# SaaSFlow for AI agents

> SaaSFlow is the finance cockpit for SaaS companies: real-time P&L, subscription analytics (MRR, churn, cohorts), and a cash flow forecast built from Stripe, HubSpot, and bank accounts. If a person asked you to set up SaaSFlow for their company, follow "Set up SaaSFlow" below step by step, and ask them before you install anything or change data. The rest of this page lists every way an agent can read the data and what it may do with it. Rendered version: https://saasflow.com/agents

## Set up SaaSFlow

### 1. Connect the SaaSFlow MCP server

First check whether you already have SaaSFlow tools: `get_started`, `companies_list` and so on (in Claude Code they're named `mcp__saasflow__…`). If you do, go to step 2.

Address: https://mcp.saasflow.com (remote MCP over Streamable HTTP, OAuth 2.1). Clients discover the sign-in flow from the address itself, so no API key is needed. The person signs in, or creates a free account, when the server is added (step 2). Until then the server shows as needing sign-in and its tools don't show up.

Use the instructions for the client you are running in:

- Claude Code, in a terminal or in the Claude desktop app: run `claude mcp add --scope user --transport http saasflow https://mcp.saasflow.com`. The server shows as needing sign-in, and you get a `mcp__saasflow__authenticate` tool for it (search for it if your tools load on demand). Call it: it returns a sign-in link. Give the person that link to click. Once they've signed in, the SaaSFlow tools show up; if they don't, ask the person to start a new session. Only if that tool is missing, ask them to type `/mcp`, pick saasflow and authenticate. If the page the link ends on doesn't load (a remote session), ask the person for the address in their browser's address bar and pass it to `mcp__saasflow__complete_authentication`. Don't run `claude mcp login` from your own shell tool: it needs an interactive terminal.
- Codex CLI: run `codex mcp add saasflow --url https://mcp.saasflow.com`, then `codex mcp login saasflow`. The tools show up in a new session.
- Gemini CLI: run `gemini mcp add --transport http saasflow https://mcp.saasflow.com`, restart, then `/mcp auth saasflow`.
- VS Code: run `code --add-mcp '{"name":"saasflow","type":"http","url":"https://mcp.saasflow.com"}'`.
- Cursor: ask the person to open cursor://anysphere.cursor-deeplink/mcp/install?name=saasflow&config=eyJ1cmwiOiJodHRwczovL21jcC5zYWFzZmxvdy5jb20ifQ%3D%3D, or add the `saasflow` entry to `mcpServers` in .cursor/mcp.json. If the file exists, merge it in and keep the other servers:

```json
{
  "mcpServers": {
    "saasflow": { "url": "https://mcp.saasflow.com" }
  }
}
```

- ChatGPT: you can't add apps yourself. Send the person to https://saasflow.com/agents#chatgpt, or straight to the official SaaSFlow app at https://chatgpt.com/apps/saasflow/asdk_app_6a01e4b30b548191ae05e049070a3fb2: they click Connect and sign in, then come back to this chat.
- Claude (web, desktop, mobile): you can't add connectors yourself. Send the person to https://saasflow.com/agents#claude, which walks them through it: open https://claude.ai/customize/connectors, click "Add custom connector", name it SaaSFlow and paste https://mcp.saasflow.com. Then they start a new chat with the connector enabled.
- A client that only runs local (stdio) servers: bridge with `npx -y mcp-remote https://mcp.saasflow.com` (a third-party package).
- Scripts and CI: skip OAuth and send a SaaSFlow API key as the bearer token on the same endpoint.
- No MCP support, or sign-in won't work in your client: use the CLI (below).

If the person has to start a new session before the tools appear, tell them to paste this there, so the new session picks up where you left off: "Continue setting up SaaSFlow. Instructions for agents: https://saasflow.com/agents.md"

#### No MCP: the saasflow CLI

The `saasflow` command-line client covers the same API and signs in from your own shell. It doesn't need an interactive terminal:

```sh
npx -y saasflow@latest login --base-url https://api.saasflow.com
```

It prints a sign-in link, opens the browser and waits until the person has signed in (they can sign up on that page). The browser then sends them back to a listener on 127.0.0.1, so this only works when the person's browser runs on the same machine as your shell. In a cloud sandbox, a container or over SSH, use the MCP connection instead. If your shell tool only shows output once a command ends, run it in the background and give the person the link. Add `--create-companies` or `--admin` to ask for those options (step 2). Then `npx -y saasflow companies list`. The commands follow the MCP tool names (`companies_create` is `saasflow companies create`), and `--help` on any of them shows the flags. Scripts can also use the REST API with an API key: https://docs.saasflow.com/developers/api/overview

### 2. Sign in or sign up

Sign-in starts when the server is added, or in Claude Code when you call its authenticate tool (step 1). Before that, tell the person what the page will ask (below). It opens in their browser, where they sign in, or create a free account, and approve the connection. You can't do this step for them.

