Is It Safe to Connect Claude to Xero?

Reasonably safe, going by what Xero publishes, if you use its read-only connector and stay away from its two MCP routes. Read the consent screen before you click Allow. After that, put dates in every question and check any number you’d act on against Xero.

I haven’t tested any of this. My company has never used Xero. We run on QuickBooks, which we moved to in August. Everything here comes from public pages I read on October 30, 2026.

Xero’s connector does less than the QuickBooks one, which is what you want. Its listing in Claude’s directory says “Claude connects with read-only access”, and all 20 tool names on it start with get_ or show_. QuickBooks’ connector can create, send and delete invoices. The table of what 33 connectors can change compares it with your other apps.

Can Claude connect to Xero?

Yes, four official ways. Xero’s “read-only” covers the first two.

The connector is free to add. You need a Xero subscription and a Claude account. Third parties such as Meridian and CData offer routes that can write, and Xero’s read-only statement doesn’t cover them.

What can Claude access in Xero?

Through the connector: profit and loss, cash and financial position, aged receivables and payables, invoices, bills, repeating invoices and bills, purchase orders, contacts, the chart of accounts, tracking categories and bank account transactions. What Claude pulls lands in your chats. The listing has no payroll tool and the permissions the connector publishes include none for payroll.

A contact record can hold a bank account number and a tax number. For a sole trader, that’s a person’s details, so check what your privacy law requires before you connect real books. And Xero says “Claude reads uncoded transactions and draft invoices too”, so an answer can include work nobody has reviewed.

You get one organisation at a time, and switching means disconnecting and reconnecting.

Connect with the most limited login that will authorize it. Xero says the connector follows your Xero permissions.

Is the Claude Xero connector read-only?

Xero Central says so: “Claude can’t make changes to your Xero organisation.” The permissions mostly agree. Apps ask for access one permission at a time (a scope), and Xero’s scope list has read-only versions across accounting.

One thing bothered me. The connector publishes its scopes, 14 of them. The accounting ones nearly all end in .read, but accounting.settings doesn’t. Xero defines it as “View and manage your organisation settings”, and it covers users, accounts and tax rates. accounting.settings.read sits right beside it.

None of the 20 tool names sounds like a change, but the listing gives names and no descriptions. That public list also shows every permission the connector supports, which may be more than it asks you for. The consent screen is where you find out. If it asks to manage settings, cancel, or connect only after Xero support explains why. You can’t remove one permission later, only revoke and start again.

Treat read-only as today’s setting. Xero’s FAQ says “read-only at launch”, and its March announcement talks about “the ability to act on it”. I found no dated plan to add writing.

The tool list looks to have grown already. On June 2, IT Brief NZ quoted an adviser who tested it and saw five functions, and reported that the connector “does not provide invoice-level detail or transaction data.” The listing now shows 20, including get_invoices and get_bank_account_transactions. The directory warns that “Anthropic does not control which tools developers make available.” Reread the listing every few months.

Can the Xero MCP server change my books?

Yes. The open-source server has create-payment, create-manual-journal, update-invoice and, for NZ and UK organisations, payroll timesheet approvals. Its default scopes can write, though the README says you can override them with XERO_SCOPES. The usual install pulls @latest, so the code running against your books can change without you doing anything.

The Remote MCP launched October 15, and it’s the one I’d be most careful with. Xero’s FAQ says: “The tools on V1 do not elicit user confirmation. Always ask your agent to confirm with you before writing anything back to Xero.” So an agent can void an invoice without asking you, and Xero’s advice here is only an instruction you give the agent.

You can narrow it. The overview says “The agent can only call tools your app has approved scopes for”, so request only .read scopes unless you have a reason. The FAQ also says to “point the agent at the demo organisation” during development. I’d keep it there past development too.

If someone at your company sets one up, ask which route they’re on and check the address in the table. On Team and Enterprise plans, for connectors enabled across your organisation, owners can set each tool to “Always allow, Needs approval, or Blocked”. I couldn’t confirm this reaches a server someone installs on their own machine or a client outside Claude, so don’t rely on it for the two MCP routes.

