Skip to main content
The Pleo MCP uses a layered permission model. Company admins control whether MCP access is enabled for the entity, and which users can connect. What AI agents can access through the MCP is then governed by each user’s existing Pleo permissions and their configuration of their AI client.

​
For Admins

​
Enabling MCP Access

MCP access is off by default. An admin must enable it before any user in the organisation can connect an AI client. To enable MCP access:
  1. Go to Settings → General → Pleo AI in the Pleo settings
  2. Under the MCP section, enable Pleo MCP access
Once MCP access is enabled, a list of people appears below the toggle, where you can control who can connect. See Managing User Access.

​
Managing User Access

Once MCP access is enabled for an entity, everyone in that entity can connect by default. Admins control individual access from the list of people below the toggle in Settings → General → Pleo AI. The list shows everyone in the entity, including external bookkeepers, along with their team and whether they currently have access. To change access for one person:
  1. Go to Settings → General → Pleo AI in the Pleo settings
  2. Find the person in the list, or search by name, email, or team
  3. Turn AI access on or off for them
To change access for several people at once, select them using the checkboxes, then choose Grant AI access or Remove AI access. User access is set per entity, in the same way as the entity toggle. If someone belongs to more than one entity, their access is managed separately in each one.

​
Disabling MCP Access

To remove access for specific people, turn off their AI access in the list of people. See Managing User Access. To disable MCP access for a whole entity, turn off the toggle in Settings → General → Pleo AI. This immediately disables access to the Pleo MCP for all clients and agents in that entity.

​
Staging Environment

The staging MCP server mirrors the production permission model. MCP access must also be enabled per entity in your staging Pleo account before connecting. See How to Install the Pleo MCP as a Custom MCP: Using Staging for setup steps.

​
For Users

​
User Permission Model

The MCP server does not grant any new permissions. An agent acting on behalf of a user can only do what that user can already do in the Pleo product.
  • A spender can read and update their own expenses
  • An agent cannot access data the connecting user cannot see in the Pleo app
Users can configure what tools require user approval within their AI client. Write tools that require approval will prompt the user to confirm the intended change before the tool executes.

​
Working Across Multiple Entities

If you have access to more than one Pleo entity, the agent can work in any of them without you reconnecting or re-authorising.
  • Each request targets one entity at a time. There is no “all entities at once” mode. The agent cannot combine data from two entities within a single request.
  • Your default entity is used unless you say otherwise. This is the entity you connected during setup. To work in a different one, name it in your request, for example “show my expenses in Beta Ltd”.
  • Naming the entity is not sticky. If you want to stay in a non-default entity across several requests, keep referring to it, or tell the agent to keep working in that entity.
  • Each entity needs its own admin opt-in. An entity where MCP access hasn’t been enabled is not available to the agent, even if you have access to it in the Pleo app.
Your permissions are resolved per entity. If you are an owner in one entity and a spender in another, the agent can only do what your role in that specific entity allows.

​
Revoking Your Access

Users can disconnect their own AI client’s MCP access. See How to Revoke Access to the Pleo MCP for the full steps.

​
Audit Trail

Any action taken or data updated in Pleo are recorded in Pleo’s activity and audit logs. The actions are visible in the Activity tab for the relevant expense.

​
Security Boundaries

  • No payment actions. The MCP does not support wallet top-ups, reimbursement payouts, invoice payments, or any autonomous payment decisions. SCA and regulatory controls remain intact.
  • No permission elevation. An agent cannot access data or take actions beyond the connected user’s existing Pleo permissions.

​
What Comes Next?