On that page, read access is always granted. The other options start ticked for an account created in the last day (someone who just signed up) and unticked for an older account. Tell the person what each one is for, so they can decide:

- "Make changes to company data": the setup work in step 5 (categorizing transactions, creating vendors and customers, planning) and starting syncs. Without it you can't edit financial records or start syncs. Creating companies and company settings have their own options, below.
- "Create companies for you": only needed if they don't have a company in SaaSFlow yet. Ticking it accepts the Terms of Service and the Data Processing Agreement for each company you create, so let them read those first.
- "Manage company settings and integrations": changing company settings and disconnecting integrations. It also lets you ask them to approve invitations, role changes and API keys, which you never make yourself.

You only get the tools of the options they allow, so help them choose for the whole task. If your client doesn't show one of these options, the steps that need it fall back to links into the app. If you need an option later (`get_started` lists what's missing), tell the person which one and why: they disconnect SaaSFlow (in their client, or in the app under User settings, then Connected apps) and connect again with it ticked. A call that answers `insufficient_scope` means the same; some clients then ask them to sign in again on their own.

The person's role in the company still applies: a viewer can't make changes, whatever they tick. A 403 without `insufficient_scope` means the role doesn't allow the call, and signing in again won't help. Tell the person which permission is missing and ask a company owner to change their role in the app. Don't retry.

### 3. Find or create the company

If the prompt names a `companyId` (the app's Connect AI page adds it), call `companies_get` with it and use that company without asking again. Otherwise call `companies_list`.

- One or more companies: confirm with the person which one to use, and pass its id as `companyId` from then on.
- Empty list: the account has no company yet. If you have the `companies_create` tool, ask the person for the company name, the currency it does its books in and its website, confirm them, then create it. Don't guess the currency: every report is converted into it. If they want a throwaway company for a demo or a test, create a sandbox instead (`type` `sandbox`, with `addSampleData` for example data). Tell them first that a sandbox is deleted after 14 days with everything in it, so it is no place for their real data. If the call answers `insufficient_scope`, the person didn't tick "Create companies for you" and the client asks them to sign in again (step 2). Without the tool, or if it answers 403 `legal_acceptance_required`, send the person to the link in the answer or to https://app.saasflow.com/getting-started (about a minute), then call `companies_list` again.

Read the company's `baseCurrency` before you interpret any total.

### 4. Connect the data sources

The person makes the connections in the app: they sign in with the provider, or upload its export for file-based sources. You never see their provider credentials. For each source, call `integrations_connect_link` with the provider (`bank` for bank accounts) and give the person the link: it opens the right dialog. Suggest, in this order:

1. Stripe or HubSpot for subscriptions and MRR.
2. The business bank accounts, for cash, spend and the forecast.
3. Pleo, Finway or DATEV Payroll if they use them. These are CSV exports: if the person gives you the file, `integrations_upload` imports it and asks the same follow-up questions the app would.

The first import takes a few minutes. Poll `integrations_list` (for banks, `accounts_list`) until the new integration shows `initialSetupComplete`. An integration with `status` `error` needs the person again: call `integrations_connect_link` with its `integrationId` for a reconnect link. Later, `integrations_sync` fetches new data without waiting for the schedule.

If a tool answers that the company's plan has expired, `billing_link` gives the person a link to the billing page.

### 5. Do the setup work

This is where you save the person the most time. With write access (and a company role that allows changes):

- Categorize open transactions. `transactions_categorization_status` shows how much is left, `transactions_search` finds them, and `transactions_batch_edit` applies a category, vendor or customer to many at once. Create missing vendors and customers with `vendors_create` and `customers_create`, then show the person what you plan to apply before you apply it.
- Add expected income and costs that aren't booked yet with `planned_transactions_create`, so the cash flow forecast is complete.
- Then answer their questions. Take every metric (MRR, ARR, churn, runway, P&L) from a `data_*` tool. Never add up transactions yourself: pagination and categorization rules make that wrong.

The server sends its own conventions when you connect (signed decimal amounts, subscription events are deltas, transfers are not income). Follow them.

### What stays with the person

- Signing in with a provider (step 4). An export file they can upload in the app, or give to you for `integrations_upload`.
- Inviting people, changing a member's role, removing a member, creating an API key and deleting the company. With "Manage company settings and integrations" you can ask for these with the `access_requests_*` tools. Each one returns a link where the person approves the exact change, and `access_requests_get` tells you the outcome. A new API key is shown to the person only, never to you.
- Full re-imports: the person starts them in the app at https://app.saasflow.com.

