Kick

Query and change a Kick bookkeeping ledger: categorize transactions, post journal entries, edit accounts, run reports.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Kick connector does

The Kick MCP server connects a Kick bookkeeping ledger to Claude, ChatGPT and any MCP client. An agent can search transactions, run financial statements, and — with your approval — recategorize transactions, post journal entries and edit the chart of accounts. Twenty of its 39 tools write to live books, each gated behind a preview you confirm before anything saves.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Kick tools (39)

  • financial_accounts_query
  • transactions_query
  • categories_query
  • classes_query
  • counterparties_query
  • rules_query
  • accounting_query
  • opening_balances_query
  • journals_query
  • documents_query
  • documents_download
  • entities_query
  • activity_query
  • tasks_query
  • reports_query
  • context_browse
  • context_resolve
  • transactions_act
  • transactions_transfer_matches_act
  • transactions_document_links_act
  • categories_act
  • classes_act
  • counterparties_act
  • rules_act
  • accounting_act
  • account_groups_act
  • opening_balances_act
  • journals_act
  • documents_act
  • entities_act
  • activity_undo
  • tasks_act
  • list_kick_skills
  • load_kick_skill
  • bills_create
  • bills_update
  • invoices_create
  • invoices_update
  • organization_clients_create

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • Twenty tools write to live accounting records, 16 of them flagged destructive by Kick. The preview gate is the only thing between an agent and a client's ledger, and it is a gate the user must actually read rather than reflexively confirm.
  • Auto-approval defeats the safeguard. The preview-and-confirm design assumes a human inspects each preview. An MCP client configured to always allow Kick's write tools converts a two-step confirmation into a one-step mutation. Kick's own advice runs the other way: treat assistant output as a draft, not an approval.
  • We could not test the gate. The endpoint requires authentication and we did not authenticate, so the preview flow, the tool schemas and the annotations are documented rather than observed.
  • Annotations are hints, not authorization. Kick states plainly that the annotations shown to AI clients are helpful hints and that the server decides what a credential can do. Do not read a tool label as a permission boundary.
  • Plan-gated tools fail late. Class, invoice and bill tools appear in tools/list regardless of plan and return a plan-capability error only at execution, so an agent discovers the gate by hitting it.
  • GL-first workspaces reject category work. Where Kick's GL-first mode is on, category taxonomy tools are blocked outright and transactions must be classified by GL account instead.
  • Prompt injection is a named risk. Kick warns that instructions embedded in external documents, emails or transaction memos may be injection attempts — a live concern for a connector whose read tools ingest documents and memos and whose write tools can act on what they say.
  • Multi-client blast radius. Authorizing all workspaces grants access to future ones as well as current, so a firm-wide grant widens on its own as clients are added.
  • No rate limits are published for this connector. Kick documents a default page limit of 25 and a maximum of 100, but no request throttle.

Frequently asked questions

Can the Kick MCP server change my books, or does it only read them?

It can change them. Twenty of Kick's 39 documented tools are writes, and they reach the ledger itself — transaction categories, journal entries, the chart of accounts and opening balances. Kick gates each one behind a preview: the first call returns a summary and a confirmation token, and nothing is saved until a second call repeats the same input with that token attached.

Does the Kick connector post journal entries?

Yes, directly. The journals tool creates single and bulk manual journal entries with debit and credit lines against a named entity and ledger, and can also update and delete them. Kick documents the same tool as write and destructive. The entry lands in the ledger once you confirm the preview — there is no separate draft or approval queue behind it.

Can the Kick MCP server touch my connected bank accounts?

No. Kick connects banks through Plaid, and no tool in Kick's 39-tool reference reaches that connection — the words Plaid, reconcile and import appear nowhere in it. The one accounts tool, financial accounts query, is documented read-only and lists connected accounts. Adding, removing or repairing a bank feed stays in the Kick web app.

What OAuth scopes does Kick ask for, and can I grant read-only access?

Kick advertises exactly two scopes, mcp:read and mcp:write, and both its protected-resource and authorization-server documents agree on that pair. So read-only access is expressible here, which is unusual — most connectors in this catalogue offer a single all-or-nothing grant. Kick also documents read-only personal access tokens as the safer credential for lookup and reporting work.

Why does a Kick write tool return a preview instead of making the change?

That is the designed behaviour, not a failure. Kick's write tools are preview-first: calling one without a confirmation token returns a summary of the pending action plus a fresh token bound to that exact input. Kick tells users to check the workspace, resource IDs, dates and amounts against the preview, and to confirm only when they match.

Why is my Kick tool list empty in Claude?

