A
licenseA
qualityD
maintenanceEnables interaction with Brex financial data including expenses, budgets, transactions, and accounts through read-only API access with support for pagination, filtering, and receipt management.
21
19
MIT
mcp-server-corpayone
by borgels
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-server-corpayoneShow me my recent expenses"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-server-corpayone
An MCP server for the Corpay One accounts-payable API: read bills and receipts, code them, manage the coding vocabulary, and — when explicitly enabled — approve or decline them.
Reads work out of the box. Every write is refused unless the server is configured to allow it, and each one goes through a prepare/commit ceremony so a change is reviewed before it happens.
What it can do
Read — expenses (bills, receipts, credit notes) with their state, vendor, amounts, attachments and coding; the activity log and approver list for an expense; the coding vocabulary (categories, label lists and labels); vendors; webhook subscriptions. With broader scopes also credit accounts and card transactions, payment methods, team members, departments and items — see below.
Write — code an expense (category and labels, set atomically); split an expense into coded amount lines; create vendors and set their external ids; maintain categories and label lists; manage webhook subscriptions.
Approve — approve or decline an expense awaiting approval. Gated separately; see below.
Start with corpay_search_capabilities to discover the tools and the
allowlisted endpoints.
Related MCP server: fintaro-mcp
Two things that will bite you
Amounts are in minor units. An amount of 930000 is 9,300.00 DKK. This
applies to everything the API returns and everything you send it.
Coding uses Corpay's internal ids, not accounting numbers. A category has
both an id and a number; the write takes the id, while the number is what
a bookkeeper recognises. Always resolve ids with corpay_list_coding_options
before coding, and match on the number or name found there.
Configuration
Copy .env.example and fill it in. Credentials are read from the environment
only — never from tool arguments.
CORPAYONE_CLIENT_ID=...
CORPAYONE_CLIENT_SECRET=...
CORPAYONE_REFRESH_TOKEN=...
CORPAYONE_ENV=productionCreate an app at https://app.corpayone.com/developers, then run the grant once
to capture a refresh token:
npm run auth:grantWhat the grant can reach
A standard Corpay app registration can obtain exactly these scopes, and
auth:grant requests them: expenses.all, teams.all,
teams.categories.all, teams.lists.all, teams.vendors.all,
webhooks.all, offline_access.
Some endpoints need more than that, and it is not obtainable self-service:
asking for such a scope makes the authorize call fail outright, and adding it
to the app in the developer portal is not enough either — verified against the
live service, identity.corpayone.com keeps its own client allowlist and still
refuses it. Enabling those needs Corpay support.
So the server does not offer tools that cannot work. With a standard grant these are simply absent, rather than present and failing:
Needs scope | Hidden tools / fields |
|
|
|
|
|
|
| departments in |
| items in |
If Corpay grants more, list the scopes in CORPAYONE_SCOPE and the matching
tools appear — the gate is configuration, not a code change.
Everything central to accounts payable works on a standard grant: expenses and
their full detail, activity log, approvers, categories, label lists and
labels, vendors, webhooks, coding, and approvals. The scope map is measured
against the live API rather than inferred from the OpenAPI documents, because
the real behaviour does not follow the obvious pattern — teams.all covers
/teams/{id}/modules but not /teams/{id}/departments or /members, and
expenses.all covers /expenses/{id}/approvers. Re-run npm run smoke:live
after changing a grant; it skips what the grant cannot reach instead of
reporting it as a failure.
Scoping the server to one company
One Corpay grant reaches every team the user belongs to, and the team is chosen per request. If you run one instance per company, set:
CORPAYONE_TEAM_ID=<team id>The team then becomes a hard boundary: it is injected into every path, query and body, and a request naming a different team is rejected rather than quietly redirected. Without it, callers choose the team themselves — appropriate when the grant belongs to the person using it, but not when several people share one endpoint.
Find team ids with corpay_list_teams.
Write policy
Writes are off by default and are enabled in two independent steps:
CORPAYONE_ENABLE_WRITES=true # coding, vendors, lists, webhooks
CORPAYONE_ENABLE_APPROVALS=true # approve / decline an expenseApproval is separate because approving a bill releases it for payment. A server can be allowed to code all day without ever being able to approve anything.
Some endpoints are refused regardless: creating or deleting teams, managing
members, and payment methods. Deleting a category, department, list or webhook
is classified dangerous and is likewise refused. CORPAYONE_POLICY_PATH can
point at a JSON file to narrow the policy further (or, deliberately, to widen
it) — including maxAmount, compared in minor units.
