Use comma from Claude and ChatGPT
Connect your books to an AI assistant, see exactly what it can do, and know what it asks before it acts. IT admins: start with security; if something is not working, see troubleshooting.
Overview
comma runs a remote Model Context Protocol (MCP) server. Add it to Claude (web, desktop and mobile), Claude Code, or ChatGPT in developer mode, and the assistant can read your reports and do bookkeeping work in your companies by calling comma's tools directly.
https://trycomma.app/api/mcpWhat you need
- A company on the Pro or Premium plan, including the 30-day trial (card required). On the Basic plan the connector refuses every call, reads included, and the books stay fully available in the browser.
- Membership in that company. The assistant works only in companies you belong to.
- Your role in each company decides what the assistant can do there:
| Role | What the assistant can do for you |
|---|---|
| Admin | Everything an accountant can, plus editing the company profile (legal name, business number and other tax-profile details). Inviting people and billing stay in the browser. |
| Accountant | All accounting: post and reverse journals, record and void payments, pay and void bills, reconcile, prepare GST/HST returns and record remittances, close and reopen years. |
| Member | Read the books, create and send invoices, enter bills and vendors, and categorize and book bank transactions. Cannot post manual journals, record payments, void anything, or reconcile. |
| Viewer | Read only: reports, ledgers, documents and the audit log. |
Connecting
Claude (web, desktop and mobile)
- Open Customize › Connectors. Add comma from the connector directory, or choose + › Add custom connector and paste the server URL.
- On a Team or Enterprise plan, an Owner adds the connector first under Organization settings › Connectors; members then choose Connect.
- Sign in to comma and choose Authorize. Once added, the connector also works in the Claude mobile apps.
Claude Code
- Run the command below in a terminal.
- Start Claude Code, run /mcp, choose comma, and complete sign-in in the browser window that opens.
claude mcp add --transport http comma https://trycomma.app/api/mcpChatGPT (developer mode)
- Turn on developer mode under Settings › Security and login.
- Open chatgpt.com/plugins, choose +, paste the server URL, and complete sign-in.
What you authorize
Connecting opens one comma consent screen listing your companies and your role in each. You approve with a single Authorize click: there is no per-permission or per-company choice, because your role is the real limit. comma never grants a connection silently, even when you are already signed in.
Your live role is checked on every call, so a role change or a removal applies to the very next request without reconnecting. If you belong to several companies, the assistant names the company on each call; with one company, it is used automatically.
What the assistant can do
Reads never change anything. Writes go through the same validated services as the web app. Tools marked Claude asks first post, void, send or record a payment, so Claude asks you to approve each call. Tools marked Emails customer send an email to your customer. The tables list the main tools; the assistant sees the full set.
Reports and answers
Every figure is derived from the posted ledger at the moment you ask, never from a cached balance.
| Tool | What it does |
|---|---|
comma_ | Profit and loss, balance sheet, cash flow and trial balance for any period. |
comma_ | Cash, income, outstanding balances, runway and recent activity. |
comma_ | General ledger detail for an account and period. |
comma_ | Who owes you, and how overdue each balance is. |
comma_ | What you owe vendors, by age. |
comma_ | What still stands between a fiscal year and its close. |
comma_ | Who changed what and when, including the assistant's own actions. |
Sales
Drafts book nothing. Sending an invoice posts it and emails it to your customer.
| Tool | What it does |
|---|---|
comma_ | Customers and their contact details. |
comma_ | Invoices by status, customer or date, or one invoice in full. |
comma_ | Customer payments received. |
comma_ | Add a customer. |
comma_ | Create a draft invoice. |
comma_ | Issue an invoice, post it, and email it. |
comma_ | Email a payment reminder for unpaid invoices. |
comma_ | Email a customer statement. |
comma_ | Record a payment you received against invoices. |
comma_ | Issue a credit note, post it, and email it. |
comma_ | Void an invoice and reverse its entries. |
Purchases
Entering a bill posts it to accounts payable; paying it records a payment you made elsewhere.
| Tool | What it does |
|---|---|
comma_ | Vendors and their details. |
comma_ | Bills by status, vendor or date, or one bill in full. |
comma_ | Add a vendor. |
comma_ | Enter a bill and post it. |
comma_ | Record a payment made on a bill. |
comma_ | Void a bill and reverse its entries. |
Banking and reconciliation
Bank rows arrive unreviewed. Reviewing a row is what books it.
