MCP
Connect an agent to your tenant. This page describes the token, the endpoint, the methods, and what the agent may read and change.
Connection
- Method
- POST
- Path
- /api/mcp
- Host
- https://api.jupiter-erp.com
- Protocol
- JSON-RPC 2.0, MCP 2025-03-26
- Token
- Bearer token
- Account
- Header, or on the OAuth token
You create a copied token in the panel under Profile → API & MCP. That token requires the X-Account-Uuid header. Without it the endpoint returns 412. If the token is bound to one account, the UUID must match it. If it is not bound, the UUID selects an account you belong to. A session token from sign-in is rejected.
An OAuth token carries the account from consent. The header may be omitted. If the request still sends it, it must match the token. The UUID never belongs in a tool argument.
Access is included in the trial and on the Enterprise plan. Amounts in tool results are cents, the same as the Account API.
The limit is 300 calls per token and 600 per account each minute. The counters are separate from the Account API.
Connect
- 1
Create a token
Under Profile → API & MCP, create a token for the agent and copy the value immediately.
- 2
Enter the endpoint
POST https://api.jupiter-erp.com/api/mcp with Authorization: Bearer. A copied token also sends X-Account-Uuid.
- 3
Load the tools
initialize and tools/list return only the functions this token may use on this tenant.
First request
POST /api/mcp
Authorization: Bearer <token>
X-Account-Uuid: <account-uuid>
Content-Type: application/json
{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"agent","version":"1"}}}Methods
- initialize
- Protocol version, server name, and a short text for the agent.
- tools/list
- The read tools, and call_api for creating and changing records, that this token may use on this account.
- tools/call
- Calls one tool with arguments. If the permission or the module is missing, the response contains no data.
- ping
- Reachability, without reading data.
A message without an id is a notification and returns HTTP 202 with an empty body. A request with an id returns HTTP 200 and a JSON-RPC result.
Without a token the endpoint returns 401. A copied token without X-Account-Uuid returns 412. A session token, another account, a blocked account, or a blocked MCP connection returns 403.
Tools
Short read tools match the Jupiter AI assistant in the panel. call_api runs one Account API route, within the token and the booked module. account_api_routes lists the paths. Amounts in call_api are cents.
| Tool | Permission |
|---|---|
| contacts, contacts_analytics | contacts.read |
| documents, document_payments | read permission of the document type |
| receipts, booking_account_catalog | receipts.read, recurring receipts also need recurring_receipts.read |
| tasks | tasks.read |
| projects | projects.read |
| products | products.read |
| service_entities | read permission of the service type |
| files | files.read and the drive module |
| bank_transactions | bank_transactions.read and the banking module |
| accounting_reports, tax_insights | accounting_reports.read, BWA and open items with their own permission |
| depreciation | depreciation.read |
| warehouses | warehouses.read |
| text_templates | text_templates.read |
| get_account_analytics, product_sales, banking_analytics, time_tracking_analytics, search_entities | only the areas the token may read |
| get_account_subscription, date | a valid token and account |
| jupiter_help | public handbook articles only |
| call_api | the permission of the Account API route being called |
| account_api_routes | a valid token and account |
Limits
call_api accepts only paths under /api/account. Subscription, users, webhooks, and the Jupiter AI assistant chat are closed. A session token is rejected.
What the token may do on the Account API, the agent may do through call_api. A new invoice stays a draft. Uploading a receipt does not start recognition. That is a separate call, and the result stays on the draft.
Each token allows 100 successful creates per day. When the quota is full or the permission is missing, the response contains no data and nothing is stored. Files are passed as Base64.
Downloads
The same description as OpenAPI 3.0. The contract describes the HTTP endpoint, not the business data inside the tools.