Xero MCP Server — agentic threat model

Not certain from the listing — the MCP server itself is model-agnostic, but the host LLM is vulnerable to indirect prompt injection via malicious invoices or contact records that could reprogram the model's behavior.

The server acts as a direct bridge to Xero's financial databases. Risks include data exfiltration of sensitive ledgers, contacts, and tax documents, as well as data poisoning if the agent writes fraudulent entries.

The core risk lies in tool misuse and insecure tool integration. If the orchestrating framework lacks strict schemas or human-in-the-loop confirmation for write operations, an agent can be manipulated into executing unauthorized financial transactions.

Not certain from the listing — depends entirely on where the MCP host and server are deployed. Risks include insecure storage of OAuth tokens and lack of network isolation between the MCP server and the local environment.

Not certain from the listing — requires robust transaction logging and anomaly detection to identify when an agent is executing unusual financial queries or bulk-exporting ledger data.

Utilizes official Xero OAuth scopes, but security relies on strict token management, least-privilege scope assignment (e.g., read-only vs. write), and adherence to financial compliance standards.

In a multi-agent setup, other less-trusted agents could exploit this MCP server to gain indirect access to the financial system, leading to cascading authorization failures.