MCP for Accountants, Explained (Without the Jargon)

If you've read an accounting software announcement in the last six months, you've hit the acronym. Xero mentions it. Ignition built one. Every second AI tool pitching your firm claims to support it. MCP (Model Context Protocol) is having a moment, and most of the explanations are written for developers, not for the person who actually signs off on what touches client data.

Here's the whole thing in one paragraph. MCP is an open standard that lets an AI assistant (Claude, ChatGPT, or whatever your firm ends up using) plug directly into the software you already run and do real things in it: look up a client, pull a report, draft an invoice. It was created by Anthropic in late 2024, and it's now an industry standard backed by OpenAI and Google as well, governed by an independent foundation rather than any one AI company. Think of it as USB-C for AI: one plug standard, so every tool doesn't need a custom cable to every assistant. That's it. That's the acronym.

We've said before that an API is how software talks to other software, and MCP puts a plain-English layer over that. That framing still holds. The API was always there. What changed is that you no longer need to be the person who reads the API documentation.

Why you're suddenly seeing it everywhere

Two things happened at once.

First, the standard won. When Anthropic released MCP in November 2024 it was one lab's experiment. By mid-2025, OpenAI and Google had both adopted it, and in late 2025 Anthropic handed the whole protocol to a foundation under the Linux Foundation, with OpenAI, Microsoft, AWS and Google on board. Once every major AI assistant speaks the same language, building a connector stops being a bet on one vendor and becomes table stakes, like building a website in the late 90s.

Second, the AI companies moved from chatbots to agents: AI that does tasks rather than just answering questions. An agent is only as useful as the systems it can reach. So every software vendor with your firm's data is now racing to be reachable: if the AI can't see their product, their product isn't in the workflow. That race is why your inbox is full of MCP announcements. It's a land grab, and your ledger is the land.

What it actually lets your firm do

Enough theory. Here's what's real and verifiable right now.

• Ask questions of your Xero data in plain English. Xero maintains an official open-source MCP server, and in March 2026 announced a multi-year partnership with Anthropic that puts Claude inside Xero and lets you connect Xero to Claude directly. Practically: "which clients have invoices more than 30 days overdue, and draft a chase email for each", without exporting anything.
• Go from discovery call to proposal in minutes with Ignition. Ignition's MCP connects Claude or ChatGPT to your clients, services, proposals and billing. We tested the workflow: call transcript in, drafted proposal out, in about four minutes instead of an hour.
• Query your practice management data in Karbon. Karbon has a solid API, and community-built and Zapier-hosted MCP servers sit on top of it: searching clients, pulling work items, checking who's assigned to what. We've covered what that looks like day-to-day: five jobs that used to be manual clicking, now a sentence each. Worth noting: at time of writing these connectors are built on Karbon's API rather than shipped by Karbon itself, so vet accordingly.
• Draft invoices and follow-ups without the copy-paste. With a billing tool connected, the assistant prepares the draft against real client records (correct entity, correct services, correct amounts) and you confirm in the source system before anything is issued.
• Do month-end triage across systems. This is where it compounds. One assistant connected to both your ledger and your practice management tool can answer questions neither system answers alone: "which jobs are over budget and still unbilled?" That used to be a spreadsheet afternoon.

None of this is the AI replacing judgment. It's the AI replacing the twenty browser tabs between your judgment and the data.

The boring part is the point

Here's the section vendors put at the bottom and you should read first: permissions.

MCP connections are scoped. A read-only scope means the AI can look but not touch: it can pull your aged receivables, but it cannot create, edit or send anything. A write scope lets it make changes, and good implementations split those finely so you grant "draft an invoice" without granting "send an invoice." Ignition's version is a decent model: the assistant inherits the permissions of your existing user role, you can scope which actions it's allowed, and anything client-facing (an invoice, a proposal) is drafted for you to open and confirm in Ignition before it goes anywhere. Xero's official server uses the same OAuth consent flow as any other Xero connection, with granular scopes you approve up front and can revoke.

The protocol's own specification says there should always be a human in the loop with the ability to deny any tool action. That's not a limitation the vendors will eventually engineer away. That's the design. Because no AI is ever going to jail for you. When a wrong invoice goes to a client, or a BAS gets lodged off bad data, the registered agent's name on the engagement is yours. The confirmation step (the part that feels like friction in the demo) is the part protecting your licence.

