Skip to content
Finero
Book a demo
Agents

Connect an AI agent to your receivables

Let an assistant read your ledger and raise payment links, as the person who approved it. It cannot write a word your customers read, cannot delete an invoice or a payment, and cannot ask for more money than an invoice is owed.

Book a demoRead the technical detail

Get started

Tell your assistant

Read getfinero.com/skill.md and connect me to Finero

Or give it the MCP server directly

https://app.getfinero.com/mcp

Works with any assistant that speaks MCP, or any that can read a URL. There is nothing to install: Finero has no CLI, and the skill tells an agent what to do rather than running anything.

One thing has to happen first, and only an administrator can do it: switch on agent connections for the workspace, in Finero under Settings, then API and agents. It is off by default. Leave it off and the assistant will appear to connect, then fail on its first real question.

The rule this is built on

An agent may choose when. It must never choose what.

Invoice text arrives from your customers' systems, so it is treated as data that could be hostile rather than as instructions. Anything an injected instruction could reach is something where picking the moment is harmless. That is why an agent can start a sync, which was going to run anyway, and why raising a payment link is restricted and bounded.

Three ways in

Pick by who is doing the calling, and by how much you want to set up.

An Agent Skill, the simplest way to start

A skill is one page of instructions written for an assistant rather than for you. Give yours getfinero.com/skill.md and it learns what Finero is, what it is allowed to do, and how to connect. There is nothing to install and nothing to configure first. If your assistant keeps skills as files, save it as finero-receivables/SKILL.md.

The MCP server, when a person is present

The session acts as the person who approved it, so the assistant sees exactly the rows they see. Streamable HTTP, authorised with OAuth 2.1, and published to the official MCP registry as com.getfinero/finero, so a client that can resolve a name does not need a URL at all. Detail on the MCP server page.

The HTTP API, when nothing is attended

A key acts as the workspace rather than as a person, which is right for a sync job or a backend service and wrong for an assistant. See the API documentation and how credentials work.

Connecting takes three steps

  1. 01

    An admin opens the workspace to agents

    One switch, in Finero under Settings, then API and agents. It is off until someone turns it on, and while it is off nothing can connect, an administrator included. There are no credentials to create and nothing to hand out: this is the whole of the administrator's part.

  2. 02

    Connect from your own assistant, and approve

    Add Finero as a connector. Your assistant registers itself and sends you to a consent screen naming what it will be able to reach, and which workspace it is joining. Approving is what creates the connection. Consent is recorded per person, so it is one click, once, rather than a prompt every time.

  3. 03

    Ask it something

    "How much is outstanding?" "Which invoices are overdue?" "Did the sync run?" The assistant reads your workspace as you, so it sees exactly the rows you see. To point an agent at Finero without any configuration at all, hand it getfinero.com/skill.md.

What you need to provide

An agent cannot bootstrap itself into your workspace, deliberately. One person has to do one thing first, and it takes about a minute.

  • An administrator, once. Only an admin can open the workspace to agents at all, and only an admin's own connection can write. A member's agent is refused by the database, not by the interface.
  • Nothing to copy. Assistants register themselves, so there is no client ID or secret to mint, hand over or lose. What a person judges the request by is the address the browser will be sent back to, shown on the consent screen. The assistant's own name is shown too, labelled unverified, because it is a claim the assistant makes about itself.
  • Consent, per person. Each person connecting approves once. Their session then carries their own access, which is what lets you revoke one person without disturbing anyone else.

If something goes wrong, look one step later than you expect. A workspace that has not been opened to agents does not stop the assistant connecting. It connects, lists what it can do, and then fails on the first real request. That is authorisation failing, not the connection, and the fix is almost always step one.

For the agent reading this

Everything a machine needs is published and generated, so none of it can drift from what the product does:

The tool list is whatever the server answers at runtime, and the API surface is whatever the specification says. Nothing on this page restates either, because a second copy is the one that goes stale and gets believed.

Agent access is included on every plan. See pricing, or the developer resources for the full technical reference.

See it running on your own receivables.

Book a 30-minute demo to explore how an agent works with Finero and discuss your ERP and payment setup.

30 minutes · No commitment

Questions

What can an AI agent actually do in Finero?

Read the workspace and act on payment links. Reads cover invoices and their ageing, payments and how they were applied, payment links, ERP connections and sync history, which collections automations are configured and what they did, and which payment-link emails are queued or have failed. It can start an ERP sync. The writes are creating and withdrawing a payment link, and rescheduling or cancelling a queued payment-link email; all four require the person who approved the connection to be a workspace administrator. No argument on this surface carries text a customer reads: the emails are the workspace's own fixed template. No invoice, payment or payment link is ever deleted.

Can an agent charge one of my customers?

No. It can create a payment link, which is a URL, and no money moves unless a person chooses to pay it. The amount cannot exceed what that installment still owes, because the database refuses a larger one under a lock rather than trusting the request. Withdrawing a link sets a status and can be reversed immediately. Those three properties are why the write was allowed at all.

What do I need to set up before an agent can connect?

One switch, and only a workspace administrator can flip it: turn on agent connections in Finero under Settings, then API and agents. It is off by default, and while it is off nothing can connect, an administrator included. After that there is nothing to create and no credential to hand out. Each person adds Finero to their own assistant, which registers itself, and approves a consent screen naming what it will reach and which workspace it is joining. Consent is recorded per person, so each user approves once.

What does it look like when the setup step is missed?

The failure appears one stage later than most people look for it. The assistant connects and lists what it can do, and then the first real request fails at authorisation rather than at connection. The usual cause is that agent connections are still switched off for the workspace, or that the person connecting is not a member of it.

Which assistants work with this?

Any client that speaks the Model Context Protocol over Streamable HTTP, which includes Claude. The server is also published to the official MCP registry, so a client that can resolve a name finds it without being handed a URL. For software with nobody present, use the HTTP API with a key instead.

Does an agent see everything in my workspace?

It sees what the person who approved it sees, and no more. A session authenticates as that person rather than as the workspace, so the same row-level rules that apply to them in the browser apply to the agent. That is also why the writes need an administrator to be the person who approved the connection: a member's agent is refused by the database, whatever the assistant asks for.

What stops a malicious instruction hidden in an invoice?

Invoice text arrives from a customer's ERP, so it is data rather than instructions, and the design assumes it may be hostile. Any capability an injected instruction could reach is one where choosing the moment is harmless: starting a sync pulls a set that was going to be pulled anyway, and the agent cannot name a target. The writes are the exception, which is why they are restricted to administrators and bounded three ways.

How do I revoke an agent's access?

Two independent levers, and either is enough. An administrator can revoke a connection in Settings, which deletes that client at the authorization server; it cannot come back, because a fresh registration is a new client needing a new approval. An administrator can also switch agent connections off for the whole workspace. Authorisation is re-checked on every request, so either takes effect immediately rather than when a token happens to expire.