# Red MCP Server

Red is an open-source [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that connects AI assistants and MCP clients to [Big Red Cloud](https://www.bigredcloud.com) accounting data through a set of controlled MCP tools.

Supported customer platforms today are **ChatGPT**, **Claude**, **Mistral (**[Vibe](https://chat.mistral.ai/chat)), and **Microsoft 365 Copilot**. Copilot uses a Microsoft federated connector at `/mcp/copilot`. Because of current Microsoft federated connector limitations, that connector is read-only for now. Create, update and delete tools on Copilot are expected to follow when Microsoft supports them. ChatGPT, Claude and Mistral use `/mcp`, which already includes those write tools where the deployment enables them. Other MCP clients may work technically, but they are not treated as officially supported platforms. Red uses platform detection only for anonymous operational telemetry (see [Privacy-safe telemetry](#privacy-safe-telemetry)).

Instead of calling the Big Red Cloud REST API directly, users work in plain language. The server translates requests into structured API calls and applies safety checks around anything that changes data.

With Red, a connected user can:

- **Review** Big Red Cloud data with read-only lookups (customers, suppliers, products, invoices, quotes, nominal reports, and more).
- **Review before posting** — see a plain-English preview of new or changed records before anything is written to Big Red Cloud.
- **Create, update, delete, batch, or email** records only after explicit confirmation (and only when those capabilities are enabled for the deployment).
- **Ask Big Red Cloud how-to and training questions** — Red answers using official support articles, customer documentation, screenshots, and webinar resources. These help tools do not require a connected company.

---



## Why open source?

We believe AI infrastructure should be transparent. Customers should be able to inspect the software that connects their accounting data to AI assistants.

Our competitive advantage is not the connector itself; it is our accounting platform, our expert bookkeeping advice, our customer experience, and the value we build on top of it.

By open-sourcing Red, we hope to encourage trust, community contributions, and wider adoption of open standards.

---



## Features

- Secure company connection flow (one-time connection page; no credentials in chat)
- Pre-confirm validation of company connection credentials on the connection page (single-company form or multi-company CSV upload)
- Partial connection results — invalid keys are rejected before confirm and reported in `failedCompanies`
- Hosted HTTP `connectionRef` / `activeConnectionRef` so MCP clients can silently reuse a confirmed connection across supported session changes; kept in tool JSON, not shown to end users
- Request routing for transactional work — action tools expect a short-lived `routeToken` from the router before create/update/delete/batch/email workflows proceed
- Privacy-safe anonymous operational telemetry (platform, environment, tool name, connected-company count) — see [docs/TELEMETRY.md](docs/TELEMETRY.md)
- Company readiness check (`brc_company_readiness_check`) for connected companies
- Read-only Big Red Cloud lookups
- Customer, supplier, product, sales rep, VAT, and analysis category tools
- Sales quotes, invoices, credit notes, purchases, payments, and cash tools
- Preview-before-posting confirmation flow for create, update, delete, and batch actions (email tools use an explicit send confirmation)
- VAT and transaction safety checks
- Sales invoice safeguards, including multi-line generated-reference validation, Gross Price Entry `priceBasis` handling, Sales VAT category validation, placeholder product ID blocking, and related preflight checks
- Session audit log of writes made through the MCP session, plus a downloadable support diagnostic for one connected company
- Official Big Red Cloud help answers from Freshdesk articles, customer documentation, screenshots, and webinars — no company connection required
- Local stdio and hosted HTTP transports

---



## Security and safety model

Red is designed so that AI-driven access to accounting data stays controlled and auditable.

