Skip to main content
Infinity runs a Model Context Protocol server at https://api.infinity.swiss/mcp. A tool that speaks MCP, such as Claude or Cursor, can use it to read and change accounting, contacts, invoices, and projects. Every tool call runs through the same code as the corresponding REST API endpoint, so behaviour, validation, and error codes are identical. The transport is Streamable HTTP. The server implements MCP revision 2026-07-28 and still answers clients on the 2025 revisions. It is stateless, so nothing is carried over between requests, and it identifies itself as infinity. See Connect a client for setting a tool up, and Tools for what the server offers.

​
Authorisation

Every request carries an OAuth 2.1 access token. Infinity is its own authorisation server, with the issuer https://api.infinity.swiss, and publishes two discovery documents:
  • /.well-known/oauth-protected-resource/mcp describes the MCP resource
  • /.well-known/oauth-authorization-server describes the authorization server
Clients use the authorization code grant with PKCE; S256 is the only accepted challenge method, and the resource parameter must be https://api.infinity.swiss/mcp. The endpoints are /oauth/authorize, /oauth/token, and /oauth/revoke. All clients are public, so no client secret is ever issued. A client identifies itself either with a Client ID Metadata Document, which is what we prefer, or by registering itself at /oauth/register. Nobody has to create a client ID by hand. Redirect URIs must use https, or http on localhost or 127.0.0.1, where any port is accepted so that a desktop tool can listen on a free one. The authorisation request sends the user to Infinity, where they sign in and choose which organisation the tool may work in. Only administrators of an organisation can approve a connection. They then decide per module between no access, read, and read and write, and may grant less than the tool asked for; the token response reports what was actually granted. There is one connection per app and organisation, and approving the same app again replaces the previous grant. The eight scopes follow the modules of the API. module:write implies module:read.
  • accounting:read and accounting:write — chart of accounts, fiscal years, tax codes, ledger entries, and receipts
  • contacts:read and contacts:write — contacts
  • invoices:read and invoices:write — customer invoices and estimates
  • projects:read and projects:write — projects and work entries
Listing tools always returns the full catalogue, whatever the connection holds. A call the connection has no scope for is refused with 403 Forbidden and an insufficient_scope challenge naming the scope it needs, which a client can use to ask for more access.

​
Lifetimes and revocation

An access token is valid for one hour. Refresh tokens rotate on every use, and a refresh token that is used a second time revokes the connection behind it. A connection that goes unused for 90 days expires. An administrator can remove a connection at any time under Settings, Automation, which stops the tool’s tokens working immediately. A client can also hand a token back itself at /oauth/revoke.

​
Rate limits

The limits match the REST API, but count per connection rather than per IP address: 1000 tool calls per hour, and 100 calls per hour for uploading receipts. Beyond that, calls are refused with HTTP status 429 and a body whose error is too_many_requests.