Pluto MCP server

A Model Context Protocol server that lets an AI assistant (Claude Desktop, Cursor, ChatGPT, …) read and act on your Pluto Suite books.

It's a thin bridge onto the Pluto public API: every tool call is an authenticated request to https://api.plutosuite.com using your plt_ API key. The key is business-scoped and subject to the public-API allowlist + RBAC (a read key can only read; a write key can create).

Tools

Read: list_invoices, get_invoice, list_receipts, list_transactions, list_trips, list_customers, list_vendors, list_bills, list_jobs, get_report (summary / P&L / GST / cash flow). Write (needs a write-scoped key): create_customer, create_invoice.

Setup

1. In Pluto → Settings → Developers, create an API key (read or write) and copy the plt_… value. It is shown once.

2. Add this to your assistant's MCP config. For Claude Desktop that is claude_desktop_config.json; for Cursor, the same block under mcpServers. Restart the app.

   {
     "mcpServers": {
       "pluto": {
         "command": "npx",
         "args": ["-y", "pluto-mcp-server"],
         "env": { "PLUTO_API_KEY": "plt_your_key_here" }
       }
     }
   }

   No install or build step: npx fetches the package on first run.

3. Ask away — e.g. “What's my net income this month?”, “List unpaid invoices”, “Create a customer named Acme Corp.”

Your key never leaves your machine. It sits in the env block above, which your assistant reads locally and sends only to https://api.plutosuite.com.

From source (contributors)

npm install && npm run build

then point command at node and args at the absolute path of dist/index.js.

Publishing (maintainers)

The package is publish-ready (files = dist + README + LICENSE; publishConfig.access = public).

cd mcp-server
npm pack --dry-run       # MUST list dist/index.js — see below
npm login                # one-time, your npm account
npm publish              # prepublishOnly builds first, then ships

prepublishOnly runs npm run build, so the compiled output cannot be forgotten. That matters: files ships dist, dist is gitignored, and before that hook existed a publish produced a tarball of three files with no code in it and a bin pointing at nothing. npm pack --dry-run does NOT run prepublishOnly, so it lists dist only if you have built locally — on a clean checkout an empty listing there is expected, and the real check is the file list npm prints immediately before it uploads.

Bump version in package.json before each publish (npm version patch|minor).

Config

| Env | Required | Default | |-----|----------|---------| | PLUTO_API_KEY | yes | — | | PLUTO_API_BASE | no | https://api.plutosuite.com |

Notes

• Read keys map to ACCOUNTANT, write keys to ADMIN — endpoint RBAC still applies, and billing/team/payroll/settings are never reachable via an API key.
• Run npm run dev to iterate with tsx without building.