- **No credentials in the repository.** Company connection credentials and secrets are never committed. Configuration is supplied at runtime through environment variables.
- **No credentials in chat.** Company connection credentials must not be pasted into chat. Companies are connected through the secure Red connection page, where credentials are entered directly — not in the chat window.
- **Two connection models.** On `https://red.bigredcloud.com/mcp`, a connected company stays available for about the configured session duration and is held in session memory (or an optional shared connection store in hosted deployments). Where supported, that flow can reuse `connectionRef` / `activeConnectionRef` across MCP session changes. On `https://red.bigredcloud.com/mcp/copilot`, companies are linked to the verified Microsoft user who connected them. Those Microsoft-owned connections are separate from anonymous or session connections.
- **Pre-confirm validation.** Company connection credentials submitted on the connection page are validated against Big Red Cloud before they are stored. Invalid or expired credentials are not saved; they appear in `failedCompanies` at confirmation time.
- **Credential invalidation.** Only confirmed authentication failures clear a stored company credential. Endpoint, validation, permission, timeout, and server failures are not treated as an expired API key.
- **User-facing presentation.** `connectionRef`, session IDs, and other MCP diagnostics are for tool arguments only. Assistants must not show `redconn_…` values or internal connection metadata to normal users unless the user explicitly asks for technical details.
- **Configurable session duration.** How long connections last is controlled by `BRC_API_KEY_TTL_MINUTES`. User-facing wording (connection page, getting-started text, connection status) is derived from that value — not hardcoded.
- **Request routing for writes.** Create, update, delete, batch, and email tools require a valid short-lived `routeToken` issued by the request router for the matching workflow. A route token is not permission to post — preview and confirmation still apply.
- **Explicit confirmation for writes.** Create, update, delete, and batch actions require an explicit confirmation flag after a preview before posting has been shown. Email tools require an explicit send confirmation after an email preview.
- **Preview before posting.** The first call to a write tool returns a payload preview rather than performing the action. Nothing is written to Big Red Cloud until you confirm.
- **Read and write are separated.** Read-only lookups are clearly distinct from actions that change data.
- **Audit log.** Writes made through the MCP session are recorded in a session audit log; read-only lookups are not treated as completed changes. Activity is scoped to currently connected companies. A downloadable support diagnostic can be generated for one connected company at a time; generating it is read-only and does not write to Big Red Cloud.
- **Deployment flags.** Update, delete, email, batch, and operator/dev tools can each be disabled per deployment. Disabled skill groups are **not registered** with the MCP client for that process, so those tools are hidden rather than callable.



### Sales invoice safety checks

Sales invoice handling includes:

- **Gross Price Entry** requires an explicit `priceBasis` of `gross` or `net` so VAT is never guessed.
- **Sales VAT rates only.** Sales invoices must use a Sales VAT category; purchase VAT rates are blocked, even when the percentage matches.
- **Placeholder product IDs** (`productId` `0` and `1`) are treated as placeholders and blocked before preview-before-posting and post.
- **Multi-line generated-reference invoices** (`brc_create_sales_invoice_gen_ref`) require each `productTrans` line to include its own `acEntries` analysis allocation. Line net/VAT/gross reconciliation, analysis allocation totals, header totals, and required product/VAT/analysis fields are validated before posting; failures return structured field-level errors.
- `note` defaults to the customer name unless a note is explicitly provided, and is never set to a product name.
- `deliveryTo` is included only when a delivery address is explicitly provided.
- **Plain-language results.** Technical HTTP status codes are translated into plain-language messages for users.

---



## Architecture

Red has two hosted MCP interfaces, each with its own tool registry.


| Interface | Address | Registry |
| --- | --- | --- |
| Normal Red | `https://red.bigredcloud.com/mcp` | Full tool registry, including create, update, delete, batch and email where the deployment enables them |
| Microsoft 365 Copilot | `https://red.bigredcloud.com/mcp/copilot` | Separate read-only accounting facade, plus help and company-management navigation |


Local stdio (`src/index.ts`, `node build/index.js`) uses the same full registry as `/mcp`. Hosted HTTP is `src/remote.ts`. `/mcp` registers that full registry and keeps request routing, `routeToken` checks, and preview-before-posting confirmation on protected writes. `/mcp/copilot` registers only its own read-only facade. It does not register accounting create, update or delete tools.


Key shared modules:

- `src/server.ts` — MCP server factory and stdio singleton
- `src/register_all_tools.ts` — central tool registration; skips tools whose skill group is disabled, and wraps write tools with routing and preview-before-posting/confirmation handling
- `src/config/server_config.ts` — deployment skill gating driven by the `BRC_ALLOW_*` flags
- `src/config/mcp_config.ts` — MCP server instructions, connection-safety rules, help-answer rules, and connectionRef presentation rules
- `src/routing/` — request classification and short-lived `routeToken` issuance/validation for transactional tools
- `src/shared.ts` — Big Red Cloud HTTP client, connection handling, audit log, and helpers
- `src/read_connection_metadata.ts` — connection status metadata echoed on tool responses (including `activeConnectionRef` for hosted clients)
- `src/auth/connection_presentation.ts` — user-facing TTL wording and assistant presentation hints
- `src/auth/credential_validation.ts` — BRC read validation before storing company connection credentials
- `src/guards/` — transaction, reference, VAT category, product line, and write-confirmation safety checks
- `src/auth/` — secure connection flow, connection store (memory or Cosmos), connection page, and credential persistence
- `src/telemetry/` — anonymous client/session identity and platform detection for hosted operational telemetry
- `src/brc-edu/` — Freshdesk articles, customer documentation, webinar indexes, screenshots, and unified help search
- `src/edu/` — shared help-resource loading, enrichment, workbook parsing, and storage configuration
- `src/tools/edu/` — read-only help tools
- `src/tools/routing/` — request-routing tool registration