Set CORPAYONE_AUDIT_LOG to a file path to record one JSON line per write
attempt. Idempotency keys are hashed rather than stored.
Preparing and committing
No write tool sends anything. Each corpay_prepare_* tool validates the change
against the allowlist and the policy and returns it with an operationHash.
Pass that operation back to corpay_commit_prepared_operation — unchanged, with
the hash restated and an idempotencyKey — to execute it. Editing the payload
in between invalidates the hash.
Approvals are committed with corpay_commit_expense_approval instead; the two
commit tools will not accept each other's operations.
corpay_prepare_expense_coding reads the expense first and reports its current
coding alongside the proposed change, so the difference is visible before
anything is committed.
Running it
npm install
npm run build
npm run dev # stdio, for a desktop MCP client
npm run dev:http # Streamable HTTP on 127.0.0.1:3000/mcpA container image is published to
ghcr.io/borgels/mcp-server-corpayone. It runs the HTTP transport:
docker run --rm -p 3000:3000 --env-file corpayone.env \
ghcr.io/borgels/mcp-server-corpayone:latestThe HTTP transport binds to loopback by default and expects to sit behind a
reverse proxy that terminates TLS and authenticates callers. MCP_HTTP_TOKEN
adds a bearer check; MCP_ALLOWED_ORIGINS restricts browser origins.
Verifying a deployment
npm run typecheck && npm test # offline
CORPAYONE_TEAM_ID=<team> npm run smoke:live # read-only, hits the real APIThe live smoke test also asserts that a cross-team read is refused, so it doubles as a check that the boundary is actually in force.
Webhooks
validateWebhookSignature (exported from ./gateway) verifies the
X-Roger-Signature header — t=<epochSeconds>;v1=<hex>, HMAC-SHA512 of
<t>.<rawBody> keyed by CORPAYONE_WEBHOOK_SECRET. Pass the raw, unparsed
body.
Notes on the API
Built against the published OpenAPI documents at api.corpayone.com/docs
(public-v1, v2 and v3). The endpoint allowlist is generated from them, so an
unlisted path fails locally instead of reaching Corpay.
One endpoint is not in those documents: PATCH /v2/expenses/{id} with
application/json-patch+json. It is the only way to set category, labels and
departments in a single atomic request, so it is used for coding and marked
provisional in the catalog. Its writable paths are /categoryId (scalar) and
/labels and /departments (plain id arrays); the JSON Patch op must be add
when the field is empty and replace when it is not, which is why the expense
is read before the patch is built.
Licence
Apache-2.0.
Available Tools
8 toolscorpay_call_endpointCall allowlisted Corpay One endpointC
Call a validated, allowlisted endpoint. Read-only unless write policy permits the call.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| query | No | ||
| method | No | GET | |
| pathParams | No | ||
| pathTemplate | Yes | ||
| idempotencyKey | No |
TDQS
C2.9/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false and openWorldHint=true. The description adds that the endpoint is validated and allowlisted, and clarifies the read-only behavior is conditional on write policy. However, it does not describe response format, error handling, or cancellation behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences, covering purpose and a usage condition. However, it sacrifices necessary detail about parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness1/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and 0% parameter coverage, the description fails to provide essential context for a 6-parameter tool. The agent lacks guidance on how to construct requests, making the tool difficult to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description provides no explanation of the six parameters (body, query, method, pathParams, pathTemplate, idempotencyKey). An agent cannot infer their meaning or usage from the description alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool calls a validated, allowlisted endpoint. The verb 'call' and resource 'endpoint' are precise, and the tool's generic nature distinguishes it from sibling tools like corpay_list_expenses or corpay_check_connection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers limited guidance on when to use this tool versus siblings. It mentions read-only unless write policy permits, which hints at safe usage, but lacks explicit when-to-use or when-not-to-use instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corpay_check_connectionCheck Corpay One connectionARead-only
Validate OAuth credentials by acquiring an access token (does not require a teamId).
