Skip to main content
Melso Agents is available only internally or by private invitation. Agents-specific features require existing access. For the autónomo fiscal service, see Get started.
Connect to https://melso.ai/api/mcp using Streamable HTTP and explicit OAuth consent. For setup, start with Connect Melso MCP. The endpoint contracts live in the MCP API reference and OAuth API reference.

​
Transport and discovery

Clients using the supported 2025-11-25 format initialize the connection, negotiate the protocol version and list the available tools. Send MCP-Protocol-Version with the negotiated value and accept application/json, text/event-stream. Responses may be JSON or SSE; read Results before interpreting success. The server also supports the 2026-07-28 request format without initialization. Those requests carry the protocol version and client capabilities in params._meta, with matching MCP-Protocol-Version and Mcp-Method headers, plus Mcp-Name for tool calls. Use your client’s protocol implementation; changing the version header alone does not construct that request format. tools/list contains the small core catalog for the authenticated connection. Advanced operations are absent from that list: search with tools_search, inspect the returned name and input schema, then invoke them through tools_call. Connected-app tool names and schemas come from the live search result. Do not invent a name or reuse a schema from another account. The tool catalog separates fiscal procedures from private Agents and managed-Run tools and gives their availability. The live catalog can be narrower because membership, service access and execution context also apply.

​
Actors and company binding

An OAuth grant acts for its person in the single company selected at consent. An active Run token acts in its Task’s company with execution-scoped access. Personal access tokens and company API keys are not MCP credentials. Membership and resource access are rechecked on calls. Do not send X-Workspace-ID with an MCP grant. A workspace tool argument is accepted only when it names the connection’s own company by ID or slug; another company is refused. To change companies, authorize another connection. Uploads use the same binding. People can inspect and disconnect their grants in Settings → MCP. ask_user, request_approval and tasks_watch are managed-context tools; external OAuth clients do not list them. External clients read pending interactions through their available Task tools. Use the per-tool availability column to distinguish OAuth-only operations from Run tools.

​
Fiscal procedures

Melso MCP supports record queries, expense registration, invoice preparation and fiscal-calendar queries for eligible accounts. These are tools for procedures with Hacienda, not a claim that every government procedure can run through MCP. Client compatibility does not imply a partnership. No customer MCP tool approves, files or pays. Invoice tools can prepare a draft and return an approval link. Tax tools can prepare a preview or an import file. Payment recording records money already received. A person authorizes the exact saved version in the app, and Melso professionals review and submit included returns under the required authority. Check the actual external reference and receipt before reporting filing.

​
Company knowledge and Artifacts

Existing Agents integrations can use permitted Library and Artifact tools. An isolated Run has no shared Library or Artifact access. Artifact upload, private preview and publication are separate actions; inspect the returned access settings before sharing a link. See Knowledge and Artifacts. Public metadata requests carry no credentials or company headers:
Use authorization_endpoint from authorization-server metadata for the browser consent flow. The signed-in GET and POST /api/oauth/mcp/authorize routes support that consent screen; they are not client authorization URLs or substitutes for the person’s consent. These docs use /api/mcp and /api/mcp/upload-file, /api/mcp/upload-secret, and /api/mcp/upload-skill. The /mcp route and matching /mcp/upload-* routes are aliases of the same handlers and permissions. They do not provide another product or broader access. The /mcp alias has protected-resource metadata at /.well-known/oauth-protected-resource/mcp; /api/mcp has it at /.well-known/oauth-protected-resource/api/mcp. Discover metadata for the endpoint you configure and keep that URL throughout the flow.