Domain logic lives under `src/tools/`, with generic create/update/delete/list/batch helpers in `src/tools/general/`.

### Technology

- TypeScript / Node.js (ES modules)
- `@modelcontextprotocol/sdk`
- Zod for tool input validation
- Express + Streamable HTTP for hosted mode

---



## Requirements

- Node.js 24 or newer (`engines` in `package.json`; the hosted Linux app uses Node 24).
- npm (bundled with Node.js).

---



## Installation

```bash
npm install
npm run build
```

If a `.env.example` file is provided, copy it to `.env` and adjust the values:

```bash
cp .env.example .env
```

Never commit your `.env` file or any real credentials.

---



## Running

Hosted HTTP server:

```bash
npm run start
# Serves the MCP endpoint at http://localhost:3000/mcp
```

Local stdio server:

```bash
npm run start:local
```

Opening the HTTP endpoint in a browser without an MCP session returns an error — that is expected.

### Microsoft Copilot (optional)

A hosted deployment can expose `/mcp/copilot` for Microsoft 365 Copilot as a [federated connector](https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/set-up-custom-federated-connectors). That path uses Microsoft Entra sign-in. Company API keys are still entered on the Red connection page and stored for the signed-in Microsoft user. Setup is in [docs/copilot-entra-sso.md](docs/copilot-entra-sso.md).

The production Copilot address is `https://red.bigredcloud.com/mcp/copilot`.

The Copilot connector is read-only. It can search and retrieve supported Big Red Cloud data, but it does not create, update or delete records. That limit comes from the current Microsoft federated connector, not from the absence of write tools in Red. Create, update and delete on Copilot are expected to follow when Microsoft supports them. Until then, those actions stay on `/mcp` for ChatGPT, Claude and Mistral.

### MCP client configuration

Local stdio (the client spawns the process):

```json
{
  "mcpServers": {
    "red-mcp-server": {
      "command": "node",
      "args": ["build/index.js"],
      "env": {
        "BRC_API_BASE_URL": "https://app.bigredcloud.com/api"
      }
    }
  }
}
```

Hosted HTTP (production):

For the hosted Big Red Cloud Red service, customers should use:

`https://red.bigredcloud.com/mcp`

```json
{
  "mcpServers": {
    "red-mcp-server": {
      "url": "https://red.bigredcloud.com/mcp"
    }
  }
}
```

Hosted HTTP (local development):

```json
{
  "mcpServers": {
    "red-mcp-server": {
      "url": "http://localhost:3000/mcp"
    }
  }
}
```

---



## Development and regression testing


| Script            | Command                    | Purpose                                     |
| ----------------- | -------------------------- | ------------------------------------------- |
| Build             | `npm run build`            | Compile TypeScript to `build/`              |
| Dev HTTP          | `npm run dev`              | Run the HTTP server from source with `tsx`  |
| Dev stdio         | `npm run dev:local`        | Run the stdio server from source with `tsx` |
| All tests         | `npm test`                 | Build, then run the full test suite         |
| Unit tests        | `npm run test:unit`        | Unit tests only                             |
| Security tests    | `npm run test:security`    | Security-focused tests                      |
| Config tests      | `npm run test:config`      | Deployment/config tests                     |
| Integration tests | `npm run test:integration` | Integration tests                           |
| Production audit  | `npm run audit:prod`       | `npm audit` for production dependencies     |


Tests cover the safety guards described above, including sales invoice checks, transaction date validation, the secure connection flow (CSV validation, partial confirm, credential invalidation), connectionRef presentation rules, request routing, TTL wording, and response wording.

