MCP

Spendbaker has an MCP server: AI assistants such as Claude or ChatGPT can read your Spendbaker data and answer questions like "How much is left on the 2026 marketing budget?" or "What did we spend with Northwind Media last quarter?".

The assistant reads exactly what you see in the app, and it can't change anything. It reads through this API, so everything in these pages applies: the same rights, data and limits.

The server's address:

https://app.spendbaker.com/sb_back/mcp

It uses the MCP Streamable HTTP transport.

Two ways to connect

	Sign in with Spendbaker	Access key
For	Claude (web, desktop and mobile), Claude Code, ChatGPT	Any other MCP client: Cursor, Dust, your own agent
Setup	Add the address, sign in to Spendbaker, click Allow	Create a personal access key and send it in a header
Stop it	Disconnect the app in Spendbaker	Revoke the key

Only the apps in the first column can sign in with Spendbaker. Any other client needs an access key.

Claude

1. In Claude, open Settings › Connectors and add a custom connector.
2. Name it "Spendbaker" and paste the address https://app.spendbaker.com/sb_back/mcp. Leave every other field empty: there is no key or client id to enter.
3. Claude sends you to Spendbaker. Log in if needed, read what Claude will be able to do, and click Allow.

The connector then works in Claude on the web, on desktop and on mobile. On a Team or Enterprise plan, an owner may have to add the connector for the organization first.

ChatGPT

Add Spendbaker as a custom connector, with the address https://app.spendbaker.com/sb_back/mcp. ChatGPT sends you to Spendbaker: log in if needed and click Allow. Whether you can add custom connectors depends on your ChatGPT plan and settings.

Claude Code

claude mcp add --transport http spendbaker https://app.spendbaker.com/sb_back/mcp

Then, in Claude Code, run /mcp, pick spendbaker and choose Authenticate. Your browser opens Spendbaker: click Allow. Claude Code runs on your computer, so allow it only if you started the sign-in yourself.

Other clients, with an access key

Create a personal access key, then have your client send it in the Authorization header: Authorization: Bearer gak_….

Cursor, in ~/.cursor/mcp.json:

{
  "mcpServers": {
    "spendbaker": {
      "url": "https://app.spendbaker.com/sb_back/mcp",
      "headers": {
        "Authorization": "Bearer gak_…"
      }
    }
  }
}

Claude Code, if you'd rather use a key than sign in:

claude mcp add --transport http spendbaker https://app.spendbaker.com/sb_back/mcp \
  --header "Authorization: Bearer gak_…"

Dust: add an MCP server with the address https://app.spendbaker.com/sb_back/mcp, authenticated by a bearer token: your key.

A shared agent sees what you see

A key acts as you. If you put it in an agent your team shares, such as a Dust agent, everyone who uses that agent reads Spendbaker as you, including the budgets shared only with you. Organization access keys, made for shared agents, are coming.

What the assistant can read

The server gives the assistant these tools. Each one reads one route of this API.

Tool	Reads	Route
get_organization	Who the connection acts as, and its organization	GET /organization
list_members	The organization's members, with names and roles	GET /users
list_vendors	The organization's vendors	GET /vendors
list_budgets	The budgets shared with you, with total, spent and committed	GET /budgets
get_budget	One budget, its plan per month and all its categories	GET /budgets/{budget_id}
list_categories	A budget's categories, one level at a time	GET /budgets/{budget_id}/categories
search_expenses	Expenses, by budget, category, vendor, status and period	GET /expenses

Like the API, the assistant:

• sees only the budgets shared with you, and their expenses;
• never sees members' email or phone, or vendors' email;
• can't create, change or delete anything: do that in the app;
• can't read ads integrations, the ROI analyzer, the activity log or invitations.

What the assistant reads is sent to the AI provider you use, such as Anthropic or OpenAI, under that provider's terms.

Staying connected, and disconnecting

Apps that signed in with Spendbaker:

• The app stays connected as long as it is used at least once every 30 days. After that, it asks you to sign in again.
• See them in Spendbaker, in Settings › API & Keys, under Connected apps. Disconnect cuts an app off at once.
• If you leave the organization, or are removed from it, the connection stops working at once.

Clients using an access key work until the key expires or you revoke it (see When a key stops working).

Limits and errors

• Each tool call is one API request. A connection, or a key, can make 120 per minute, shared with any API calls made with the same key. Over that, the assistant is told how many seconds to wait.
• Refused: the key expired or was revoked, or you left the organization. With a key, create a new one. An app that signed in asks you to sign in again.
• Not found: the item doesn't exist, or isn't shared with you. Spendbaker doesn't say which.