Can an AI agent use Moneybird?

As of 6 Oct 2026, an AI agent can't use Moneybird on its own: Invisible reCAPTCHA silently blocks the sign-up form.

Level 1 · Needs a personAgents can't get in on their own.
  • Find: Docs for agents: llms.txt, an OpenAPI and an MCP server.
  • Access: Can't sign up.
  • Use: Work not reached.
  • Pay: Payment not reached.
  • Leave: Leaving not reached.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean

Driven 6 Oct 2026Same level in 4 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverTurned away when they send the sign-up form.
  • Signed agentsThe site opens. The check on the form still applies.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 13 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Moneybird.

On its own

  • Read all the developer documentation, including a version made for AI tools
  • Register as a technical client with the service (this alone does not grant access)
  • Install the official command-line tool

What it can't, and why

  • Create an accountThe sign-up form's hidden bot check failed silently with nothing visible to respond to
  • Get a login key for the API, command line, or AI connectorKeys are only issued from inside an account
  • Do any invoicing, bookkeeping or banking taskNo account was ever created
Blocked

Can an AI agent sign up for Moneybird on its own?

No. Sign-up: blocked. Only route is the web form (POST /register_from_website) behind invisible Google reCAPTCHA v2. In our agent's browser the click produced no token, no visible puzzle, and no error: the form silently never submitted. No visible challenge existed for a human to solve either. Nothing, agent or human, could get past this path on the evidence gathered: blocked, not human.

Official server · no call worked

Does Moneybird have an MCP server, and can an agent connect to it?

Yes. Moneybird has an official MCP server.

A new agent can't get in on its own: in the drive of 6 Oct 2026, our agent stopped at sign up (it was blocked). Through the MCP server, 0 of our agent's 1 attempt worked.

What the drive found

APIOpenAPIMCP · officialCLI–SDKllms.txtWebhooks–Sandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind Moneybird.

Where agents stop in Moneybird today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

  1. Let verified agents sign upStep-by-step guide
  2. Show a challenge or error when reCAPTCHA failsStep-by-step guide
  3. Add device flow for API and CLI tokensStep-by-step guide
2 more fixes
  1. Make the MCP endpoints discoverable without a token Step-by-step guide
  2. Serve markdown on Accept: text/markdown Step-by-step guide
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L1 · Needs a person badge

Behind the level.

Our agent couldn't get into Moneybird, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

  • llms.txt: found
  • OpenAPI: found
  • MCP server: found
  • CLI: found

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

  1. 1 Oct 20263 drivesL1Needs a person
  2. 6 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 29 attempts.

