MCP server

Spend runs a Model Context Protocol server at https://<host>/api/mcp. Each connected agent acts for one person, with the tools, autonomy and amount limit an administrator sets.

Connect

1. An administrator registers the agent on Administration › Connected agents (MCP): the person it acts for, its tools, its autonomy (read_only, draft or act) and an optional amount limit. They issue a token, shown once.
2. Configure your client with the server URL and the token as a bearer token.

Setting	Value
Transport	Streamable HTTP, JSON responses (no server-sent events)
Protocol version	2025-06-18
Endpoint	POST https://<host>/api/mcp
Auth	Authorization: Bearer <agent token>
Methods	initialize, ping, tools/list, tools/call

curl -s https://<host>/api/mcp \
  -H "authorization: Bearer $AGENT_TOKEN" -H 'content-type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Tools

Tool	Kind	What it does
search_suppliers	read	Suppliers by name, with status and open risk findings
get_supplier_risk	read	Every risk source’s latest finding for a supplier, and whether it is barred
list_invoices	read	Invoices by status or supplier, with amount and due date
get_invoice	read	One invoice’s lines, match exceptions, hold and status
list_my_approvals	read	What is waiting on the person; deciding stays with them
list_requests	read	Purchase requests with status, method and amount
get_request	read	One request with its lines, method and why policy picked it
search_catalog	read	Items on executed contracts, with contract prices
list_contracts	read	Contracts with value, spend to date and end date
get_contract	read	One contract’s renewals, insurance and open obligations
draft_request	draft	Turn a description into a draft request for the person to check
submit_request	act	Submit a draft into approval, within the amount limit and once its questions are answered
hold_invoice	act	Put an invoice on hold with a reason, within the amount limit

An agent only lists the tools it was given, and each still checks that the person it acts for holds the needed permission.

Limits that always apply

• The agent can do only what its person may do. If the person is deactivated, the agent stops.
• The tenant’s policy pack caps every agent’s autonomy and amount, whatever the registration says.
• There are no tools to approve, award, release a payment or change policy.
• Every call, allowed or refused, is written to the audit ledger under the agent’s name.
• Revoking the token or turning the agent off takes effect on the next call.