Usually the authorization did not finish. Kick's fix is to disconnect Kick on the Claude connectors page and reconnect, completing the flow. Kick also lists four other causes: the credential cannot reach the workspace, the token lacks the mcp:read scope, the relevant Kick feature is off for that workspace, or the client was not restarted after a config change.

Do I need a paid Kick plan to use the MCP server?

Not for the core tools, but two toolsets are plan-gated. Kick documents class tools as requiring the Classes capability and invoice and bill tools as requiring the Accrual Ledger capability — both sit on the Plus plan at $100 a month. Gated tools still appear in the tool list and fail at execution with a plan-capability error rather than being hidden.

Can an accountant use the Kick connector across multiple client workspaces?

Yes, and that is the intended shape. Kick gives each client its own workspace, and at authorization you choose either all workspaces or a named subset. Access never exceeds your own Kick permissions. Because one connection can span several clients' books, Kick tells agents to confirm the active workspace before reading or changing any client data.

Sources

  • Kick, Connect Claude — https://docs.kick.co/ai/mcp/connectors/connect-claude (the directory's documentation URL; fetched 2026-08-21 as Markdown via the .md suffix, HTTP 200, no redirect) · retrieved 2026-08-21
  • Kick, Tool Reference — https://docs.kick.co/ai/developer-tools/mcp/tool-reference (fetched 2026-08-21; source of the 39 tool sections, the per-tool read/write and destructive labels, the confirmation-token flow, and the hard-deletion and account-merge exclusions) · retrieved 2026-08-21
  • Kick, Kick Tool List — https://docs.kick.co/ai/mcp/available-tools (fetched 2026-08-21; the user-facing capability tables with a Read/Write column) · retrieved 2026-08-21
  • Kick, Permissions and Security — https://docs.kick.co/ai/permissions-and-security (fetched 2026-08-21; scopes, PAT guidance, confirmation previews, the annotations-are-not-authorization statement, and the prompt-injection warning) · retrieved 2026-08-21
  • Kick, MCP Troubleshooting — https://docs.kick.co/ai/troubleshooting/mcp-troubleshooting (fetched 2026-08-21; the empty-tool-list and OAuth-failure remedies) · retrieved 2026-08-21
  • Kick, Reference — https://docs.kick.co/ai/developer-tools/mcp/mcp-reference (fetched 2026-08-21; endpoint, PAT bearer format, workspace selection) · retrieved 2026-08-21
  • Kick, Plan Comparison — https://docs.kick.co/reference/plan-comparison (fetched 2026-08-21; the Plus plan at $100/mo carrying classes and the accrual ledger) · retrieved 2026-08-21
  • Kick machine documentation index — https://docs.kick.co/llms.txt and https://docs.kick.co/llms-full.txt (fetched 2026-08-21; the full corpus is roughly 50,700 words and was used to test the bank-feed, reconciliation and import negatives) · retrieved 2026-08-21
  • docs.kick.co/robots.txt (fetched 2026-08-21) allows all crawlers and carries Content-Signal: ai-train=yes, search=yes, ai-input=yes — the publisher expressly permits AI synthesis of this content · retrieved 2026-08-21
  • Live RFC 9728 protected-resource descriptor — https://use.kick.co/.well-known/oauth-protected-resource (fetched 2026-08-21; declares resource, authorization_servers and scopes_supported of mcp:read and mcp:write). The path-append and path-insert forms both return HTTP 200 serving an identical SPA HTML shell, not metadata — only the root form is real · retrieved 2026-08-21
  • Live RFC 8414 authorization-server metadata — https://use.kick.co/.well-known/oauth-authorization-server (fetched 2026-08-21; same two scopes, PKCE S256, dynamic registration, one-hour token lifetime) · retrieved 2026-08-21
  • Live anonymous probe — 2026-08-21: an unauthenticated GET of the endpoint returns HTTP 401 with a www-authenticate Bearer challenge naming resource_metadata and pointing at the root descriptor. No tool was ever called and no authentication was attempted · retrieved 2026-08-21
  • Anthropic connector directory — https://claude.ai/directory/c9ac93e3-2c5b-4419-9e42-3337a43e7307 (snapshot 2026-08-16; source of the 39 tool names, the partner tier, the prose permissions value, the sensitive-data types, and an empty prompt list) · retrieved 2026-08-16
  • Kick support — support@kick.co · Privacy — https://www.kick.co/legal#privacy

More Finance connectors

  • Affinity

    Search your CRM, prep for meetings and update deal records from your AI assistant.

  • Aiera

    Pull earnings-call transcripts, event calendars, SEC filings and company publications into your AI assistant.

  • Airwallex Developer

    Search Airwallex documentation and exercise a sandbox account from an AI agent.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Kick to work.

Connect Kick once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio