What MCP Is, and Why an Accounting Ledger Needs One

MCP stands for Model Context Protocol — an open standard that lets an AI assistant, whether that's Claude, ChatGPT, Cursor, or any other assistant that supports it, connect to an application's real functionality through a defined set of named actions, called tools, instead of only being able to chat about the application or guess at a user interface it can't actually see.

Bookkeeping specifically needs this kind of connection rather than "just ask the AI," because without it, an AI assistant only knows whatever you happen to type or paste into the conversation. It can't see your actual chart of accounts, your actual account balances, or your actual transaction history — it can only work from your description of them. Ask an unconnected AI assistant "what's my net income this month," and whatever it tells you is really an estimate based on what you told it, not something verified against a real, current ledger. That gap matters a lot more for money than it does for most other things an AI helps with.

BalanceMCP exposes nineteen specific tools over an authenticated endpoint, secured by a bearer API key tied to one user's own books — things like import_statement, categorize_transactions, post_journal_entry, reverse_entry, reconcile_account, trial_balance, profit_and_loss, and balance_sheet, among others. Each one is a narrow, specifically named capability. Connecting an AI assistant this way is nothing like handing it a database password — it's giving it a fixed menu of actions, each one doing exactly what its name says and nothing more.

A concrete sequence makes this less abstract. Ask a connected assistant to close out last month, and it might call reconcile_account to check each bank account against its statement, categorize_transactions for anything still sitting uncategorized, profit_and_loss to show you the month's results, and lock_period once you confirm you're satisfied — four different tools, each doing one narrow thing, chained together by the assistant on your behalf rather than you invoking each one by name yourself.

That narrowness is the point, not a limitation to work around. Every one of those tool calls runs under the exact same rules as anything else touching your books — the same tenant isolation, so an AI connected to your account genuinely cannot see or touch another user's books, and the same database-level guarantees covered elsewhere in this cluster: entries must balance, the journal is append-only, nothing can post into a locked period. The AI isn't given a side door around any of that. It's given the same front door everything else uses.

The bearer API key is what ties all of this back to exactly one user's books, and it's worth treating like any other credential that grants real access — anyone holding a valid key for your account can call these tools as you. That's not a weakness specific to MCP; it's true of any authenticated API, and it's the reason a key should be revoked the moment you suspect it's been exposed, the same way you'd treat a leaked password. It's also worth knowing that a key grants access to everything the assistant is allowed to do on your books at once — there's no way today to hand out a narrower key that, say, can only run reports but never post an entry, so anyone you'd trust with one should be someone you'd trust with the full set of tools.

Worth being honest about a real, current limitation on the other side of this: there isn't a separate web dashboard today for browsing your books visually — no page you'd log into and click around to see a report. You view your reports and your data by asking your connected AI assistant, which calls the same underlying tools a dashboard would use behind the scenes. That's a genuine gap right now, not a hidden feature waiting to be found, and it's worth knowing going in rather than discovering by surprise.

Put together, this is what makes "let my AI do my bookkeeping" mean something more solid than "paste my numbers into a chat and hope." It's a defined, narrow, specifically scoped channel between the assistant and your actual ledger — not an open-ended one, and not one where the assistant is trusted to just be careful. The rest of that trust is enforced by the ledger itself, which is exactly what the next guide in this cluster is about.