| Tool | What it does |
|---|---|
comma_ | Bank and card accounts. |
comma_ | Bank transactions, filtered by review state, account or date. |
comma_ | Open invoices or bills a transaction could settle. |
comma_ | Reconciliation sessions and their status. |
comma_ | Import transactions parsed from a bank statement; they arrive unreviewed. |
comma_ | Set the category on unreviewed transactions, ready for review. |
comma_ | Review a bank transaction, which books it. |
comma_ | Settle an invoice or bill with a bank transaction. |
comma_ | Book a transfer between two of your accounts. |
comma_ | Start reconciling an account against a statement. |
comma_ | Finish a reconciliation. |
comma_ | Void a completed reconciliation. |
Journals and the chart of accounts
Every entry must balance before it posts. A posted entry is corrected by a reversal, never edited.
| Tool | What it does |
|---|---|
comma_ | The chart of accounts. |
comma_ | Journal entries, or one entry with its lines. |
comma_ | Check a proposed entry without saving it. |
comma_ | Add a ledger account. |
comma_ | Save a draft journal entry. |
comma_ | Post a manual journal entry. |
comma_ | Reverse a posted entry, or void a draft. |
GST/HST and period end
Returns are prepared from the tax recorded on your documents. comma records remittances; it never sends them.
| Tool | What it does |
|---|---|
comma_ | GST/HST returns and their status. |
comma_ | The date your books are locked through. |
comma_ | What the next book depreciation run would post. |
comma_ | Each fiscal year's close and reopen history. |
comma_ | Start a GST/HST return for a period. |
comma_ | Freeze a return's figures for review. |
comma_ | Record the GST/HST you paid and post it. |
comma_ | Post a book depreciation run. |
comma_ | Lock or reopen accounting periods. |
comma_ | Close a fiscal year into retained earnings. |
comma_ | Reopen a closed fiscal year. |
What stays in the browser
Some actions stay in the comma web app on purpose. The assistant can tell you where to go: it lists them with comma_secure_actions_list.
- Signing in, two-factor authentication, and deleting your account. Credentials and one-time codes never pass through a connector.
- Creating or deleting a company. Creating one can start a paid subscription; deleting one is irreversible.
- Inviting people, changing roles, and removing members. These decide who can see the books.
- Billing and your subscription. Financial commitments are confirmed by the billing owner.
- Document branding. A logo and accent colour need a person looking at the result.
- Reviewing and revoking connections, and approving a new one. These change the security boundary itself (Settings › Connections).
- Linking a bank through Plaid, and connecting a Gmail or Outlook mailbox. Each is a sign-in with the provider; its credentials never reach a connector.
- Permanently deleting an account's history. An irreversible purge under an admin's typed confirmation. A connector can preview and archive instead.
- Settings other than the company profile. Sales-tax registrations, report layouts, roles, security and audit settings are readable but not changeable through a connector.
Settings are read-only through the connector, apart from the company profile, which an admin can update with comma_company_update.
Safety
- Approval before it posts. Tools that post, void, send or record a payment are flagged as destructive, so Claude asks you to approve each call. If you set a tool to always allow, that prompt goes away — choose that only for tools you are comfortable running unattended.
- Your name, marked as AI. Every action is written to the company's audit log under the name of the person who connected the assistant, with an AI marker beside it.
- No double booking. Write tools that create records take an idempotency key, so a retried request returns the first result instead of booking twice. Where a tool carries the version the assistant read, a record someone changed in the meantime is refused rather than overwritten.
- Closed periods stay closed. A posting dated in a locked period or a closed year is refused, exactly as it is in the browser.
- Corrections are reversals. A posted entry is never edited or deleted. Voiding it posts an exact reversing entry, and both stay in the ledger.
- It never moves money. comma records payments that happened elsewhere. No tool can send, pull or transfer funds.