How an agent connects · 4 tips
  • Sign-up needs a human: have the user create the account and a personal API token (Settings > External applications and AI connections) with the scopes you need, then use the CLI or API.
  • The CLI (moneybird-cli) reads the OpenAPI at runtime; install with MONEYBIRD_CLI_DIR set to a writable dir.
  • Use developer.moneybird.com/llms-full.txt and the .md pages; Accept: text/markdown is not negotiated.
  • OAuth: DCR at /oauth/register works and CIMD is advertised; a human still approves at /oauth/authorize. No device flow.
Every checkpoint, in detail · 9 checkpoints
  1. DocsHeadlessdeveloper.moneybird.com: llms.txt, .md pages, llms-full.txt; OpenAPI 3.1.0 on GitHub (297 operations); MCP and CLI pages.
  2. Sign upBlockedOnly route is the web form (POST /register_from_website) behind invisible Google reCAPTCHA v2. In our agent's browser the click produced no token, no visible puzzle, and no error: the form silently never submitted. No visible challenge existed for a human to solve either. Nothing, agent or human, could get past this path on the evidence gathered: blocked, not human.
  3. VerifyNot reachedNo sign-up went through, so no mail to verify.
  4. KeyNot reachedAPI tokens are made inside an account (Settings > External applications and AI connections). OAuth DCR at /oauth/register worked headless (201), but /oauth/authorize redirects to a login we have no account for. No device flow or agent registration.
  5. First callNot reachedNo token; unauthenticated API calls get 401 JSON 'no applicable policies'.
  6. First actionNot reachedNo token.
  7. PayNot reachedNo agent payment rail: no 402 on API paths, x402./mpp./agents. subdomains 404, no /.well-known/ucp, no x-payment-info, not in x402 Bazaar or mpp.dev. Pricing FAQ: paid plans are paid by monthly direct debit or credit card, chosen in the app after a 60-day trial (llms.txt: no credit card for the trial). Not reached: sign-up needs a human (reCAPTCHA), so; the in-app checkout itself was not seen.
  8. CancelNot reachedNo plan started. Pricing FAQ: 'You can cancel at any time, without notice.' The OpenAPI has no billing operations, so cancelling is not an API call; the in-app route was not seen (not verified).
  9. DeleteNot reachedNo account was created, so nothing to delete. Two OAuth clients registered via DCR have no documented delete (no registration_client_uri).
The attempt log · 29 attempts
Attempt log
CapabilityRouteResultEvidence
MCP discovery: POST server/discover to https://moneybird.com/mcp/v1/read_write and read_onlymcppartial ✓Both answered HTTP 401 application/json {"error":"no applicable policies"} with WWW-Authenticate: Bearer resource_metadata="https://moneybird.com/.well-known/oauth-protected-resource"; no version info without a token
OAuth metadata: GET /.well-known/oauth-protected-resource and oauth-authorization-serverapidone ✓PRM 200 JSON resource=https://moneybird.com/mcp, AS=https://moneybird.com; AS metadata: registration_endpoint /oauth/register, client_id_metadata_document_supported:true, S256, grants authorization_code+refresh_token, no device_authorization_endpoint, no agent_auth block
cards: GET /.well-known/ai-catalog.json, agent-card.json, agent.json, mcp/server-card.json, <mcp>/server-card, /auth.md, /SKILL.md, /.well-known/ucpapifailed ✓all 404 text/html
llms.txt: GET developer.moneybird.com/llms.txt and www.moneybird.com/llms.txtapidone ✓both 200 text/plain; developer llms.txt links .md pages; www llms.txt points to MCP, CLI, API, and llms-full.txt
markdown: Accept: text/markdown on developer.moneybird.com/introduction; and /introduction.mdapipartial ✓Accept negotiation returned text/html (no Vary); /introduction.md returned 200 content-type text/markdown
aipref: robots.txt Content-Usage lines and Content-Usage headerapidone ✓robots.txt (www/moneybird.com) has User-agent: * with Disallow incl. /api/, /user/, /app/; no Content-Usage or Content-signal lines; no Content-Usage header on www
OpenAPI: GET github moneybird/openapi openapi.jsonapidone ✓openapi 3.1.0, info.version v2-20261006-23627e8bd2, 212 paths / 297 operations, no x-payment-info
Sign up: Find a headless sign-up routenonefailed ✓No documented signup API (developer docs: tokens are created inside an account at moneybird.com/user/applications/new). Website form POSTs to https://moneybird.com/register_from_website with hidden captcha_token (reCAPTCHA); not submitted headless, to avoid skipping the check
Sign up: Sign up at https://www.moneybird.com/aanmelden/ in the drive browser (name, email, password)browserblocked ✓Form #sign-up-for-moneybird-form (POST https://moneybird.com/register_from_website) is guarded by invisible Google reCAPTCHA v2 (site key [redacted], api2 anchor+bframe). After clicking 'Sign up for free' (after declining optional cookies) the page stays on /aanmelden/, hidden captcha_token stays empty, no POST to register_from_website, no visible puzzle (bframe hidden), no error text. No mail arrived at the agent's inbox.
Sign up: Human own-browser handoff for the reCAPTCHA-guarded sign-up formnoneblocked ✓
OAuth client registration: Register an OAuth client via DCR at https://moneybird.com/oauth/register (from AS metadata)apipartial ✓POST /oauth/register -> 201 JSON client_id 2baa9dac…, grant_types authorization_code+refresh_token, scope all six; asked token_endpoint_auth_method none, got client_secret_basic
Docs: Read developer docs, llms.txt, OpenAPI, MCP and CLI pages headlessapidone ✓developer.moneybird.com/llms.txt + .md pages (authentication, tools/mcp, tools/cli, integration/*), llms-full.txt, OpenAPI 3.1.0 at github.com/moneybird/openapi (297 operations)
Verify email: Read verification mailnoneblocked ✓inbox read the agent's inbox: 'no mail'no sign-up was submitted
Personal API token / OAuth token: Get an API tokennoneblocked ✓Tokens are created inside an account (Settings > External applications and AI connections, or /user/applications/new); /oauth/authorize 302 -> https://moneybird.com/login
First API call: GET /api/v2/administrations.json without credentialsapiblocked ✓401 application/json {"error":"no applicable policies","symbolic":{"request":"invalid_grant"}}
Operate the administration from a terminal (CLI): Install the official moneybird-cli and list contactscliblocked ✓install.sh (MONEYBIRD_CLI_DIR=run dir) cloned moneybird-cli 2e34e51; `contacts list` -> 'Error: No administration selected. Run: moneybird-cli login <token>'
Pay: Probe agent payment rails and billingapidone ✓No 402 on API paths (401 JSON); x402./mpp./agents. subdomains 404; /.well-known/ucp 404; no x-payment-info in OpenAPI; no moneybird entries in x402 Bazaar or mpp.dev/api/services; llms-full.txt has no x402/MPP/ACP mentions. Pricing page: plans from €3, €41/month, 60-day trial; FAQ: 'you give us permission to debit the subscription fee from your account by means of a monthly direct debit or credit card transaction'. www llms.txt: 'Free trial ... 60 days, no limits, no credit card.'
Create a sales invoice: Drive via POST /api/v2/:administration_id/sales_invoicesnoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Send an invoice to a customer: Drive via PATCH /api/v2/:administration_id/sales_invoices/:id/send_invoicenoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Record a payment / mark invoice paid: Drive via POST /api/v2/:administration_id/sales_invoices/:id/paymentsnoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Set up a recurring sales invoice: Drive via POST /api/v2/:administration_id/recurring_sales_invoicesnoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Create and convert a quote/estimate to an invoice: Drive via POST /api/v2/:administration_id/estimates; PATCH estimates/:id/create_sales_invoicenoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Scan and process a receipt/purchase invoice (smart document processing): Drive via POST /api/v2/:administration_id/documents/purchase_invoicesnoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Connect a bank account and import transactions: Drive via GET /api/v2/:administration_id/financial_mutationsnoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Match/categorize a bank transaction to an invoice or ledger account: Drive via PATCH /api/v2/:administration_id/financial_mutations/:id/link_bookingnoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
File an electronic VAT return: Drive via APInoneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
View financial reports and dashboard (P&L, balance sheet): Drive via GET /api/v2/:administration_id/reports/...noneblockedNo account: sign-up blocked by invisible reCAPTCHA (see signup attempt); no token for API/CLI/MCP
Cancel plan: Cancel a plannoneblocked ✓No plan started (no account). Pricing FAQ: 'You can cancel at any time, without notice.' No billing endpoints in OpenAPI (grep: no plan/billing operations for the Moneybird subscription itself)
Delete account: Delete the account and datanoneblocked ✓No account was created; nothing to delete. DCR clients 2baa9dac…/one more were registered at /oauth/register; registration response carried no registration_client_uri/registration_access_token, so no documented way to delete them

Also in Invoicing.