SaaSFlow never moves money.

### Pricing

Free below 120k EUR ARR. Paid plans start at 100 EUR per month, billed annually, with a 14-day trial and no credit card. Details: https://saasflow.com/pricing

## Tools

Over 90 read tools: companies, accounts, transactions, customers, vendors, subscriptions, files, comments, and one data_<slice> tool per metric slice (data_mrrAtDate, data_monthlyData, data_periodDetails, data_topExpenseVendors, data_cashFlowTimeSeries, data_cohorts, data_metricExplanation, ...). Hand-written: search (free text across the company) and run_data_batch (several slices in one round trip).

Conventions the server sends on connect: start from companies_list to get a companyId, take every metric from a data_* tool instead of summing transactions, amounts are signed decimal strings, subscription events are deltas.

Write tools (create, update, delete on every resource) need the saasflow:write OAuth scope or an API key that allows them, and stay bounded by the credential's permissions. A connection lists only the tools its grant allows; a call to one it doesn't cover answers insufficient_scope (step 2 above).

Full reference: https://docs.saasflow.com/developers/mcp/tools

## Build your own

- REST API: base URL https://api.saasflow.com, JSON, resources under /companies/{companyId}/..., one GET per data slice plus POST /companies/{companyId}/data/batch. Overview: https://docs.saasflow.com/developers/api/overview
- OpenAPI 3.1 document: https://api.saasflow.com/openapi.json (each operation lists the permission an API key needs and the OAuth scope an app must hold)
- Typed client: `npx openapi-typescript https://api.saasflow.com/openapi.json -o saasflow.d.ts`
- CLI: npm package `saasflow`. `saasflow login` (OAuth) or SAASFLOW_API_KEY, then e.g. `saasflow data mrrAtDate --mrr-type cmrr --date 2026-08-31`. Docs: https://docs.saasflow.com/developers/cli
- OAuth for apps other people install: https://docs.saasflow.com/developers/oauth-for-apps
- Outbound webhooks are not available yet; poll or use the batch endpoint.

## Agents that run inside SaaSFlow

- AI analyst: writes a monthly performance report with its own charts; headline numbers are replayed against live data before the report is accepted.
- Report chat: answers questions about a report and applies requested edits as new versions.
- Categorization helper: proposes vendors, customers, and categories for uncategorized transactions; a person reviews and applies them.

All three run in isolated containers with a run-scoped credential, on Claude models hosted by Google Cloud (Vertex AI) in the EU. They can be started via POST /companies/{companyId}/agent_runs; GET /companies/{companyId}/agent_definitions lists what is available.

## Discovery

- https://saasflow.com/llms.txt: site overview and page index
- https://docs.saasflow.com/llms.txt: page-by-page docs index; append .md to any docs URL for its Markdown source
- https://api.saasflow.com/openapi.json: OpenAPI document
- https://api.saasflow.com/.well-known/mcp: MCP server card
- https://api.saasflow.com/.well-known/api-catalog: RFC 9727 API catalog
- https://api.saasflow.com/: JSON index of the above
- On https://saasflow.com pages in a WebMCP-capable browser, document.modelContext exposes estimate_saasflow_price and estimate_saas_valuation.

## Permissions

- API keys belong to one company and carry an explicit permission set (for example subscriptions:read, transactions:write). Created and revoked under Settings > API keys in the app.
- OAuth grants carry saasflow:read, saasflow:write and optionally saasflow:admin, intersected with the granting user's role. saasflow:admin (a separate box on the consent screen, unticked for existing accounts) allows company settings and integrations. saasflow:create_companies (another unticked box) lets the agent create companies; ticking it is where the person accepts the Terms and the data processing agreement for them. An API key gets company settings and integrations only when its permission list names company:manage or integrations:manage, and can't create companies. Members, API keys and deleting a company are never changed by an agent: with saasflow:admin it can ask (access_requests_* tools), and the person approves the exact change in the app.
- Connecting Stripe, HubSpot or a bank stays with the person: integrations_connect_link returns a link to the connect dialog in the app, and integrations_list shows when the import is done.
- Revocation takes effect on the next request. Every tool call over the hosted endpoint is written to an audit log.
- SaaSFlow is hosted in the EU and reads from billing and banking providers. It cannot move money.

## Other clients

- Raycast: extension at https://www.raycast.com/saasflow/saasflow, with the same tools available to Raycast AI.
- Connectors set up with the earlier address, https://api.saasflow.com/mcp, keep working.
- Connect guide for people: https://docs.saasflow.com/developers/mcp/connect

## Contact

support@saasflow.com