---



## Environment variables

Customers of the hosted Red service do not configure its environment. ChatGPT, Claude and Mistral use `https://red.bigredcloud.com/mcp`. Microsoft 365 Copilot uses `https://red.bigredcloud.com/mcp/copilot`.

Operators who self-host Red set environment variables for that process. The canonical list, including which settings are optional, platform-managed, or secret, is [docs/environment-variables.md](docs/environment-variables.md). `.env.example` is a placeholder template only. Never commit real secrets.

On `/mcp`, deployment skill flags (`BRC_ALLOW_*`) choose which tool groups are registered. The Copilot facade keeps its own read-only catalogue and does not follow those write flags. `brc_get_deployment_policy` summarises customer-facing availability for the normal registry.

---



## Connecting a company

Customers should connect companies through the **secure Red connection page**. Company connection credentials must not be sent through chat — they are entered only on the secure Red connection page, not in the chat window.

Customers can get or regenerate their company API keys in Big Red Cloud under **Administration → API Keys**.

The flow is:

1. Ask the assistant to start a company connection. It returns a secure connection page link.
2. On that page, enter a single company, manually enter multiple companies, **or upload a CSV** for several companies at once. Company connection credentials are entered on the secure page, not in chat.
3. The server validates each credential against Big Red Cloud **before storing it**. Credentials that fail validation are not saved.
4. Return to the chat and provide the **confirmation code** shown on the success page.
5. After confirm, the assistant reports which companies connected and which failed (if any). Invalid credentials appear in `failedCompanies` immediately — you do not need to run a lookup first to discover a bad key.

Connection links are **one-time use**. Connected companies stay available for about the configured session duration (`BRC_API_KEY_TTL_MINUTES`, for example 240 minutes → about four hours), unless you disconnect or the connection expires.

### Hosted HTTP and `connectionRef`

In hosted HTTP mode (for example Mistral/Vibe), `brc_confirm_company_connection` returns an opaque `connectionRef` in the tool JSON. MCP clients should preserve and silently reuse `connectionRef` / `activeConnectionRef` on later tool calls when the platform rotates session IDs. Connection persistence survives MCP session rotation where supported. This is an implementation detail for the client — **assistants should not show** `connectionRef` **or** `redconn_…` **values to end users**. Tool responses include `assistantInstruction` / `presentationHint` fields to reinforce that rule.

Helper tools:

- List connected companies in the session
- Clear one company connection
- Clear all company connections

---



## Privacy-safe telemetry

On hosted deployments, Red may record anonymous operational telemetry so operators can understand approximate usage. Typical dimensions include anonymous client and connection-session identifiers, detected platform, deployment environment, tool name, and connected-company count.

Telemetry does **not** include API keys, credentials, raw `connectionRef` values, authorisation headers, request bodies, or invoice/customer/supplier payloads. Failed Big Red Cloud calls may include safe identifiers such as `company_id` or `record_id`. Anonymous telemetry is not a verified Big Red Cloud user identity. Microsoft 365 Copilot uses verified Microsoft sign-in to decide which companies that user may access. That sign-in is separate from the anonymous telemetry described here.

Details for operators and developers: [docs/TELEMETRY.md](docs/TELEMETRY.md).

---



## Tool coverage

Red exposes a focused set of MCP tools, grouped by domain. Exact tool names and their endpoint mappings live in the source code under `src/tools/` and are summarised for developers in [docs/TOOLS.md](docs/TOOLS.md).

- **Company setup and readiness** — company setup configuration, financial year, processing settings, readiness checks, transaction date validation, and account-history document-type resolution.
- **Customers and suppliers** — list/get/create/update/delete plus opening balances and account transactions.
- **Products and sales reps** — list/get/create/update/delete and product types.
- **Sales documents** — quotes, sales invoices, sales credit notes, and sales entries, including generated-reference variants and generating an invoice from a quote.
- **Purchases and payments** — purchases, payments, cash payments, cash receipts, and bank accounts.
- **VAT and analysis lookups** — VAT rates, VAT categories, VAT types, analysis categories, accounts, and related reference data.
- **Nominal reports** — nominal account listings and grouped/multi-company nominal reporting.
- **Audit and session** — session connection management, the session audit log, and the downloadable support diagnostic.
- **Help and training** — Freshdesk articles, customer documentation, recorded webinars, upcoming webinars, and screenshot links through read-only help tools. No company connection is required.

