C

Brex MCP Server

Community Brex corporate card and expense management MCP server with transactions, budgets, and receipt matching

Overall Score67/100

Score Breakdown

Server Info

Package
mcp-brex
Registry
npm
Maintainer
Community
Category
Finance & Payments
Tags
expensescorporate-cardsfinance
Last Scanned
7 Apr 2026

Findings

5 issues

Authentication & Identity

HIGHNo per-request auth - requires instance-per-user

Uses a static API key (BREX_API_KEY) passed via environment variables. Stdio transport only via StdioServerTransport. Has built-in rate limiting configuration via env vars. No OAuth, no HTTP/SSE transport. For multi-tenant deployment, the platform must spawn a separate server instance per user.

Remediation

Add HTTP/SSE transport to accept per-request Authorization headers, or implement the MCP OAuth spec.

LLM Safety

MEDIUM2 tool descriptions are too vague

Short or generic descriptions make tool selection unreliable.

Remediation

Expand descriptions with specific actions, data types, and side effects.

MEDIUMOverlapping tool descriptions may cause wrong selection

Similar descriptions between tools could cause the LLM to pick the wrong one.

Remediation

Differentiate descriptions with unique use cases.

Maintenance & Trust

LOWCommunity-maintained by Dennison Bertram

No official vendor backing.

Remediation

Seek vendor verification.

HIGH19 dependency vulnerabilities (1 critical, 12 high)

npm audit found 1 critical and 12 high severity CVEs.

Remediation

Run `npm audit fix` and update vulnerable dependencies.

Tools

21 total
NameDescriptionRisk
get_budgetsList budgets (read-only). Example: {"limit":10}read
get_budgetGet a budget by ID (read-only). Returns the complete budget object.read
get_spend_limitsList spend limits (read-only). Example: {"limit":10,"status":"ACTIVE"}read
get_spend_limitGet a spend limit by ID (read-only).read
get_budget_programsList budget programs (read-only). Returns complete budget program objects.read
get_budget_programGet a budget program by ID (read-only).read
get_expenseGet a single expense by ID. Returns the complete expense object.read
get_card_expenseGet a single card expense by ID. Returns the complete card expense object.read
get_card_statements_primaryGet complete statements for the primary card account. Returns full statement objects.read
get_cash_transactionsLIST: Cash transactions (requires cash scopes). Returns complete transaction objects.read
get_card_transactionsLIST: Primary card transactions. Returns complete transaction objects.read
get_cash_account_statementsGet cash account statements by account ID. Returns complete statement objects.read
get_transactionsGet transactions for a Brex accountread
get_expensesLIST (single page): Expenses with optional filters. Returns complete expense objects.read
get_account_detailsGet detailed information about a Brex accountread
upload_receiptUpload a receipt image to match with expenseswrite
match_receiptCreate a pre-signed URL for uploading a receipt that will be automatically matched with existing expenseswrite
update_expenseUpdate an existing card expensewrite
get_all_accountsGet all Brex accounts with pagination supportread
get_all_expensesLIST: Paginated expenses with filters. Returns complete expense objects.read
get_all_card_expensesLIST: Paginated card expenses (no expense_type needed). Returns complete card expense objects.read

Deploy Brex MCP Server securely

CompleteFlow adds per-user authentication, permission scoping, and audit logging to any MCP server out of the box.

Deploy on CompleteFlow