Mercury provides banking and financial workflow tools for businesses. Use Mercury's approved OAuth integration flow when it is available, or a vendor-issued API credential for a dedicated least-privileged finance identity.
This guide prepares Mercury for an MCP client. The Mercury agent template is separate from Mercury-side authorization.
Choose a connection method
Choose Mercury's approved OAuth or integration-authorization flow when the connection should act for a finance user. Choose a vendor-issued service credential only after Mercury has enabled it for the organization and a finance owner has approved its use. See Mercury's OAuth integration documentation for current eligibility and setup.
Recommended: Approved OAuth or integration authorization
Use the user-delegated authorization method Mercury makes available for your account and MCP implementation. Begin with a dedicated test or least-privileged finance identity; never start with an account owner who can move money.
- Confirm with your Mercury administrator that the intended account and permissions may be exposed to the integration.
- Register the OAuth/integration client and its exact redirect URL where Mercury requires it. For Dome, use
https://api.domesystems.ai/oauth/callback. - Request read-only account and transaction access for the initial deployment.
- Complete the organization approval and authorize the dedicated identity.
- Retrieve a known test transaction and confirm payment creation, wire actions, and access to unrelated accounts are unavailable.
Alternative: Vendor-issued API credential
Use a service credential only when Mercury has enabled that product for your organization and a finance owner has approved it. Keep it in secret storage, document its owner and rotation plan, and limit it to the required accounts and read scopes.
- Open the vendor's credential documentation as the dedicated least-privileged identity.
- Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
- Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
- Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.
Verify Mercury MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Mercury MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Mercury boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
If authorization is blocked, review your organization's integration policy and account roles. Never bypass a role restriction with an owner credential; finance permissions should be corrected at the vendor.
Next steps
Deploy the Mercury agent template to create a governed agent in Dome that can work with the approved finance data boundary, with the template's included model, tools, and rules.