Can Claude’s Xero numbers be wrong?

Yes, and Xero documents two ways.

Leave the period out of your question and Central says Claude “Uses the current calendar month to date (for revenue and profit type questions)” and “Uses the last 12 months (for contacts and receivables type questions)”. By that rule, “how much did I make?” on the 2nd of the month gets you two days of revenue.

The numbers can also lag, so check the time stamp on any visual summary. If it’s old, Xero Analytics hasn’t refreshed yet: click Explore Xero Analytics on the answer, then Refresh now, and ask again. Ignore the “always up to date” line on Xero’s marketing page, and check any number you’d act on against Xero, because its own guide says “It can’t guarantee accuracy on every detail.”

Does Claude train on your Xero data?

Mostly no. Xero says connector data isn’t “used to train Anthropic models”, then adds “Your Claude plan and settings control conversation data use.”

On Free, Pro and Max, Anthropic says training data “does not include raw content from connectors”, unless it’s “directly copied into your conversation with Claude.” Conversations flagged for safety review can be used regardless of your setting. On commercial plans, inputs and outputs aren’t used by default.

Neither connector promise covers what Claude writes back. When it says “revenue was 84,000 last quarter”, that sentence sits in your conversation. So on a personal plan, turn the training setting off and don’t paste figures in. Don’t give these chats a thumbs up or down either, because a rating stores “the entire related conversation” for up to five years.

The listing also says data is “never stored between sessions”, but the chat holding Claude’s answer stays in your history until you delete it. Anthropic says a deleted chat leaves its back-end within 30 days on personal plans, but with training on it may keep de-identified data for up to 5 years.

How do I test the Xero connector safely?

Xero’s demo company is the closest thing to a sandbox. It holds fictional data, needs only a Xero login and resets every 28 days. If the connector won’t offer it at sign-in, skip steps 3 and 4, and know that step 2 means granting access to your real books.

1. Read the consent screen. Before you click Allow, look for anything that says manage rather than view, settings especially. I haven’t seen this screen, so that wording is a guess. Treat anything beyond viewing settings as the same red flag.
2. Ask a vague question. “How much did I make?” Ask again with exact dates and compare both with the profit and loss report in Xero. If there’s a visual summary, check its time stamp.
3. Ask for a write, on the demo company only. Ask Claude to create a draft invoice, edit a contact and add a tax rate. You should get a refusal. Check Xero anyway, and if anything changed, disconnect. A refusal shows only that there’s no tool for it today.
4. Check the contact fields. Add a made-up bank number to a demo contact, then ask Claude to show everything it can see for that contact.

How do I disconnect Claude from Xero?

In Claude, open Xero in Connectors, then Disconnect. Xero says “Disconnect anytime in Claude or Xero”, and its developer FAQ, writing about the Remote MCP, points to the Connected Apps page in the Xero App.

Xero calls the connector “session only”, but its developer docs say connections in general “stay active indefinitely” even when unused. Assume the connector’s does too, and disconnect on purpose. Xero’s docs say removing the user from the organisation also ends a connection, though I couldn’t confirm that for the connector. When someone leaves, have them disconnect first and then remove them.

What I couldn’t confirm

• Whether the real consent screen asks for accounting.settings.
• Whether the connector returns the bank and tax numbers on a contact.
• Whether the connector offers the demo company at sign-in, or works there without a paid subscription.
• Whether a Viewer can authorize the connector, or whether hiding bank data from a Standard user narrows what Claude sees. The demo company can’t test this.
• Whether Claude appears by name on Xero’s Connected Apps page, and whether disconnecting in Claude revokes on Xero’s side.

What should I do before I click Allow?

Run the test and write down who connected what, because I couldn’t confirm you get any log of what Claude read through the connector. For the rules around it, use the one-page connector policy in the QuickBooks post.

If you’d rather plan which of your tools to connect, and how, the setup planner asks six questions and gives you a plan without asking for an email. If you want a second look at a list you already have, bring your connected apps to a 30-minute call.