Entendre
by Entendre
Query and post to crypto-native accounting books from your AI assistant. Three tools — a directory lister, a file reader and a code executor — front 248 API operations. The directory record carries no permissions label in front of arbitrary code execution.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Entendre via MCP
https://mcp.entendre.finance/api/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Entendre Tools & Capabilities (3)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- The directory record carries no permissions label. The field is absent, not empty. In front of a tool Entendre itself documents as write-capable, that is the most consequential instance of the unlabelled-surface pattern this catalogue has found. Judge the connector from Entendre's docs.
- The tool names mislead in the other direction.
list_directoryandread_filereach an API catalog, not a disk — Entendre says so, and says so again in its troubleshooting. The three names together are not a remote shell. - The scope split is two tiers wide, and OAuth grants the broader one. Entendre documents the Claude connector as granting
apis.all. There is no read-only assistant configuration on that path short of using an API key you have separately constrained. - Sandbox containment is documented, not verified by us. Entendre states the key is injected at the proxy after the sandbox boundary and never seen by the sandbox process. Testing that would mean authenticating and executing code, which we do not do. It is a credible, specific claim — and still a claim.
- The sandbox's resource and egress limits are undocumented. No memory ceiling, no execution time budget, and no statement of whether outbound network access is confined to Entendre's own API.
- We could not verify tool behaviour ourselves. The endpoint returns 401 to an anonymous handshake, so no schemas and no
readOnlyHintordestructiveHintannotations were readable. Every description here is Entendre's own. - Prompts are unconfirmed. Anthropic's snapshot lists none, and the gated endpoint blocked our own check.
- Approval enforcement is your client's job. Entendre states plainly that the server cannot prove a client showed a per-operation prompt. If your client does not gate
execute_code, nothing else will. - Rate limits are tight for multi-step work: a 60-request burst and one request per second sustained, per key. Entendre notes a single question can fire five to ten tool calls.
- Three concurrent sessions per organization by default, each released after ten minutes idle.
- One organization per connection. Covering a second means adding the connector again.
entendre.airestricts AI training. Its robots.txt carriesContent-Signal: search=yes,ai-train=no,use=referenceand separately disallows several named AI crawlers. This page cites and links rather than reproducing, consistent with reference use.
Frequently asked questions
Where does Entendre's execute_code tool actually run the code?
In a server-side sandbox Entendre operates, not on your machine and not in your own cloud. Entendre's documentation describes an isolated sandbox bound to one MCP connection, and its unauthenticated health endpoint independently reports Vercel as the sandbox provider. Nothing runs locally, and no code touches infrastructure you administer.
Can the Entendre MCP server read files on my computer?
No. Despite the names, list_directory and read_file do not reach your disk. Entendre documents them as navigating a virtual catalog of its own API operations — the directory lists domains such as transactions and reports, and the reader returns a TypeScript signature with its documentation comment. There is no path from either tool to your local filesystem.
Does the Entendre connector's code sandbox see my API key?
Entendre states it does not. Its documentation says the bearer credential is injected at the outbound network proxy, after the sandbox boundary, so the sandbox process never holds the raw key. That is a containment claim we could not test without authenticating. Treat it as Entendre's documented design rather than something independently verified here.
What can an agent change in my Entendre books through MCP?
A great deal. Entendre documents 248 operations across 36 domains reachable through generated code, including posting, reversing and unposting journal entries, bulk transaction updates, and closing or reopening accounting periods. Entendre excludes irreversible hard-deletes and API-key revocation from the agent catalog, but everything else is a live ledger write.
Why does the Anthropic directory listing for Entendre show no permissions label?
Anthropic's 2026-08-16 snapshot simply carries no permissions field for this record — the key is absent rather than empty. That is a gap in the listing, not a statement by Entendre, whose own documentation is explicit that one tool is write-capable. Read Entendre's docs for the real reach; the directory row understates it by omission.
What OAuth scopes does the Entendre MCP server request?
Two, and only two. Entendre's authorization server advertises apis.read for read-only access to v1 resources and apis.all for full read and write. Its documentation states any other value is rejected. Entendre also documents that the Claude custom connector grants the broader of the pair, so an OAuth connection is read-write by default.
Is an Entendre MCP connection limited to one organization?
Yes. Entendre documents that you choose an organization during the authorization step and the connection is bound to that single org, never to all of them at once. Reaching a second organization means adding the connector again and picking that one. Entendre also caps each organization at three concurrent sessions by default.
Sources
- Entendre MCP integration documentation — https://entendre.ai/docs/api-reference/mcp-integration (fetched 2026-08-19 as Markdown via the
.mdsuffix). The URL Anthropic's directory publishes,https://entendre.ai/docs/api-reference/claude-connector, returns HTTP 308 and redirects here; the.mdform returns 307 to the same destination · retrieved 2026-08-19 - Entendre authentication documentation — https://entendre.ai/docs/api-reference/authentication (fetched 2026-08-19; source of the scope table, the one-day access token and the 90-day rotating refresh token) · retrieved 2026-08-19
- Entendre API introduction — https://entendre.ai/docs/api-reference/introduction (fetched 2026-08-19; source of the crypto-native accounting and treasury description and the
api.entendre.finance/v1base URL) · retrieved 2026-08-19 - Entendre docs machine index — https://entendre.ai/docs/llms.txt (fetched 2026-08-19; 390 entries, confirming the per-operation reference pages behind the 248-operation catalog) · retrieved 2026-08-19
- Entendre sitemap — https://entendre.ai/sitemap.xml (fetched 2026-08-19; 62 URLs, none under
/docs, so the machine index rather than the sitemap is the documentation map) · retrieved 2026-08-19 entendre.ai/robots.txt(fetched 2026-08-19) carriesContent-Signal: search=yes,ai-train=no,use=referenceand disallows several named AI crawlers.entendre.finance/robots.txtreturns HTTP 308 to theentendre.aicopy;mcp.entendre.finance/robots.txtreturns 404 · retrieved 2026-08-19- Live RFC 9728 protected-resource descriptor — https://mcp.entendre.finance/.well-known/oauth-protected-resource (fetched 2026-08-19; the root form, named by the
www-authenticatechallenge. The path-append and path-insert forms both return 404 HTML) · retrieved 2026-08-19 - Live RFC 8414 authorization-server metadata — https://api.entendre.finance/.well-known/oauth-authorization-server (fetched 2026-08-19;
issuer,scopes_supported, PKCE and grant types) · retrieved 2026-08-19 - Live health endpoint — https://mcp.entendre.finance/api/health (fetched 2026-08-19, unauthenticated; reports
sandboxProviderasvercel, production stage, regioniad1, Node 24) · retrieved 2026-08-19 - Live anonymous probe — 2026-08-19: an anonymous POST request to the endpoint returns HTTP 401 with
www-authenticate: Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://mcp.entendre.finance/.well-known/oauth-protected-resource"· retrieved 2026-08-19 - Anthropic, "Code execution with MCP" — https://www.anthropic.com/engineering/code-execution-with-mcp (the pattern Entendre's documentation cites for its three-tool design)
- Anthropic connector directory — https://claude.ai/directory/2041628e-b7b0-4a73-89fa-0a95b952468c (snapshot 2026-08-16; three tools, no
permissionsfield, no prompts) · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Productivity
- Developer
- Entendre
- Tools
- 3
- Domain
- mcp.entendre.finance
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.