_get_data_info",
      "mcp__codat__codat_list_integrations",
      "mcp__codat__codat_list_accounts",
      "mcp__codat__codat_list_invoices",
      "mcp__codat__codat_get_invoice",
      "mcp__codat__codat_list_bills",
      "mcp__codat__codat_list_bill_payments",
      "mcp__codat__codat_list_credit_notes",
      "mcp__codat__codat_list_customers",
      "mcp__codat__codat_list_suppliers",
      "mcp__codat__codat_list_payments",
      "mcp__codat__codat_list_journal_entries",
      "mcp__codat__codat_get_balance_sheet",
      "mcp__codat__codat_get_profit_and_loss",
      "mcp__codat__codat_get_cash_flow_statement",
      "mcp__codat__codat_list_direct_costs",
      "mcp__codat__codat_list_account_transactions"
    ],
    "ask": [
      "mcp__codat__codat_request"
    ],
    "deny": [
      "mcp__codat__codat_create_company",
      "mcp__codat__codat_create_connection",
      "mcp__codat__codat_refresh_all_data",
      "mcp__codat__codat_refresh_data_type"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as codat. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/codat/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 19:23 UTC.

For agents: Markdown · JSON · report this listing