FOR AI AGENTS

Hand your AI agent a copy of your Xero data

Ask your assistant to check Xero for fraud, find where to cut spend, or audit your books. And it needs the data to work on. Boxkite gives it a complete, read-only export it can actually read. Your agent can connect Xero, pay once, and pull the data itself.

Discover

Your agent finds Boxkite via llms.txt and our MCP server.

Connect & pay

Your agent signs in to Xero (read-only) and pays the one-off fee in the browser.

Boxkite exports

We package a full read-only copy: a ZIP plus a machine-readable manifest.

Your agent analyses

It reads the manifest and works on your data: fraud, overspend, anomalies.

What your agent receives

A single ZIP archive plus a manifest.json describing every file, so your agent knows exactly what's inside before it starts.

·Contacts, Debtor & Creditor Invoices, Bank Transactions

·Manual Journals, Financial Statements, Purchase Orders, Quotes

·Tax Rates, Tracking Categories, Payments, Batch Payments

·Items, Accounts, Budgets, Assets, and uploaded files

Safe by design

✓Read-only. Boxkite requests read-only Xero scopes, so the export can never change, delete or create anything in your books.

✓One-off. $39 per organisation, no subscription. A single payment completed in the export flow.

✓Temporary. Exports are encrypted, available for 7 days, then automatically deleted.

SETUP

Connect your agent

Boxkite runs a hosted MCP server over Streamable HTTP, plus the same capabilities as a REST API. The MCP server signs you in with OAuth, so there is no key to copy or paste. Both are read-only against Xero.

1. Add the connector

In Claude, open Settings → Connectors → Add custom connector and enter the server URL. Leave the advanced OAuth fields blank:

https://app.getboxkite.com/mcp

On Team and Enterprise plans an Owner adds it under Admin settings → Connectors; members then connect from their own settings.

2. Connect your account

Claude will send you to Boxkite to sign in and approve access. Review what the agent will be able to do, then choose Allow. That is the whole setup.

Approving connects your own Boxkite account, so the agent sees only your organisations. You can disconnect an app at any time under API keys, which cuts off its access immediately.

3. Scripts and the REST API

For your own scripts, or a client that cannot do OAuth, create a key at Settings → API keys. It starts with bk_live_ and is shown once. Send it as a header:

Authorization: Bearer bk_live_your_key_here

Include the word Bearer and the space. The value is sent exactly as entered, and a bare key is rejected. If your client cannot set an authorization header, x-api-key with just the key also works. The MCP endpoint accepts either an API key or OAuth.

What the MCP server exposes

Tool	What it does
list_organisations	Lists the Xero organisations connected to your Boxkite account, with the ids the other tools take.
start_export	WRITE · Starts a read-only export of one organisation. $39 per organisation: when payment is outstanding the response carries a Stripe checkout URL to complete in a browser. Repeat calls return the existing export rather than charging again.
list_exports	Lists your exports, newest first, optionally filtered to one organisation.
get_export_status	Reports queued / running / ready / failed, plus records discovered and transferred, when a Xero rate limit lifts, and how long until the status is expected to change. Exports commonly run for hours.
get_export_manifest	What an in-progress export contains: entities, per-entity counts, and a per-file checksum. Paged via fileOffset / fileLimit.
get_export_mapping	Which Xero object each file represents or is attached to, e.g. the invoice a receipt PDF belongs to. Also paged.
get_download_url	A short-lived signed URL for the export ZIP, with its size in bytes and file count. Valid within the 7-day retention window.

Every tool except start_export is read-only. Once an export finishes, the complete manifest and mapping travel inside the ZIP (at manifest.json and Info/), so the manifest and mapping tools serve live structure while an export is building and then point you at the archive. For the REST equivalents, use app.getboxkite.com/api/v1 with the same Authorization: Bearer header; download a sample export to see the exact archive structure.

FAQ

Questions about agent access

Can an agent change my Xero data?+

No. Boxkite only ever requests read-only access to Xero, so anything built on top of it, including AI agents, can read your data but can never edit, delete, or create anything in your books.

What exactly does my agent receive?+

A single ZIP archive of your Xero data (CSVs, files and PDFs) plus a manifest.json at the root that lists every file, its entity type, record count, date range and checksum. The manifest lets an agent understand the contents and load the right files without unpacking everything first. Download a sample export to see the exact structure.

How does payment work?+

A one-off export is $39 USD per organisation, with no subscription. Your agent completes the Stripe checkout in the browser as part of running the export.

What can an agent do with the data?+

Common uses: scanning for duplicate payments or suspected fraud, finding where you can cut spend, reconciliation checks, cash-flow analysis, and preparing data for audits or a move off Xero. Because it's a complete copy, your agent works on everything at once instead of paging through the Xero API.

Is there an API or MCP server?+

Yes. A REST API and a hosted MCP server let your agent start an export and fetch the manifest, mapping and download link directly. Add app.getboxkite.com/mcp as a custom connector and sign in with OAuth; there is no key to paste. For scripts and the REST API, create an API key at app.getboxkite.com/settings/api-keys (shown once) and send it as an Authorization: Bearer header. REST base: app.getboxkite.com/api/v1.

Give your agent the data it needs

Start a one-off, read-only export now, or connect your agent to the MCP server for fully programmatic access.

Download my data → Connect an agent

Boxkite

Documentation