Reports endpoints (P&L, Cash Position, Financial Position, Top Customers) return generic 500 error while non-Reports endpoints succeed

[laurahuckabee]

Summary

Four of the seven tools exposed by the hosted Xero MCP server (https://mcp.xero.com/mcp) consistently return the generic error "We are sorry, something has gone wrong" for our organisation. The failing tools all hit the Reports API; tools that hit Contacts or Settings APIs work normally. Three full OAuth disconnect/reconnect cycles did not resolve the issue, which rules out a scope/grant problem on the client side.

Affected tools (all fail with "We are sorry, something has gone wrong")

• get_profit_and_loss — fails with date params and with empty params (defaults)
• get_cash_position
• get_financial_position
• get_top_customers_by_revenue

Working tools (same connection, same session)

• whoami — returns user/org correctly
• get_organisation_financial_year — returns FY dates correctly
• get_contacts_and_receivables — returns AR data correctly, including correlation_id

Reproduction

1. Authorize the hosted Xero MCP via an MCP client (Anthropic's Claude desktop/Cowork connector at directory UUID 4c1fcb68-c482-46c5-a677-659eaf2f2c85, URL https://mcp.xero.com/mcp).
2. Confirm authentication: whoami returns the connected org.
3. Call get_profit_and_loss with any params (e.g., start_date: "2026-04-01", end_date: "2026-04-30") — generic error.
4. Call get_cash_position with empty params — generic error.
5. Call get_financial_position with empty params — generic error.
6. Call get_top_customers_by_revenue with any date range — generic error.
7. Call get_contacts_and_receivables — returns valid JSON.

Diagnostic info

• Organisation: Transcend LLC
• organisation_id: 240576c0-73b7-4783-b186-4418ce6dc62b
• user_id: 47d49a22-bbad-4f4c-86c8-09b55c749ecd
• client_id: AC489F74437D42D6A825010424AB969C
• Date of testing: 2026-05-05
• Times tested (approximate, UTC): 16:33, 16:41, and ~16:50 — same failure pattern in all three rounds
• Known-good correlation_ids (from successful get_contacts_and_receivables calls — your team can search logs around these timestamps for the failing calls in the same session):
  • db5daf64-7e5a-42dc-8ca1-72ed25b40391 at 2026-05-05T16:33:46Z
  • 49c552ab-1ba8-4fca-af4f-eee9a5452b70 at 2026-05-05T16:41:37Z

The failing tools do not return correlation_ids in their response — only the generic error message — which makes user-side debugging harder. Surfacing correlation_ids in error responses would help.

Re-authorization attempts

Three full OAuth disconnect/reconnect cycles were performed today (2026-05-05). Each cycle: revoked the connection, re-authorized through the consent screen, then immediately retested. Every cycle produced the identical failure pattern. This rules out a missing-scope issue on the user side.

Suspected cause

Xero's SCOPES_V2 (granular scope model) rolled out on 2026-04-29 — six days before this report. Connections authorized after that date use V2 by default. The timing and the endpoint-specific failure pattern (Reports endpoints failing, others working) suggest a regression in Reports endpoint handling under the new scope model in the hosted MCP server.

Why this matters

get_profit_and_loss is the canonical way to retrieve cash-basis P&L from Xero programmatically. Without it, downstream automation that relies on monthly actuals has to fall back to BankTransactions-only pulls, which understate true cash-basis P&L because they exclude manual journals, expense claims, and AP-cleared payments. For our weekly close automation this means we can't replace a manual XLSX export step with the hosted MCP until this is fixed.

Environment

• MCP client: Anthropic Claude (Cowork mode), hosted Xero MCP connector
• Server URL: https://mcp.xero.com/mcp
• Region: US

Happy to provide additional logs, repeat tests, or test a fix.