Connecting AI clients

Point Claude, Claude Code, Cursor, or any MCP client at SuperBooks over the remote URL.

SuperBooks is an MCP server, so any MCP-capable client can use it without a plugin or an adapter. The endpoint is:

https://api.superbooks.io/mcp

It speaks Streamable HTTP, and clients connect to that URL directly.

Choosing between a key and OAuth

Clients that support remote MCP servers with OAuth — Claude among them — can sign you in through the SuperBooks consent screen. Nothing to copy, nothing to store, and access is revocable from the app.

Clients that expect a static header want an API key instead. Mint one at Settings → Developer; see Authentication.

Claude

Claude connects over OAuth, so you do not handle a key at all.

Open Settings → Connectors.
Choose Add custom connector.
Enter https://api.superbooks.io/mcp.
Claude registers itself, then sends you to SuperBooks to sign in and approve the scopes it asked for.

The SuperBooks tools then appear in the conversation. Revoke access any time from the same Connectors screen or from the SuperBooks app.

Claude Code

One command, using an API key:

claude mcp add --transport http superbooks https://api.superbooks.io/mcp \
  --header "Authorization: Bearer sb_your_api_key_here"

Then check it is live:

claude mcp list

Cursor

Add SuperBooks to ~/.cursor/mcp.json (global) or .cursor/mcp.json in a project:

{
  "mcpServers": {
    "superbooks": {
      "url": "https://api.superbooks.io/mcp",
      "headers": {
        "Authorization": "Bearer sb_your_api_key_here"
      }
    }
  }
}

Restart Cursor, and the tools appear under Settings → MCP.

Windsurf

Windsurf uses the same shape, in ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "superbooks": {
      "serverUrl": "https://api.superbooks.io/mcp",
      "headers": {
        "Authorization": "Bearer sb_your_api_key_here"
      }
    }
  }
}

The tool surface

45 tools across 12 domains. What a given credential actually sees depends on its scopes — see How scopes gate the tool surface.

Domain	Tools	Destructive	What it covers
`transactions`	5	1	Bank transactions, filtering, categorisation
`invoices`	5	1	Drafting, sending, and voiding invoices
`customers`	5	1	The customer book
`tracker`	5	1	Time-tracking projects and entries
`categories`	4	1	Transaction categories
`documents`	4	1	Uploaded files and their contents
`tags`	3	1	Labels across customers, transactions, projects
`inbox`	3	1	Incoming receipts and bills, and matching them
`reports`	8	0	Revenue, profit and loss, burn rate, runway, spending
`bank_accounts`	1	0	Connected accounts
`search`	1	0	Cross-domain search
`team`	1	0	The current team's profile

The eight destructive tools are the seven *_delete tools plus invoices_void (a soft cancel, not a delete), and they are gated twice over — see Destructive tools need two gates.

Troubleshooting

The client shows no tools, or fails to connect. Check the credential first: a 401 comes back with a WWW-Authenticate header pointing at the OAuth metadata. If you are using a key, confirm it starts with sb_ and still exists in Settings → Developer.

Fewer tools than expected. That is scopes working as designed. A read-only key sees the read tier only. Destructive tools additionally need apis.all plus the team setting.

Requests start failing after heavy use. You may be hitting the limit of 120 requests per minute — see Rate limits.