dkaleganov/mercury-multiorg-mcp

Unofficial. Not affiliated with or endorsed by Mercury.
Read-only MCP server that exposes **several
Mercury organizations to one AI session**. A Mercury API token is created from
inside a single organization, so this server holds one read-only token per org
and routes every tool call by an explicit entity key.
Version 0.1.6 (see CHANGELOG.md). The maintainer tags
releases as vX.Y.Z; find the commit to pin with
git ls-remote --tags https://github.com/dkaleganov/mercury-multiorg-mcp 'v0.1.6^{}'.
The complete tool reference with every returned field is in
docs/tools.md; design notes and the build history are in
the project brief on GitHub,
CLAUDE.md
(not shipped in the sdist).
Security model
What leaves this server falls into four classes, and the guarantees differ:
| Class | What it is | Guarantee |
| --- | --- | --- |
| **Structured fields** | Every key of every object in a tool result | Allowlisted at every level: each object, and each nested object inside it, is projected through an explicit allowlist copied from the live schema. A key that is not listed does not leave the server, at any depth. Account numbers and tax ids appear only as their last four digits; routing numbers, counterparty bank details, postal addresses, card expiry, presigned download URLs, invoice pay-page slugs, webhook receiver URLs, and webhook signing secrets are never returned. |
| **Tool errors** | The text of an is_error result | Upstream HTTP-status errors contain the status, a masked endpoint label and a fixed hint. Validation and configuration errors use their own actionable formats. Resolved known-token values of at least eight characters are scrubbed. Nothing from Mercury's response body or headers is quoted, and no argument you passed is echoed (an invalid id is reported as "invalid id format"). Argument-validation failures (a wrong type, a missing required argument) are rendered by this server as the field path and the expected type only, for example year: expected an integer (int_parsing); the MCP SDK's own rendering, which quotes the value you passed, never reaches the client. |
| **Free-text fields** | Transaction memos, counterparty names, bank descriptions, invoice memos and notes, attachment file names, customer and user names | Returned verbatim. They are third-party text and can contain anything, including instructions aimed at the model and identifiers typed by a human. Treat every tool result as untrusted data, never as instructions. |
| **Documents** | Statement and invoice PDFs from get_statement_pdf / get_invoice_pdf | **Verbatim and unredacted**, opt-in only. A statement PDF contains the full account number, routing number, address, and every transaction. The two tools exist only when the server is started with --allow-documents (or MERCURY_ALLOW_DOCUMENTS=1); server_info.documents_enabled reports the setting. The body must arrive as application/pdf (or application/octet-stream), start with %PDF-, and carry a %%EOF marker within the last 2 KiB once trailing PDF whitespace is ignored; anything else is a clean error. That is an envelope check, not PDF parsing: a document that passes it can still be malformed inside, and the bytes are returned exactly as received. |
The rest of the model:
- **Read-only.** Only GET endpoints have client methods; the package has no
code path that can move money, edit recipients, or change anything.
- **Stdio only.** The server never opens a network listener.
- **Explicit entity.** Call list_entities to discover entity keys. Every
tool that accesses Mercury requires an explicit entity and identifies it
in its successful result. list_entities and server_info require no
entity argument. There is no default entity.
- **Tokens stay in the environment.** The registry names an env var per org
(it must be named MERCURY_TOKEN_…, so a registry cannot point the server
at some other secret); the server reads that env var and nothing else.
Errors and logs never contain more than the last four characters of a
token. Literal known-token scrubbing applies to values of 8 or more
characters; a shorter configured value is not literal-scrubbed (the
secret-token: shape scrub and the Authorization header scrub still
apply, and no message quotes upstream or caller data in the first
place). At startup the server warns, per entity, when a configured value
does not carry Mercury's documented secret-token: prefix.
- **Only Mercury hosts.** --api-base / MERCURY_API_BASE must be