Batch variants exist for the main create workflows and apply the same safety checks as the single-record tools.

### Company readiness check

`brc_company_readiness_check` is a read-only overall health check for a connected company. Overall statuses are:

- `ready`
- `ready_with_warnings`
- `not_ready`
- `connection_problem`

It reviews connection status plus relevant setup such as financial year, transaction date position, active Sales VAT rates, Sales Analysis categories, products, and sales representatives. Missing suppliers is reported as a purchase-setup warning and does **not** block sales-invoice readiness. Manual reference settings are treated as a warning / preflight consideration, not necessarily a blocker.

For a specific VAT-sensitive workflow (sales invoice, purchase, cash receipt, statement), use `brc_check_transaction_settings` instead — that tool checks one workflow’s processing settings, while readiness scores overall company readiness. Narrower helpers such as `brc_validate_transaction_date`, `brc_get_company_processing_settings`, and `brc_get_company_reference_settings` remain available for focused lookups.

### Support diagnostics

`brc_list_audit_log` shows Red write activity from the current session for currently connected companies. Read-only lookups are not treated as completed changes.

`brc_generate_support_report` creates a downloadable plain-text diagnostic for **one connected company** at a time. If several companies were used, generate a separate report for each. Reports include success/failure and correlation information useful to support. They exclude credentials, API keys, tokens and connection references. Generating a report is read-only and does not write to Big Red Cloud.

Developer details: [docs/TOOLS.md](docs/TOOLS.md) and [docs/TELEMETRY.md](docs/TELEMETRY.md).

### Previous-financial-year behaviour

A transaction date outside the current financial year is a **warning**, not an automatic statement that the operation is impossible. After normal preview and confirmation, Red attempts only the supported action. If Big Red Cloud rejects the action or date, Red reports the actual response. Not every historical transaction can be changed.

### Transaction improvements

- Quote confirmation previews, validation and quote-to-invoice generation (`brc_generate_sales_invoice_from_quote`).
- Cash-receipt VAT handling and ledger preservation on updates.
- Supported cash-payment fields can be corrected on the existing record through the update workflow.
- Account-history lines should be resolved to the correct document type (`brc_resolve_book_transaction_type`) before a document-specific lookup or change.
- Undo, reverse and correct requests are treated as planning first — never as automatic permission to post another transaction.

---



## Help and training resources

Red includes read-only MCP tools for Big Red Cloud help and training questions. They do not require a connected company.

Typical capabilities:

- search official articles, customer documentation, recorded webinars, and upcoming webinars;
- load full details for a selected resource, including step-by-step guidance and relevant screenshot links where available;
- answer reserved help-style questions (including `red-help` / `/red-help` style commands) through the help pipeline.

Help answers may include:

- official Freshdesk articles;
- customer documentation;
- relevant screenshots;
- recorded YouTube training videos;
- upcoming webinar links.

Help-resource indexes are supplied by the deployment operator. The repository includes the operator upload, catalogue and sync implementation used to maintain those indexes. Customers do not configure that workflow.

---



## Known limitations

- Some features depend on how the company is configured in Big Red Cloud.
- Email sending and some bank write operations may require additional tenant configuration and may be disabled by deployment flags.
- Generated-reference behaviour can depend on Big Red Cloud tenant settings, and some generated-document endpoints may apply the tenant's current transaction date. A date outside the current financial year is a warning, not an automatic refusal; the Big Red Cloud response is authoritative.
- Tool availability may vary by deployment policy (disabled skill groups are not registered).
- Anonymous telemetry counts approximate clients (for example browser/device cookies), not verified individual people.
- Platform detection may be `unknown` when a client does not provide enough identifying information.
- Officially supported customer platforms are ChatGPT, Claude, Mistral/Vibe, and Microsoft 365 Copilot. Copilot is a federated connector and is read-only until Microsoft supports write actions on that connector. Other MCP clients are not claimed as supported platforms.

---



## Maintainers

This project is maintained by the Big Red Cloud software development team.

---



## Status

Red is in BETA.
Red is an open-source MCP integration for Big Red Cloud and is under active development. Tool availability and behaviour may change between releases, and some capabilities are gated by deployment policy.

---



## License

This project is licensed under the Apache License 2.0. See LICENSE for details.

---



## Support and responsible disclosure

If you believe you have found a security issue, please report it to Big Red Cloud's support team.