Rillet
by Rillet
Query a live general ledger and post to it from your AI assistant. 81 listed tools across AR, AP, revenue and reporting — and 43 of them write, including 13 that delete accounting records.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Rillet via MCP
https://api.rillet.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Rillet Tools & Capabilities (81)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- Full-replace update semantics are the sharpest hazard here. Rillet flags this as IMPORTANT on its invoice, bill, credit memo, vendor credit, customer and product update endpoints: the operations are PUT, all fields must be present, and an omitted field is set to null, wiping existing data. Rillet's stated remedy is to retrieve the whole record first and resend it.
- No safety annotations could be read. The endpoint returns HTTP 401 to an anonymous client, so the MCP
readOnlyHintanddestructiveHintvalues — the fields a client uses to prompt for confirmation — are unverified for every one of the 81 tools. The read/write split published above is inferred from verb prefixes and Rillet's own endpoint documentation, not from annotations. - The two OAuth scopes are coarse.
writecovers creating invoices, recording payments and deleting records with one grant;readcovers every report and subledger with the other. There is no per-domain or per-destructiveness split of the kind some connectors publish. - Deletion preconditions are advisory only. Rillet documents what to verify before each delete, but those are instructions to a reader, not constraints the API enforces on a caller.
- 60 requests per rolling minute, then HTTP 429 — shared across every integration using the same credentials.
- Pagination is cursor-based and capped. Lists default to 25 records and allow at most 100 per page, and Rillet states cursors expire after two hours. Long ledger walks interact directly with the rate limit.
- API versioning changes underneath you. Rillet documents
X-Rillet-API-Versionas the way to pin behaviour and warns that the no-header default moved from version 1 to the latest version on 1 August 2026. It is not documented whether the MCP server pins a version on your behalf. - Idempotency is opt-in. Rillet supports an
Idempotency-Keyheader on POST requests and stores the response for 24 hours, but nothing states that the MCP server sets one — so a retried create is not automatically safe from duplicating a record. - Multi-book restrictions apply. Rillet documents that only primary and adjustment-overlay
book_idvalues work with report and journal-entry endpoints, and that multi-book support applies to v4 only. - The published tool list is a floor, not a ceiling, and 22 documented mutating operations sit outside it. Scope any deployment to what the OAuth grant and the Rillet user's own permissions allow, not to the 81 names.
Frequently asked questions
Can the Rillet MCP server change my accounting records, or only read them?
It changes them. Anthropic's directory publishes the permission label Read and write, and 43 of the 81 listed tool names are mutating verbs — 12 create, 13 update, 13 delete, plus five one-off actions. Only 38 read. Every financial subledger Rillet exposes has a delete tool attached to it, so this is not a reporting connector with a few writes bolted on.
Does Rillet MCP let an agent post journal entries to the general ledger?
The directory listing does not include one, but Rillet's own API does. Anthropic's snapshot names only list_all_journal_entries, a read. Rillet's published v4 OpenAPI specification documents POST, PUT and DELETE on /journal-entries, and Rillet's connector description advertises creating journal entries by prompt. Treat GL posting as reachable and gate it deliberately.
How many tools does the Rillet MCP server actually expose?
Anthropic's directory lists 81 tool names, but that is a floor rather than a total. Rillet documents the MCP server as implementing the same features as its Public API, whose v4 specification defines 117 operations. Rillet also states an agent only sees tools the signed-in Rillet user can reach, so the real surface varies per user.
Can you connect Rillet MCP with read-only access?
Yes, in principle. Rillet's RFC 9728 resource descriptor advertises exactly two scopes, read and write, so a token can carry read without write. Whether your MCP client lets you decline the write scope at the consent screen is a client question, not a Rillet one. The scopes are coarse: read covers every report and subledger at once.
What happens if I update a Rillet record through an agent?
You may silently erase fields you never mentioned. Rillet marks its update endpoints as full-replace PUT semantics and warns that omitting any field sets it to null, wiping existing data. Its documented remedy is to retrieve the record first and resend every existing field alongside the change. An agent that patches conversationally will not do that by default.
Does Rillet MCP need a paid plan or an admin to switch on?
You need a Rillet account, and API access is not self-serve. Rillet's setup page lists a valid Rillet account as the only stated prerequisite for MCP. Its getting-started guide adds that you contact your Rillet team to enable API access before keys can be created. Authorisation is per organisation — you pick one during the OAuth redirect.
Is there a rate limit on the Rillet MCP server?
Yes. Rillet documents a maximum of 60 API requests over a rolling one-minute window, with requests above that threshold failing with HTTP 429. That budget is shared with any other integration using the same credentials. Agents that fan out across subsidiaries or paginate long ledgers can exhaust it quickly, since list responses default to 25 records per page.
Sources
- Rillet MCP documentation (retrieved 2026-08-20) · retrieved 2026-08-20
- Rillet API getting started, covering authentication, pagination, idempotency and rate limits (retrieved 2026-08-20) · retrieved 2026-08-20
- Rillet documentation index (retrieved 2026-08-20).
robots.txtallows crawling and names this file itself; nollms-full.txtexists (HTTP 404) · retrieved 2026-08-20 - Rillet Accounting API v4 OpenAPI specification, 117 operations (retrieved 2026-08-20) · retrieved 2026-08-20
- Rillet multi-book changelog entry (retrieved 2026-08-20) · retrieved 2026-08-20
- Live OAuth posture check: anonymous
initializeto the endpoint returned HTTP 401 with awww-authenticatechallenge namingresource_metadata; RFC 9728 descriptor atapi.rillet.com/.well-known/oauth-protected-resourcereturned scopesreadandwrite(2026-08-20) · retrieved 2026-08-20 - Anthropic Connectors Directory entry (directory snapshot 2026-08-16) · retrieved 2026-08-16
- Rillet support — <mailto:mcp-support@rillet.com> · Privacy
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Finance
- Developer
- Rillet
- Tools
- 81
- Domain
- api.rillet.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.