Everything the screens do, and more.
Trellis ships a REST API and an MCP server over it, so a coding or planning agent can keep the books the way a person would from the screens, and reach further in a few places. This page says what is there, who can call it, and how the hosted invoice link is protected.
119 agent tools
The MCP server runs over stdio, relayed by the fleet's tool router. It calls the REST API and adds nothing the API lacks. The full list is on the home page.
| Chart of accounts and journal | 9 tools, such as create_account, create_journal_entry, void_journal_entry. |
|---|---|
| Customers and vendors | 14 tools, such as create_customer, create_customer_contact, update_vendor. |
| Invoices, estimates, and hosted links | 18 tools, such as create_invoice, send_invoice, get_invoice_pdf, create_invoice_share_link. |
| Bills, expenses, and payments | 17 tools, such as create_bill, record_invoice_payment, record_bill_payment, create_expense. |
| Banking | 14 tools, such as list_bank_transactions, auto_categorize_transactions, create_bank_rule, create_reconciliation. |
| Reports | 6 tools, such as balance_sheet, profit_loss, ar_aging, cash_flow. |
| Tax | 6 tools, such as create_tax_code, list_tax_rates, list_tax_periods. |
| Products, projects, and recurring profiles | 21 tools, such as create_product, create_project, create_recurring_profile. |
| Classes, locations, organizations, and settings | 11 tools, such as create_class, create_organization, update_settings. |
| Health and identity | 3 tools, such as get_my_identity, check_service_health, get_diagnostics. |
Some tools go past the screens: the invoice PDF, the hosted link, bank rules, reconciliation, voiding a journal entry, and the cash flow report.
The REST API
The API lives under /api/v1 and has 119 operations across 19 resource groups: accounts, banking, bills, customers, estimates, expenses, invoices, journal entries, payments, products, projects, organizations, recurring profiles, reports, settings, tax, vendors, the signed-in user, and the public invoice pages. A health check and a diagnostics endpoint sit beside them.
The API description is committed with the code as an OpenAPI file, and a test fails when it goes stale. Amounts are whole cents everywhere.
Who gets in
A request is accepted with a client certificate, a scoped service token, a signed-in session token, or an API key. A local-development setting can switch authentication off on a developer's machine.
Beyond who you are, a request names an organization, and Trellis authorizes that choice on every call. The caller must be a member of it, an admin, or hold a service token scoped to it. A caller with none of those gets a 403 and no data. A service token that lists no organizations reaches only the default one.
Only admins and named services can create or change an organization.
- Requests are rate limited per address.
- Every response carries security headers: no sniffing, no framing, strict transport, and a content security policy.
How the hosted invoice link is protected
These properties come from Trellis's design notes and requirements, and tests in the repo cover them.
| Signed | The link carries an HMAC-SHA256 signature over the invoice, the link, and the expiry. The signature is compared in constant time. |
|---|---|
| Expiring | A link lasts 30 days by default and at most 365 days. An expired link answers with a gone status. |
| Revocable | A link is live only while it is recorded on the invoice and not revoked. You can revoke one link or all of them, and changing the signing secret ends every outstanding link. |
| Off without a secret | If no signing secret is set, no link works. |
| Bad links look like nothing | A link with a bad signature answers as not found. |
| Private by default | Public responses are marked do not store, do not index, and send no referrer. |
| Locked down | The page carries a content security policy that allows no script, escapes every value it prints, and loads a logo only from a public host. |
You create and revoke hosted links through the API and agent tools.
Questions about this tool?
Write to Renkara Media Group and a person will answer.