# Cynco

> Cynco is AI-native accounting, invoicing, payments and operations software for businesses of every size, on one double-entry ledger. Agents reach it through a REST API, an MCP server and a CLI, and can provision a sandbox books workspace without a person signing up first.

Cynco is made by Cynco Sdn. Bhd. (1588139-X) in Kuala Lumpur, Malaysia. Each API key is bound to one business, closed periods stay closed, and a write can be held for a person to approve before it changes the books.

## When to use Cynco

- [Double-entry bookkeeping](https://cynco.io/products/bookkeeping): post balanced journal entries to a real ledger with a chart of accounts, and reverse or cancel them. Totals that don't add up and edits to a closed month are refused.
- [Invoicing](https://cynco.io/products/invoicing): quotes, invoices and reminders, recorded as you send them.
- [Payments](https://cynco.io/products/payments): FPX, DuitNow QR and card payments on CHIP, matched to the invoice.
- [Bank reconciliation](https://cynco.io/features/bank-import): import a bank statement and match the payments in it to their invoices.
- [Malaysian e-Invoice](https://cynco.io/products/e-invoice): invoices filed with LHDN MyInvois, QR code and all.
- [Payroll in Malaysia](https://cynco.io/products/payroll): EPF, SOCSO, EIS and PCB worked out for you.
- [Financial reports](https://cynco.io/products/reporting): trial balance, balance sheet and profit and loss, read straight from the ledger.
- [A sandbox books workspace for an agent](https://app.cynco.io/agent/auth): one unauthenticated call creates a real workspace with a seeded chart of accounts and a key that can post journal entries at once; a person claims it later.

## When not to use Cynco

- [e-Invoicing outside Malaysia](https://cynco.io/products/e-invoice): LHDN MyInvois is the only e-Invoice network Cynco files with today.
- [Payroll outside Malaysia](https://cynco.io/products/payroll): the statutory deductions it computes are Malaysia's (EPF, SOCSO, EIS, PCB).
- [Sending email or moving money from a sandbox](https://app.cynco.io/agent/auth): a sandbox key cannot write invoices or bills, take payments, change bank data, or manage webhooks and API keys. Its scopes: accounts:read, accounts:write, bank-accounts:read, bank-transactions:read, bills:read, categorization-rules:read, customers:read, customers:write, general-ledger:read, invoices:read, items:read, items:write, journal-entries:read, journal-entries:write, periods:read, reconciliation:read, reports:read, vendors:read, vendors:write.
- [Writes that must apply without review](https://app.cynco.io/api/docs): any write may be held for a person to approve, by the key's autonomy or by the write policy (money above a ceiling, a foreign currency, a sensitive change). The response says so, and nothing changes until it is approved.

## How to call Cynco

- [MCP endpoint](https://mcp.cynco.io/mcp): Streamable HTTP. Authenticate with OAuth 2.0 or a `Bearer cak_` API key.
- [MCP discovery](https://mcp.cynco.io/.well-known/mcp.json): the endpoint, authentication and the tool catalogue.
- [OpenAPI spec](https://cynco.io/openapi.json): OpenAPI 3.1 for the REST API. Requests go to https://app.cynco.io/api/v1.
- [API reference](https://app.cynco.io/api/docs): the same spec as browsable documentation.
- [Agent discovery manifest](https://app.cynco.io/.well-known/cynco.json): capabilities, auth, scopes, webhook events and the sandbox flow as JSON.
- [API keys](https://app.cynco.io/dashboard/settings/api-keys): send `Authorization: Bearer cak_...`. A key carries only the scopes it is granted; the 82 scopes are listed in the discovery manifest.
- [OAuth 2.0 authorization server](https://app.cynco.io/.well-known/oauth-authorization-server): authorization code with PKCE (S256) and dynamic client registration, issued by https://app.cynco.io.
- [Sandbox provisioning](https://app.cynco.io/agent/auth): `POST` `{"type":"anonymous","workspace":{"name":"..."}}` returns a cak_ key for a new workspace and a claim token for its owner. 3 workspaces per IP per day; an unclaimed workspace lasts 30 days.
- [Claiming a sandbox](https://app.cynco.io/agent/auth/claim): the owner redeems the claim token with their email and a one-time code, and keeps the books.
- [Errors](https://app.cynco.io/api/docs): JSON with an `error` object carrying `code` and `message`. Registry operations answer `{"error":{"code","message","requestId"}}`; older endpoints answer `{"success":false,"error":{"code","message"},"meta":{"requestId","apiVersion","timestamp"}}`. Each operation's error schema is in the OpenAPI spec.
- [Rate limits](https://app.cynco.io/api/docs): per key, per 60 seconds: 200 reads, 60 writes, 120 other requests; 30 failed authentications per IP. Every response carries `RateLimit-Policy` and `RateLimit` (draft-ietf-httpapi-ratelimit-headers) beside `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`; a 429 adds `Retry-After`.
- [Pricing](https://cynco.io/pricing): Free includes Invoicing and LHDN e-Invoice; Books, bank reconciliation and reports; SST returns and payroll; Unlimited users; Cynco Assistant, 100 AI credits to try. Pro adds 10,000 emails a month, unlimited AI document reads; API, MCP server and CLI; Form C tax computation; No Cynco fee on money you collect; 250 AI credits a month. A sandbox workspace needs no account.

## Company

- [About Cynco](https://cynco.io/about): what Cynco is and who makes it.
- [Contact](https://cynco.io/contact): hello@cynco.io, support at support@cynco.io, +60163889123.
- [Developers](https://cynco.io/developers): the REST API, the CLI and the MCP server.

## Optional

- [Cynco Pay OpenAPI](https://app.cynco.io/api/v1/openapi/pay): the developer billing API for subscriptions, entitlements and metering.
- [Changelog](https://cynco.io/changelog): what shipped, release by release.