One more uncomfortable truth: connected AI has real risks, and the security industry's current top-ranked one is prompt injection: malicious instructions hidden in content the AI reads (an email, a PDF, a web page) that try to hijack what it does with its connected tools. The defence is exactly the boring stuff above: least privilege, read-only by default, human confirmation on anything that leaves the building. Boring is the feature.

What to ask any vendor claiming "MCP support"

"We support MCP" now means anything from "we built and maintain an official server" to "someone on GitHub wrapped our API once." Five questions sort them fast:

1. Is the MCP server built and maintained by you, or by a third party? Official servers get security patches and support. Community servers can be excellent, but you're trusting whoever wrote them with an authenticated connection to client data.
2. What can it write, not just read? Ask for the actual list of actions. "Full MCP support" that can delete records is a very different risk to read-only reporting access.
3. Can I scope it per user and per action? The admin partner and the first-year grad should not hand the AI the same powers.
4. Is our data used to train models? Get it in writing. (The Xero-Anthropic partnership, for the record, states session data isn't used for training.)
5. How do I revoke access, and is there an audit log? One click to disconnect, and a record of every action the AI took. If the answer is vague, walk.

Getting started without a developer

You don't need MCP to start, and honestly, most firms shouldn't start there.

Step one is export-a-spreadsheet. Pull an aged receivables report, a WIP report, or a timesheet export and paste it into Claude or ChatGPT with a real question. Zero integration, zero standing access to client systems, and you'll learn in a week whether the analysis is actually useful to your firm. (Strip client names first if your engagement terms haven't caught up with your tooling.)

Step two is a read-only connector. Once the spreadsheet habit proves out, connect one tool (Xero's connector inside Claude, or Ignition's MCP) with read scopes only. Modern MCP connections in Claude and ChatGPT are click-to-authorise, the same OAuth approval screen you've used for every app addon since 2015. No code, no developer.

Step three is write access, one action at a time. Drafting (never sending) comes first. If you're weighing up what this costs against what it saves at the firm level, we've run those numbers in our breakdown of Claude for accounting firms, and the broader landscape lives in our AI for accounting firms guide.

The firms getting value from MCP in 2026 aren't the ones that connected everything on day one. They're the ones that connected one thing, watched it carefully, and only then gave it more rope.

---

Frequently asked questions

What is MCP in plain English?

MCP (Model Context Protocol) is an open standard that lets AI assistants like Claude and ChatGPT connect to other software (your ledger, your practice management tool, your proposal system) and read data or take actions in it. One standard plug instead of a custom integration for every pairing, which is why it's often called USB-C for AI.

Is MCP safe for client data?

It can be, if it's set up properly. Safety comes from the scopes you grant (start read-only), the vendor's implementation (official servers with OAuth consent and revocable access, like Xero's and Ignition's), and keeping a human confirmation step on anything client-facing. The genuine risks (over-broad permissions and prompt injection) are managed by least-privilege access, not by avoiding the technology. Check the vendor's data-training policy in writing before connecting.

Which accounting tools support MCP today?

Xero maintains an official open-source MCP server and, through its 2026 Anthropic partnership, a direct Xero connection inside Claude. Ignition offers its own MCP covering clients, proposals, invoicing and payments, working with Claude and ChatGPT. Karbon's data is accessible through its API via community-built and Zapier-hosted MCP servers, though Karbon hadn't shipped an official one at time of writing. The list grows monthly. Apply the vendor questions above to anything new.

Do I need a developer to use MCP?

No. Vendor-hosted connectors like Ignition's MCP and the Xero connection in Claude are click-to-authorise: the same approval flow as any app-store addon. Developer skills only enter the picture if you want to run community-built servers or build a custom connection to an in-house system.

What's the difference between MCP, an API and an integration?

An API is how software talks to other software: it's always been there, but using it meant reading documentation and writing code. An integration is a pre-built, fixed pipe between two specific products, doing one predefined job. MCP puts a plain-English layer over the API: instead of a fixed pipe, an AI assistant can use any connected tool flexibly, in response to whatever you ask. API is the wiring, integrations are single-purpose appliances, MCP lets the assistant use the whole toolbox.