> ## Documentation Index
> Fetch the complete documentation index at: https://developers.dash.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# MCP server

> Connect Claude, ChatGPT, Cursor, or any MCP-compatible AI assistant to your Dash.fi account.

The Dash.fi MCP server lets you connect your AI assistant to your Dash.fi account so you can ask questions about your data in plain language — "what bills are due this week?", "show my pending approvals", "how much did Marketing spend last month?"

The connection is **read-only**. Your assistant can look things up and report on them, but it cannot create cards, approve requests, pay bills, or move money.

## What you can ask about

| Area | What you can ask |
| - | - |
| Cards | Card status, spend vs. limit, restrictions, and cardholders |
| Transactions | Amounts, merchants, dates, status, and decline reasons |
| Bills | Vendor bills — amounts, due dates, and payment status |
| Approvals | Pending card requests, expenses, bill payments, and vendor changes |
| Teams & people | Team members, emails, and roles |
| Spend insights | Account credit position and spend summaries by card or team |
| Your profile | Who you're signed in as and what role you hold |

## Tools the server exposes

Thirteen read-only tools. Your assistant picks the right one for the question — you don't call these by name — but administrators reviewing the server can see the full surface here.

| Tool | What it does |
| - | - |
| `dash_get_current_user` | Who you're signed in as, and your role |
| `dash_list_users` | People on the account |
| `dash_list_teams` | Teams and their members |
| `dash_list_cards` | Cards, with status and limits |
| `dash_get_card` | One card in detail |
| `dash_list_transactions` | Card transactions, filterable by status or card |
| `dash_get_transaction` | One transaction in detail, including decline reason |
| `dash_find_bills` | Vendor bills — amounts, due dates, payment status |
| `dash_list_approval_requests` | The sign-off queue for cards, expenses, bills, or vendor changes |
| `dash_get_approval_request` | One approval request in detail |
| `dash_get_account_summary` | Credit position, recent spend, next payment |
| `dash_get_card_spend_summary` | Settled spend for a single card over a date window |
| `dash_get_team_spend_summary` | Settled spend for a team, broken down per card |

Every tool is annotated read-only, so compliant clients won't show "this tool can modify your data" warnings. Each one is gated on its own permission scope — a call your role doesn't cover is rejected rather than answered.

<Note>
  The two spend-summary tools read from the analytics warehouse, so their figures are current as of the latest refresh and can lag live transactions by a short period.
</Note>

## What it can't do

* **Read-only** — the assistant cannot create a card, approve a request, pay a bill, or move money
* Can't filter transactions by date range *(planned)*
* Can't narrow the approvals queue to only those waiting on you specifically *(planned)*

## Permissions

The assistant signs in as you and inherits your exact Dash.fi permissions — it gives no extra access. If you can't see something in Dash.fi, the assistant can't either.

| Role | What the assistant can access |
| - | - |
| Administrator | The whole company |
| Bookkeeper | The whole company's transactions, teams, bills, and spend insights; cards within your own visibility |
| Manager | Yourself, plus the people and teams you manage |
| Employee | Your own cards, transactions, and expenses |

Spend insights (the account credit position and spend summaries by card or team) require the Administrator or Bookkeeper role. Every other role can read cards, transactions, bills, and approvals within the visibility above; a spend-insight question is answered with an "insufficient scope" message rather than data.

## Connect your assistant

**Connector URL:** `https://mcp.dash.fi/mcp`

Add Dash.fi as a connector in your AI assistant, then sign in with your Dash.fi account when prompted. You only need to approve it once — you can disconnect at any time from the same settings screen.

| Assistant | How to add it |
| - | - |
| Claude (web & desktop) | Settings → Connectors → Add custom connector → paste the URL |
| Claude Code | `claude mcp add --transport http dashfi https://mcp.dash.fi/mcp`, then `/mcp` to sign in |
| ChatGPT | Settings → Apps & Connectors → add by URL |
| Cursor | Settings → MCP → add the server URL |
| Other MCP-compatible tools | Use the connector URL above and follow that tool's MCP setup docs |

**Verify it's working.** Ask your assistant *"Who am I?"* or *"List my cards"* — a sensible answer confirms the connection.

<Note>
  MCP is available to every Dash.fi organisation. An administrator needs to turn it on once under **Company → Products** before anyone can connect — until then, sign-in fails for everyone in the organisation.
</Note>

## Security

* You sign in with your own Dash.fi login — no separate password, no extra access granted
* You only ever see your own company's data
* Full card numbers and vendor bank account details are never exposed to the assistant
* Every request is logged for audit
* The connection is read-only

### How sign-in works

Sign-in uses the OAuth authorization code flow with PKCE. Your assistant redirects you to Dash.fi, you approve the connection once, and the assistant receives a token — **your password never reaches the MCP server**, and the server never stores credentials of any kind.

* **Short-lived access tokens.** An access token is valid for 60 minutes, after which your assistant obtains a fresh one. A leaked token stops working within the hour.
* **Tokens are validated at the edge.** Signature, audience, and expiry are checked before a request reaches the server at all, so an expired or forged token never touches your data.
* **Scoped tokens.** A token carries only the permission scopes your role holds. Any call beyond them is rejected for insufficient scope, and each tool re-checks its own scope on every call.
* **Client registration is dynamic.** Assistants register themselves at connection time, so there's no shared secret for you to distribute or rotate.

### Audit logging

Every tool call is recorded, and so is every rejected attempt — an expired token, a missing scope, or a request made while MCP is switched off. Each record captures who called, which tool, when, the outcome, and how long it took.

* **Outputs are never stored.** The log keeps the size of the response, not its contents.
* **Inputs are reduced to an allow-list.** Only a named set of fields per tool is retained, so free-text arguments don't land in the log.
* **Records are append-only** — they can't be edited or deleted after the fact.

Logs are held by Dash.fi. Contact [support@dash.fi](mailto:support@dash.fi) if you need MCP activity for your organisation as part of a security review or audit.

### Turning it off for everyone

An administrator can revoke MCP for the whole organisation at any time under **Company → Products**. This takes effect immediately: every subsequent request from every connected assistant is rejected, regardless of tokens already issued, and each rejection is recorded in the audit log. Re-enabling restores access without anyone having to re-approve the connection.

Changing a person's role is the narrower lever — it shrinks what their assistant can read on their next reconnect. Removing them from Dash.fi ends their access outright.

## Troubleshooting

<AccordionGroup>
  <Accordion title="The assistant can't see something I expect">
    The assistant uses your exact Dash.fi permissions. If you can't see it inside Dash.fi directly, the assistant can't either. Check what you see for the same query inside the app first.
  </Accordion>

  <Accordion title="The assistant returns nothing or an empty list">
    Either your role doesn't include that data, or there are simply no matching records. Check what you'd see for the same query inside Dash.fi.
  </Accordion>

  <Accordion title="My role changed recently and the assistant is showing wrong data">
    Disconnect and reconnect the connector. This refreshes your permissions so the assistant picks up your new role.
  </Accordion>

  <Accordion title="A tool is missing or behaving oddly">
    Disconnect and reconnect the connector — this refreshes the list of available tools.
  </Accordion>

  <Accordion title="I can't connect or sign-in fails">
    Check you're using the correct connector URL and the correct Dash.fi account. If sign-in still fails, MCP may not be turned on yet — ask an administrator to enable it under **Company → Products**.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.