Log in Start free
Log in Start free

Technical documentation

Dynafis MCP for AI clients

Technical reference for the optional Dynafis MCP interface. OAuth with PKCE binds every approval to exactly one workspace and one legal entity/client.

MCP overview Help Center API documentation

Quickstart

Quickstart

The client discovers Dynafis, registers dynamically when needed, starts OAuth, and then receives only approved tools.

1
Use the MCP server

https://dynafis.com/mcp

2
Start OAuth approval

The client performs discovery and PKCE.

3
Confirm context

Review workspace, legal entity/client and scopes.

4
Use tools

Start with tools/list and call only approved tools.

Overview

MCP is an optional developer module. Normal Dynafis use in the browser requires no MCP setup.

Streamable HTTP

MCP endpoint

POST https://dynafis.com/mcp

MCP uses stateless Streamable HTTP. JSON-RPC requests are sent by POST. The access token is supplied as a Bearer token.

Responses use JSON-RPC 2.0. Tool results contain structured data and a text representation.

OAuth 2.1 + PKCE

OAuth endpoints

Clients can register dynamically and then start OAuth Authorization Code with PKCE S256. Before approval Dynafis shows the client, workspace, legal entity/client and requested scopes.

GET/.well-known/oauth-protected-resourceProtected Resource Metadata
GET/.well-known/oauth-protected-resource/mcpResource Metadata (MCP path)
GET/.well-known/oauth-authorization-serverAuthorization Server Metadata
GET/.well-known/oauth-authorization-server/mcpAuthorization Server Metadata (MCP path)
POST/oauth/registerDynamic Client Registration
GET/oauth/authorizeAuthorization Code + PKCE S256
POST/oauth/tokenAuthorization Code / Refresh Token exchange
POST/oauth/revokeToken revocation

Permissions

Scopes

mcp:readRead-only MCP tools and tool discovery.
mcp:writeSeparately approved write actions, currently including task creation.
offline_accessAllows a rotating refresh token for persistent connections.

Tools

Available tools

dynafis.workspace_summaryRead workspace, legal entity, role, capabilities and usage counters.
dynafis.list_documentsList recent documents for the OAuth-bound legal entity.
dynafis.list_invoicesList invoices by status and review state.
dynafis.get_invoiceRead one invoice with canonical data and validation results.
dynafis.list_review_queueRead open review items.
dynafis.monthly_close_statusRead monthly-close status and metrics.
dynafis.create_taskCreate a task in the bound legal entity; requires mcp:write.

OAuth flow

Authorization flow

1. DiscoveryClient reads Protected Resource Metadata and Authorization Server Metadata.
2. RegistrationPublic PKCE client registers redirect URI and scopes through Dynamic Client Registration.
3. ApprovalUser signs in, selects workspace and legal entity/client, and approves scopes.
4. TokenAuthorization code is exchanged with the PKCE verifier for an access token and optional refresh token.
5. MCPClient calls tools/list and then permitted tools/call actions.
6. RevocationThe connection can be revoked in Dynafis or through OAuth Revocation.

JSON-RPC 2.0

Example: tools/list

POST /mcp
Authorization: Bearer <access_token>
Content-Type: application/json
MCP-Protocol-Version: 2026-07-28

{
  "jsonrpc": "2.0",
  "id": "tools-1",
  "method": "tools/list",
  "params": {}
}

Operations

Operator switches

SERVICE_MCP_ENABLED is the global MCP master switch; false disables both Partner and Self-Service MCP. SELF_SERVICE_MCP_ENABLED controls only the public OAuth/workspace MCP. Both must be true for Self-Service MCP.

SERVICE_MCP_ENABLED=true
SELF_SERVICE_MCP_ENABLED=true
SELF_SERVICE_MCP_PUBLIC_BASE_URL=https://dynafis.com

Help Center

Overview

MCP is an optional developer module. Normal Dynafis use in the browser requires no MCP setup.

Help Center →

Help

Troubleshooting

HTTP 401 Bearer token required

The endpoint is reachable, but the client has no valid MCP access token yet. Complete OAuth.

MCP not visible

Check SELF_SERVICE_MCP_ENABLED, workspace module and role/permission.

No tools visible

Check role, plan, enabled modules, scopes and bound legal entity.

Expected access to another client

An MCP grant is intentionally bound to one client. Create a separate grant for another client.

What is Dynafis MCP? →Connect an MCP client →MCP or API? →MCP not visible? →Revoke a connection →

Policy

Security & limits

Tool discovery and calls enforce roles, scopes, workspace capabilities, module entitlements and the OAuth-bound legal entity. MCP does not bypass document, export or AI limits. A dedicated MCP rate limiter also applies.

B2B

Partner MCP

Service/Partner MCP is separate from Self-Service MCP. Partners use dedicated service tokens, partner/environment headers, capability allowlists and tenant isolation at /api/internal/partners/v1/mcp.

POST /api/internal/partners/v1/mcp