MCP rollout for IT and security
This page is for the people who approve and deploy the SpendOne connector: IT, security and the Owner of your Claude organization. What the connector does for the people using it is in the MCP server guide, and every tool it can serve is listed in the MCP tool reference.
In one paragraph
Each person connects the assistant as themselves, through your normal SpendOne login and identity provider. There is no shared account. The assistant sees exactly what that person sees in the SpendOne dashboard and can do nothing that person could not do there, with the same roles, approval rules and four-eyes checks. Tools that change data are marked as such, and the assistant asks before running them. No card numbers pass through it. Every change is recorded in SpendOne's audit trail against the person who made it. Access can be cut per person, per token, or for the whole company.
The properties a review asks about
| Question | Answer |
|---|---|
| Who does the assistant act as? | The user who connected it, through your normal login and identity provider. There is no shared or service account, and a connection can never see more than that user sees in the dashboard. |
| Can one person's connection be used by another? | No. Every member of your Claude organization connects individually and gets a token of their own. A connector an Owner adds is shared as a configuration, never as a session. |
| Is the client ID a secret? | No. The connector is a public OAuth client that proves each login with PKCE, so there is no client secret to issue, store or rotate. |
| Can the assistant change data? | Yes, within what the user may do: draft and submit purchase requests, mark orders as ordered, decide approvals and claim accounting tasks. Every change runs the same permission checks, approval rules and four-eyes checks as the dashboard, each such tool is marked as changing data so Claude asks before running it, and SpendOne can turn any tool off for your deployment. |
| Does card data go through it? | No card numbers or CVVs. For a purchase order paid by virtual card, the requester or buyer sees the last four digits, the expiry and a link that opens the card in SpendOne, where it is revealed to the signed-in person. |
| Is it audited? | Every change made through an assistant is recorded in SpendOne's audit trail against the user, exactly as a change made in the dashboard. A change made with a personal access token is additionally marked as made with an API credential. Reads are not written to the audit trail. |
| What is out of reach? | Credit card details, subscriptions and payment methods, accounting exports, user administration, bulk import, audit-log export and anything under tenant administration. Those stay in the dashboard and the REST API. |
| Which assistants work? | Claude (web, Desktop, mobile) through the connector. Claude Code is not supported. An assistant that cannot take a client ID it is given, such as ChatGPT today, cannot connect yet. |
How data flows
- The assistant calls SpendOne from Anthropic's cloud, not from your users' devices.
- What leaves SpendOne is the result of the tools a user runs. It becomes part of that user's conversation with Claude, under your organization's agreement with Anthropic. Nothing is sent that the user could not open in the dashboard themselves.
- One tool,
product_scrape, fetches a public web page the user pasted, so a purchase request can be drafted from it. Every other tool reads and writes only your SpendOne data. - SpendOne's overall AI security posture (model providers, data residency, retention) is described at spendone.com/en/ai-security.
What to allow on your network
Nothing inbound. Your users' browsers and the Claude apps need to reach:
| Host | Why |
|---|---|
claude.ai | The Claude apps themselves. |
Your SpendOne login host (auth.spendone.tech in production) | The login screen a user is sent to when they connect. |
| Your identity provider | If you sign in to SpendOne with SSO, the login continues there, exactly as it does for the dashboard. |
The MCP endpoint itself (https://mcp.<environment>.spendone.tech/t/{your-tenant}/mcp) is called by Anthropic's servers, not by your users' devices, so it does not need to be allowed on your network. Access to it is decided by the login, not by network location.
Deploy the connector to everyone
Done once, by an Owner of your Claude organization (Team or Enterprise plan). You need your endpoint URL and the connector client ID.
- In Claude, open Organization settings → Connectors.
- Click Add, hover over Custom and choose Web.
- Paste your endpoint URL exactly, including the
/t/{your-tenant}/mcppath. - Open Advanced settings and paste the client ID. Leave the client secret empty.
- Click Add.
Then tell your users. Each one opens Customize → Connectors in Claude, finds the SpendOne connector, clicks Connect and logs in as themselves. Until they do, the connector does nothing for them.
Each user decides per tool whether Claude runs it without asking (Allow always) or asks every time, and can switch individual tools off in the conversation's tools menu. Claude asks before a tool that changes data unless the user has allowed it.
To change the endpoint or client ID later, remove the connector and add it again: Claude does not edit a custom connector in place.
Removing access
Someone leaves. Remove the user in SpendOne, or deprovision them in your identity provider if you provision users by SCIM. The next request any assistant makes with their connector or their tokens is refused. Deactivating a user instead stops new logins and their personal access tokens straight away; to end an assistant session they already have open, remove the user.
A removed user's personal access tokens stop working, but they are not deleted with the account. If you later invite the same email address again, ask your SpendOne contact to clear that person's old tokens first.
A token leaks. Its owner deletes it under Profile → API Tokens, and the next request with it is refused. Only the owner can see and delete their own tokens, so if the owner is not available, remove or deactivate the user, which stops every token they hold.
A user disconnects. In Claude, Disconnect on the connector drops that user's session. Nothing changes for anyone else.
The whole company. An Owner of your Claude organization removes the connector under Organization settings → Connectors, which takes it away from every member. To stop access on SpendOne's side as well, whatever client is used, ask your SpendOne contact to turn MCP access off for your tenant; it takes effect within a few minutes, and from then on every connection is refused.