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
A4.2/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint and openWorldHint are true. The description adds that the tool acquires an access token and that no teamId is needed, providing context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is clear and concise, with no unnecessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description adequately explains its function. However, it could mention what the tool returns (e.g., success/failure) for full completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the schema coverage is 100%. The description adds value by clarifying that no teamId is required, which is useful for agent understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it validates OAuth credentials by acquiring an access token, which distinguishes it from sibling tools that perform other actions like calling endpoints or listing expenses.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions it does not require a teamId but does not explicitly state when to use this tool versus alternatives, such as before making other API calls or for troubleshooting.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corpay_commit_prepared_operationCommit prepared operationADestructive
Execute a prepared, policy-checked write. Requires the full prepared operation, a matching confirmOperationHash, and an idempotencyKey.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | ||
| idempotencyKey | Yes | ||
| confirmOperationHash | Yes |
TDQS
A4/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, destructiveHint=true, openWorldHint=true. The description adds that the write is 'policy-checked' and requires idempotencyKey, which provides some additional context but does not elaborate on what gets destroyed or side effects. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the core purpose ('Execute a prepared, policy-checked write') followed by required inputs. Every word contributes value with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (3 required params, no output schema, destructive nature), the description covers the main action and inputs but does not specify return values, success indicators, or sync/async behavior. It's mostly complete but could add a note on what to expect after execution.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description compensates by explaining the purpose of each parameter: operation is the 'full prepared operation', confirmOperationHash must match, and idempotencyKey ensures idempotency. This adds meaning beyond the bare schema, though type details are lacking.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a prepared, policy-checked write. It specifies the required inputs (operation, confirmOperationHash, idempotencyKey). The verb 'execute' and resource 'prepared operation' are precise, and the name itself distinguishes it from sibling prepare tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use after a preparation step but does not explicitly state when to use this tool versus its siblings (e.g., corpay_prepare_expense_coding). It lacks exclusions or alternative guidance, relying on the implied context from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corpay_list_expensesList expensesARead-only
List expenses (bills/documents). Filter via query (e.g. status=pending_approval).
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No |
TDQS
A3.5/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and openWorldHint=true, so the description's 'List expenses' adds no further behavioral context. It does not disclose pagination, latency, or result limits. With annotations covering the core behavioral traits, the description adds minimal extra transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the verb and resource, followed by the filtering usage. No extraneous words; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a simple list tool with one optional parameter and no output schema, the description is adequate but incomplete. It does not address pagination, result format, or handling of complex nested query objects. For a tool with nested object parameters, more detail would be beneficial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It provides a concrete example of how to use the query parameter ('status=pending_approval'), which adds meaning beyond the abstract schema definition. However, it does not explain all possible filter keys or the structure of nested objects.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose4/5
Does the description clearly state what the tool does and how it differs from similar tools?
Title and description clearly state the verb 'list' and resource 'expenses', with parenthetical clarification 'bills/documents'. While not explicitly differentiating from sibling tools, none are similarly named, so the purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides an example of filtering usage ('status=pending_approval') but lacks when-not-to-use guidance or comparison with sibling tools like corpay_prepare_expense_coding. The use case is implied but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corpay_list_webhooksList webhooksARead-only
List active webhook subscriptions for the configured team.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
A3.8/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already state readOnlyHint=true and openWorldHint=true, so the safety and variability are covered. The description adds that only 'active' subscriptions are listed, but does not mention pagination, limits, or response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that efficiently communicates the tool's purpose without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with no input parameters, the description adequately states what it returns and the scope. However, it lacks details on response structure or any constraints, though no output schema exists to compensate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so baseline 4 applies. The description does not need to add parameter info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists active webhook subscriptions for the configured team, using a specific verb and resource. It distinguishes itself from the sibling tool 'corpay_prepare_webhook_change' which modifies webhooks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'corpay_prepare_webhook_change' or when to list webhooks. No context about prerequisites or conditions is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corpay_prepare_expense_codingPrepare expense codingARead-only
Dry-run update of an expense’s coding — category (GL account) and labels (project, cost type, ...). Returns an operationHash to commit. Does not call Corpay One until committed.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| reason | Yes | ||
| expenseId | Yes |
TDQS
