# @chrischall/concur-mcp Unofficial SAP Concur MCP server for Claude — expense reports, expenses, receipts and trips — developed and maintained by AI (Claude Code) - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.3.3 - **Author:** Claude Code - **License:** MIT - **npm:** @chrischall/concur-mcp - **Source:** https://github.com/chrischall/concur-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-22T13:44:31.606Z - **Version scanned:** 0.3.3 - **CVEs:** none found by OSV at scan time ## Tools 37 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `concur_search_attendees` — Search the SAP Concur attendee directory (colleagues and saved business guests) by name or email text, as - `concur_set_attendees` — Set the attendees on an expense in an unsubmitted SAP Concur report (e.g. a group meal). This REPLACES the - `concur_list_reports` — List your SAP Concur expense reports (name, number, dates, approval and payment status, totals, approver). Filter by status (ALL, ACTIVE, UNSUBMITTED, SENT_FOR_ - `concur_get_report` — Get one SAP Concur expense report: the header (status, totals, policy), every expense entry on it (date, type, vendor, payment type, amounts, receipt, flags) an - `concur_get_report_timeline` — Get an SAP Concur report's history: its timeline — the comments on it (yours and approvers') and its workflow events (submitted, approved, sent back…), grouped - `concur_get_expense` — Get one expense entry on an SAP Concur report: date, type, vendor, payment type, amounts, location, receipt, itemizations, comments, exceptions, and the expense - `concur_list_available_expenses` — List SAP Concur available expenses — card transactions, e-receipts, mobile/ExpenseIt captures and quick expenses that are not on any report yet. A row whose fie - `concur_create_expense` — Add an expense to an unsubmitted SAP Concur report. The expense form is tenant- and type-specific: pick - `concur_update_expense` - `concur_delete_expenses` — Permanently delete one or more expenses from an unsubmitted SAP Concur report. Card transactions return to your available expenses; manually entered expenses an - `concur_copy_expense` — Duplicate an expense on an unsubmitted SAP Concur report (same type, amount, vendor and fields; receipts are not copied as the original’s). Answers with the new - `concur_move_available_expenses_to_report` — Move available expenses (card transactions, e-receipts, mobile captures — see concur_list_available_expenses) onto an unsubmitted SAP Concur report, where they - `concur_delete_available_expenses` — Permanently delete available expenses (not yet on any report — see concur_list_available_expenses), e.g. duplicate mobile captures or quick expenses. Cannot be - `concur_graphql_query` - `concur_graphql_mutation` - `concur_list_operations` - `concur_whoami` — Who the SAP Concur session belongs to: your Concur user id (UUID), the datacenter, minutes until the browser session token expires, and which Concur features yo - `concur_list_expense_types` — List the expense types you can use on one SAP Concur report (its policy decides which). Returns each type's id (pass it as the expense type when creating an exp - `concur_list_payment_types` — List the SAP Concur payment types you can put on an expense (e.g. cash / out-of-pocket, company card). Returns each payment type id and name. - `concur_list_currencies` — List the currencies SAP Concur accepts (ISO code and name), optionally filtered by a code or name fragment. - `concur_search_locations` — Search SAP Concur locations by city name (optionally narrowed by country and subdivision code) — the location list expense forms use. Returns each match with it - `concur_add_missing_receipt_declaration` - `concur_list_available_receipts` — List the receipt images in your SAP Concur receipt store — uploaded or emailed receipts not attached to any expense. Attach one with concur_attach_receipt, down - `concur_get_receipt` — Download one SAP Concur receipt image by id (from concur_list_available_receipts, or an expense’s `receiptImageId`). Locally it is saved, never overwriting, to - `concur_upload_receipt` - `concur_detach_receipt` — Take the receipt image off an expense on an unsubmitted SAP Concur report (re-attach one with concur_attach_receipt). The preview shows the expense and the imag - `concur_delete_receipt` — Permanently delete a receipt image from your SAP Concur available receipts (see concur_list_available_receipts). Cannot be undone. Only an unattached receipt ca - `concur_create_report` — Create a new (unsubmitted) SAP Concur expense report. The header form is tenant-specific: it starts from your company's defaults, then applies `name`, `reportDa - `concur_update_report` — Change an unsubmitted SAP Concur report's header — name, date, business purpose, comment, or other header fields by label. Sends only the fields that actually c - `concur_delete_report` — Permanently delete an unsubmitted SAP Concur expense report AND every expense on it (the expenses first, then the report — as the web app does). Card transactio - `concur_add_report_comment` — Add a comment to an SAP Concur expense report. Comments are permanent (there is no delete) and are seen by your approvers and auditors. Confirms the comment is - `concur_submit_report` - `concur_recall_report` — Recall a submitted SAP Concur expense report from your approver, returning it to you unsubmitted so it can be edited and resubmitted (the inverse of concur_subm - `concur_list_trips` - `concur_get_trip` - `concur_get_trip_history` - `concur_send_itinerary` ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"concur\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@chrischall/concur-mcp\"\n ]\n }\n }\n}" ``` ## Blast radius Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on your machine. - Floor 40, ceiling 64 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40chrischall%2Fconcur-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40chrischall%2Fconcur-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40chrischall%2Fconcur-mcp - HTML page: https://forgeregistry.com/registry/%40chrischall%2Fconcur-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.