Mercury

Mercury

This connector reads your Mercury organization through the official Mercury API (https://api.mercury.com/api/v1): organization, bank accounts and balances, transactions, cards, statements, recipients, Treasury, credit accounts, users, custom categories and payment requests awaiting approval. Three small actions are included and installed switched off: freeze a card, unfreeze a card and set a transaction's note or category.

It cannot send money, by design. There is no tool for payments, transfers, internal transfers, payment requests, recipients, invoices or cards to be created, not even a switched-off one. Mercury's own send-money endpoints are not used at all.

Setup (about 3 minutes)

1. Sign in to https://app.mercury.com, click your organization at the top left, then Settings, then Tokens (https://app.mercury.com/settings/tokens). You need a user allowed to create API tokens; ask an admin otherwise.
2. Click Create an API Token and choose Read Only. A Read Only token can read all data, cannot move money and needs no IP allow-list.
3. Copy the token into MERCURY_API_TOKEN. It looks like secret-token:mercury_production_...; paste the whole value including secret-token:. Mercury shows it only once.
4. Install and run mercury_get_organization.

Read-only by default. With a Read Only token every write is refused by Mercury. The switched-off tools mercury_freeze_card, mercury_unfreeze_card and mercury_update_transaction need a Custom token with the matching write scopes, and Mercury requires an IP allow-list for any write scope: on AnythingMCP Cloud, ask support for the current outgoing IP address first. Never give this connector a Read and Write token: it can send money without approval. Mercury downgrades tokens that do not use their write permission for 45 days and deletes tokens unused for 45 days.

Financial data is sensitive. Balances, transactions, statements, recipients and employees are confidential company data. Share this MCP server only with people allowed to see them, read only what the user asks for and do not copy it elsewhere. Account numbers, routing numbers, IBANs and card numbers are removed from every answer; statements and transaction attachments carry download links instead.

Writes: confirm first. Before mercury_freeze_card, mercury_unfreeze_card or mercury_update_transaction, show the user what will change and wait for a clear yes.

How to work

1. Start with mercury_get_organization and mercury_list_accounts (account ids and balances); mercury_get_account for one account.
2. Transactions: mercury_list_account_transactions for one account (last 30 days unless you pass start), mercury_list_transactions across accounts with filters, mercury_get_transaction for one with attachments. Use mercury_list_categories for category ids.
3. Cards: mercury_list_cards, mercury_get_card, mercury_list_account_cards; actions mercury_freeze_card, mercury_unfreeze_card.
4. Statements: mercury_list_account_statements.
5. Payees and approvals: mercury_list_recipients, mercury_get_recipient, mercury_list_payment_approval_requests (read only).
6. Treasury and credit: mercury_list_treasury_accounts, mercury_list_treasury_transactions, mercury_list_treasury_statements, mercury_list_credit_accounts.
7. People: mercury_list_users.
8. Notes and categories: mercury_update_transaction.

Amounts are decimal numbers in dollars, negative for money going out. A card transaction's merchant.amount is in the smallest unit of the merchant currency.

Paging: most lists answer with page.nextPage; pass it as start_after for the next page. mercury_list_account_transactions pages with offset and reports total. Treasury transactions page with cursor.

Sandbox: create a sandbox at https://sandbox.mercury.com/signup, make a token there and change the connector's base URL to https://api-sandbox.mercury.com/api/v1. Production tokens do not work in the sandbox.

Common errors

• 401 noTokenInDB: the token is wrong, deleted (unused for 45 days) or from the other environment.
• 403: the token's type or scopes do not allow this call, or a write came from an IP address that is not on the token's allow-list.
• 404: the id does not exist.

Out of scope: sending money, payment requests, transfers, recipients, invoices and customers, creating or cancelling cards, changing spend limits, webhooks, SAFEs and uploading attachments.