Security for IT admins
| Authorization | OAuth 2.1 authorization code flow with PKCE (S256). Clients register dynamically or identify themselves with a client ID metadata document. |
|---|---|
| Access tokens | 15 minutes when the token can change the books (as a full connection can), otherwise one hour. |
| Refresh tokens | 30 days, rotated on every use. A retry within 60 seconds receives the same new pair, so a dropped response does not disconnect you; reuse after that revokes the connection. |
| Authorization codes | 10 minutes, single use. |
| Token storage | Tokens are opaque and stored only as keyed hashes, bound to the comma MCP endpoint and to one connection grant. |
| Revocation | Revoking a connection deletes its access tokens and revokes its refresh tokens; the assistant's next request is refused with 401. |
| Per-call checks | Every call re-checks the connection, your live membership, the company's plan and your current role, so a change applies to the very next call. |
| Conversation data | comma receives only the inputs of each tool call — never your chat history, the assistant's memory, or files you did not ask it to send. |
| Telemetry | Tool name, duration, error category, and user and company identifiers. Never the inputs or the results. |
Discovery documents follow RFC 9728 and RFC 8414: the protected resource metadata is at /.well-known/oauth-protected-resource/api/mcp and the authorization server metadata at /.well-known/oauth-authorization-server/api/auth. The service providers that process data for comma are listed in the privacy policy.
Admin controls
- Each person reviews and revokes their own connections at Settings › Connections. Revoking takes effect on the assistant's next request.
- An admin who removes a member or changes a role changes what that person's assistant can do on its very next call. No token outlives the membership it was issued under.
- A company outside an active plan becomes read-only: connector writes are refused with a message that nothing was changed, and its books stay readable and exportable.
- Every assistant action is in the company's audit log, under the person's name, marked as AI.
Limits
| Limit | Value | When it is exceeded |
|---|---|---|
| Requests | About 120 per minute per connection | HTTP 429 with a Retry-After header saying how many seconds to wait before retrying. |
| Request size | 1 MiB | HTTP 413. Upload larger receipts in the browser. |
| Result size | 64 KiB per tool result | An error asking for a narrower filter or a smaller page. No partial financial data is returned. |
| Lists | Paginated | List tools return a page at a time; ask for the next page or narrow the date range. |
Example prompts
- “What was our net income last quarter, and which expense lines grew the most?” Uses
comma_.report - “Which customers are more than 30 days overdue, and by how much?” Uses
comma_.receivables_ aging - “Categorize this month's unreviewed bank transactions, tell me which ones you weren't sure about, then book the rest.” Uses
comma_,transactions_ list comma_,transaction_ categorize comma_.transactions_ review - “Create an invoice to Northwind Co. for $2,400.00 of brand strategy, due in 30 days, and send it.” Uses
comma_,customers_ list comma_,invoice_ create comma_.invoice_ send - “Northwind paid their last invoice in full today by e-transfer. Record it.” Uses
comma_,invoices_ list comma_.payment_ record - “Is last fiscal year ready to close? What's still open?” Uses
comma_.year_ end_ review
Troubleshooting
- “This company's plan does not include using comma from Claude or ChatGPT.”
- The connector is part of the Pro and Premium plans, including their trial. The billing owner can change plans at Account › Billing. The books stay fully available in the browser.
- “… is retained in read-only mode, so connectors cannot change it.”
- The company is outside an active plan. Reads and exports still work; nothing was half-written. Changes resume once the billing owner restores the plan.
- “Your current role lacks the … permission.”
- Your role in that company does not allow the action. Ask an admin or accountant to do it, or to change your role. The change applies on the next call, with no reconnect.
- “This connector can access more than one company.”
- Tell the assistant which company you mean. It lists your companies and passes the one you name on each call.
- “Couldn't reach the MCP server”, or the connection stops working
- Remove the connector and add it again. Check that the URL is exactly https://trycomma.app/api/mcp, with no www and no trailing slash. If you revoked the connection in Settings › Connections, you must reconnect.
- Claude Code says a tool's output is too large
- Ask for a narrower date range or a smaller page, or raise Claude Code's limit by starting it with the MAX_MCP_OUTPUT_TOKENS environment variable set higher, for example MAX_MCP_OUTPUT_TOKENS=50000.
Support
Email support@trycomma.app and a person will answer. If a tool returned an error, include its request id if the assistant showed one. Privacy questions go to privacy@trycomma.app; see also the privacy policy and support.
.
Ask your books a question.
Pro and Premium, including the 30-day trial. Card required.