Every MCP tool in the SCOPE compliance index, grouped by server — risk posture, regulatory exposure, and the tools that warrant tighter governance.
3 critical 8 high 14 med · 25 tools · 6 SoD-flagged
regimes APPICCPACOSOGDPRISO_27001LGPDPIPEDAPIPLPOPIASOC2SOXUK_GDPR
Tools needing tighter control (12 of 25)
xero-api.create-payment critical conf highhuman approval
Records a payment against an invoice or bill, settling a receivable or payable and moving cash balances in the general ledger.
xero-api.create-manual-journal critical conf highhuman approval
Posts a journal entry directly to the general ledger, changing reported account balances without any originating source document.
xero-api.update-manual-journal critical conf highhuman approval
Rewrites an existing general-ledger journal entry, altering posted balances and the audit trail auditors rely on to trace period-end adjustments.
xero-api.create-invoice high conf highOBO
Raises a customer invoice, creating an accounts-receivable balance and a revenue-recognition event in the ledger.
xero-api.update-invoice high conf highOBO
Changes line items, amounts or contacts on a draft invoice, shifting the receivable and revenue it will post when approved.
xero-api.create-credit-note high conf highOBO
Issues a credit against a customer or supplier account, reducing recognised revenue or payables for the period.
xero-api.update-credit-note high conf highOBO
Alters the value or allocation of a draft credit note, changing the offset applied against customer balances.
xero-api.create-bank-transaction high conf highOBO
Writes a spend- or receive-money entry against a bank account, changing cash position and the reconciliation an accountant will sign off.
xero-api.update-bank-transaction high conf highOBO
Modifies a recorded bank transaction's amount, account or coding, breaking prior reconciliation and restating cash movements.
xero-api.approve-payroll-timesheet high conf highhuman approval
Approves an employee timesheet so the recorded hours flow into a pay run, committing wage expense without a second reviewer.
xero-api.delete-payroll-timesheet high conf highhuman approval
Destroys an employee's timesheet record, erasing the hours evidence behind wage payments with no recovery path in Xero.
xero-api.revert-payroll-timesheet medium conf mediumhuman approval
Pulls an approved timesheet back to draft, reopening hours that had already cleared payroll review.
All other tools (13)
xero-api.create-contact medium conf highaudit
Adds a customer or supplier record holding personal contact details that will be attached to invoices and payments.
xero-api.create-payroll-timesheet medium conf highaudit
Opens a timesheet for a named employee and pay period, the record that will drive their wage calculation.
xero-api.list-bank-transactions medium conf highaudit
Pulls the organisation's bank account activity, exposing counterparties, amounts and cash position to whoever holds the agent's session.
xero-api.list-contacts medium conf highaudit
Returns the organisation's customer and supplier contacts with names, emails, phone numbers and addresses in bulk.
xero-api.list-payments medium conf highaudit
Reads the payment history across invoices and bills, revealing who was paid, when and how much.
xero-api.list-payroll-employee-leave medium conf mediumaudit
Exposes an employee's leave history, which can reveal sick-leave and other sensitive absence patterns tied to a named individual.
xero-api.list-payroll-employees medium conf highaudit
Returns the full payroll employee roster with identifying and employment details, a bulk staff-PII read in one call.
xero-api.list-profit-and-loss medium conf highaudit
Returns the organisation's income statement, surfacing unpublished revenue and margin figures for the requested period.
xero-api.list-report-balance-sheet medium conf highaudit
Returns assets, liabilities and equity as reported, exposing the financial position before it is externally published.
xero-api.list-timesheets medium conf mediumaudit
Lists payroll timesheets across employees, exposing per-person working hours and pay-period activity.
xero-api.list-trial-balance medium conf highaudit
Returns every ledger account balance used to close the books, the working set behind statutory reporting.
xero-api.update-contact medium conf highaudit
Overwrites a contact's personal and banking details, which determines where invoices are sent and payments are directed.
xero-api.update-payroll-timesheet-line medium conf highaudit
Changes the hours or earnings rate on a timesheet line, directly adjusting what an identified employee will be paid.