wint-mcp

An MCP server that lets an AI assistant handle the day-to-day of your Wint bookkeeping. It reads to-dos, receipts, supplier invoices, ledger transactions, reports and bank balances. It can finish and submit receipts, send in new receipts and documents, approve supplier invoices, and attach documents to payments that are missing one. You log in with BankID through a small login panel shown right in the chat.

It covers the everyday work of a small company owner, not all of Wint. Customer invoicing, salaries, annual accounts and settings are not included. Contributions that add them are welcome.

Unofficial. This is not affiliated with Wint or BankID. Wint publishes an OpenAPI description of its API, but the BankID login and the to-do list used here come from Wint's own web app and are not documented. Either can change or break at any time. Automated use may be against Wint's terms. Use at your own risk.

What it can do

Tools that change things (marked ✎):

Every change takes two steps. Without confirm the tool only returns a preview of what would be sent. With confirm=true it is sent to Wint, and that changes the company's bookkeeping. Nothing can be paid with BankID, sent to customers or deleted, except attachments on a receipt you are editing. The file can come from:

• the upload panel (upload_document), which gives each file an upload_id

• file_url, an https:// link the server downloads (public addresses only)

• file_base64, the file content itself

Files are PDFs or images, up to 10 MB each. Uploaded files are kept for one hour.

Related MCP server: billy-mcp

The login panel

connect_wint returns an interactive MCP Apps panel instead of a link:

• On a computer it shows a live BankID QR code. Scan it with the BankID app.

• On a phone it shows an Open BankID button that opens the BankID app on the same device.

The login only starts when the panel asks for it, because BankID cancels a login the app hasn't picked up within about 30 seconds. A new QR code is started automatically if nobody scans in time.

After the login, the server keeps Wint's refresh token and gets a new access token when the old one expires (about every 10 minutes). You stay logged in for as long as Wint keeps accepting the refresh token, or until --max-session-hours has passed.

You need a client that renders MCP Apps panels, such as ChatGPT. In other clients you can log in by running the server locally once in a client that has panels. The session is stored in the data directory, so other clients that use the same directory get the same session.

Install

Requires Python 3.12+ and uv.

git clone https://github.com/truls27a/wint-mcp.git
cd wint-mcp
uv sync
uv run wint-mcp --help

Local clients (stdio)

For a client that starts the server itself, add something like this to its MCP config:

{
  "mcpServers": {
    "wint": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/wint-mcp", "wint-mcp"]
    }
  }
}

Remote clients (HTTP)

WINT_MCP_TOKEN="$(openssl rand -hex 32)" uv run wint-mcp --transport http --port 8000

The MCP endpoint is http://127.0.0.1:8000/mcp, and /healthz is a health check.

• By default it listens on 127.0.0.1 only.

• If WINT_MCP_TOKEN is set, every request must send Authorization: Bearer <token>.

• It refuses to listen on a non-loopback address without a token. The exception is --allow-unauthenticated, meant for a private container network where the only way in is a tunnel you control.

ChatGPT needs to reach the server over the internet. Put it behind a tunnel or reverse proxy that handles authentication, and never expose an unauthenticated port.

Docker

docker build -t wint-mcp .
docker run -d --name wint-mcp -p 127.0.0.1:8000:8000 \
  -e WINT_MCP_TOKEN=change-me -v wint-mcp-data:/data wint-mcp

Configuration

Security

Read this before you run it.

• One user per server. The server stores one Wint session. Anyone who can call the server can read that person's bookkeeping for every company they have in Wint, and can attach documents to missing documents, submit receipts and approve supplier invoices. Run your own instance and keep it private.

• The stored session can do more than this server does. The refresh token belongs to a normal Wint web session, which can also approve invoices and change bookkeeping data. In Wint, payouts and salaries need a separate BankID signature. Anyone who gets hold of the data directory can use the session until Wint stops accepting it. The directory is created 0700 and the database 0600. Use disconnect_wint, and consider --max-session-hours.

• No credentials are stored. Login is BankID only. The server never sees a password, and it does not store your personal identity number.

• Prompt injection. Supplier names, receipt texts and file names come from Wint and from documents. The server tells the model to treat them as data, and every change needs an explicit confirmation.

Limitations

• Endpoints and response shapes are reverse-engineered and may change without notice.

• Dimensions (cost centres, projects) and invoice periodisation can't be set. If Wint requires them for a company, finish that item in Wint.

• Supplier invoices can be approved, not rejected or sent back.

• Wint has no logout endpoint for this kind of session. disconnect_wint deletes the stored tokens, and Wint expires them on its own.

License

MIT