A4/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses key behavior: dry-run, no call to Corpay One until committed, returns operationHash. Annotations indicate readOnlyHint=true, which aligns with no side-effects until commit. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Two effective sentences front-loading purpose and behavior. No fluff; every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple tool with no output schema, but parameter explanations are missing. Workflow is clear, but parameter semantics are incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%. Description mentions categories and labels, suggesting body content, but does not explain expenseId or reason. Lacks explicit mapping to parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool is a dry-run update for expense coding (GL account and labels), returns an operationHash, and does not commit until later. Differentiates from sibling corpay_commit_prepared_operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage: prepare then commit. Lacks explicit when-not-to-use or alternatives, but the dry-run nature and hash return clearly guide the workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corpay_prepare_webhook_changePrepare webhook changeARead-only
Dry-run create (POST), update (PUT), or delete (DELETE) of a webhook subscription. Returns an operationHash to commit.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | ||
| method | No | POST | |
| reason | Yes | ||
| webhookId | No |
TDQS
A3.5/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds context beyond the readOnlyHint annotation by specifying the dry-run nature (no actual changes) and that the output is a hash for commitment. It does not detail error behavior or idempotency, but the annotation already covers read-only safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness3/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The two-sentence description is concise but omits vital parameter semantics, making it too brief for a tool with four parameters and no output schema. The structure front-loads the key 'Dry-run' concept, but the lack of parameter info undermines conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness2/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is incomplete for the tool's complexity: 0% schema coverage, no output schema, and no mention of error cases or parameter details. It only partially covers the return value (operationHash) and omits essential usage context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters1/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage and no parameter descriptions in the description, the agent receives no guidance on the meaning or format of body, method, reason, or webhookId. This is a critical gap given the tool has four parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool performs a dry-run of create, update, or delete operations on webhook subscriptions, and that it returns an operationHash for later commitment. This distinguishes it from sibling tools like corpay_list_webhooks and corpay_commit_prepared_operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The term 'Dry-run' explicitly signals a preview mode before committing changes, which guides the agent to use this tool for testing rather than direct modification. The mention of 'operationHash to commit' implies a follow-up step, though it does not name the sibling commit tool explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
corpay_search_capabilitiesSearch Corpay One capabilitiesARead-only
Find supported tools and allowlisted endpoint operations.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | No |
TDQS
A3.5/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false. The description adds the specific search context but no additional behavioral details like pagination, rate limits, or what happens with an empty query.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no redundant text. Could be slightly improved by briefly mentioning the query parameter's role, but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple search tool with no output schema. Lacks details on input behavior (e.g., case sensitivity, partial matching) but covers the basic purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description does not explain the 'query' parameter's meaning or behavior (e.g., what empty query returns, how to format). Relies entirely on the parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Find supported tools and allowlisted endpoint operations' clearly states the tool's purpose with a specific verb ('find') and resource ('tools' and 'endpoint operations'). It distinguishes from sibling tools like corpay_call_endpoint which executes calls.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives. The purpose implies it's for discovery, but no 'when not to use' or references to siblings are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
8 tool updates
v0.0.1- First observed
corpay_call_endpoint - First observed
corpay_check_connection - First observed
corpay_commit_prepared_operation - First observed
corpay_list_expenses - First observed
corpay_list_webhooks - First observed
corpay_prepare_expense_coding - First observed
corpay_prepare_webhook_change - First observed
corpay_search_capabilities
TDQS
A3.8/5.0
Disambiguation5/5
Each tool has a distinct purpose: connection check, generic endpoint call, committing prepared writes, listing expenses/webhooks, preparing expense coding or webhook changes, and searching capabilities. Descriptions clearly differentiate them, with no overlapping functionality that would cause confusion.
Naming Consistency5/5
All tools follow a consistent 'corpay_verb_noun' pattern using snake_case, such as 'corpay_list_expenses' and 'corpay_prepare_webhook_change'. Verbs are descriptive and uniform, making the tool set predictable and easy to navigate.
Tool Count5/5
With 8 tools, the server is well-scoped for its purpose of interacting with the Corpay One API. Each tool covers a necessary function (authentication, listing, preparing, committing, searching) without unnecessary bloat or gaps.
Completeness4/5
The tool set covers core workflows including listing, preparing, and committing operations. However, direct 'get' operations for individual expenses or webhook subscriptions are missing, requiring use of the generic endpoint call tool. This minor gap prevents full CRUD coverage.
Maintenance
ActivityMaintained
ResponsivenessNo issues
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Manage expenses, corporate cards, accounts payable, and accounting integrations
Governed finance operations for AP, AR, GL, approvals, reporting, and payments.
Agent payments, API key vaulting, and governed mandates. Agents spend within user-defined limits.
Read-only finance and operations controls for AI agents with evidence and safe next actions.
Related MCP Servers
fintaro-mcpofficial
AlicenseAqualityCmaintenanceEnables MCP-capable agents to read Fintaro invoices and transactions, and upload receipts, via a scoped API key with PII-safe projections.6Apache 2.0- AlicenseNot gradedqualityBmaintenanceEnables agents to perform financial operations including categorization, reconciliation, and reporting on a tamper-evident, self-hosted ledger.AGPL 3.0
- AlicenseNot gradedqualityCmaintenanceEnables read-only access to PayPal transactions, orders, invoices, and disputes for auditing cash flow and tracking billing.15MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/borgels/mcp-server-corpayone'
If you have feedback or need assistance with the MCP directory API, please join our Discord server