Pleo

Diskret connects to Pleo’s official MCP server (https://mcp.pleo.io/mcp). Pleo supports dynamic client registration, so Diskret registers itself with Pleo: there is no app to create and nothing to paste. A Pleo admin only has to switch MCP access on.

Time: about 5 minutes. Who: a Pleo admin, and a Diskret owner or admin.

Why Pleo goes through Diskret

Expenses are personal data too. They hold employees’ names, attendees at meals, merchants and places, notes and receipts, and they show where and when someone spent money. Through Diskret the AI client sees pseudonyms such as [PERSON_12] instead of names, and every call is audited.

What Diskret can access

Each user connects their own Pleo account. Pleo applies the same permissions as that user has in Pleo, so the AI client can never see or do more than the user can.

Kind	Examples	Default in Diskret
Read	Search expenses, find expenses missing details, expenses waiting for review	Open
Write	Set categories and tags, split, add notes, attendees and receipts, approve, add to the export queue	Closed until an admin opens them

Start with read tools only. Pleo’s own documentation lists these capabilities but not every tool name: Diskret classifies each tool when it fetches the list, and you see the result under the connector’s tools.

1. Turn on MCP access in Pleo

1. In Pleo, go to Settings → General → Pleo AI.
2. Under MCP, turn on Pleo MCP access.
3. If your company has more than one entity, do this for each entity that should be reachable.

Pleo switches MCP access on or off for a whole entity: there is no per-user switch in Pleo yet. Use Diskret to decide who gets the tools (see step 2).

2. Add the connector in Diskret

1. In Diskret, go to Connectors → New connector.
2. Name it (e.g. Pleo) and set the URL to https://mcp.pleo.io/mcp.
3. Under Authentication, choose Sign in with OAuth, and under Whose credential choose Personal (each user connects their own).
4. Leave Client ID, Client secret and Scope empty.
5. Save, then click Check sign-in. Diskret shows the authorization server it found (https://mcp.pleo.io) and registers itself there.
6. Choose which units get access to which Pleo tools, e.g. only the finance unit. Keep write tools closed, or set them to need an approval.

Each user then goes to My connections, clicks Connect and signs in to Pleo. Users who have not connected do not see the Pleo tools. If Pleo stops accepting the sign-in, the user sees Sign in again under My connections.

Caution

If Check sign-in says the server needs an OAuth client, Pleo has stopped offering dynamic registration. Ask Pleo support for a client ID (and secret) for Diskret, with the Redirect URI shown on the connector form, and paste them under Authentication.

Maintenance

• Turn it off: switch off Pleo MCP access under Settings → General → Pleo AI to cut off every MCP client, Diskret included, or remove the connector in Diskret. Users can revoke their own access under My connections.
• Direct connectors: remove any direct Pleo connector in your AI client, so Pleo is only reachable through Diskret. See Recommended Claude settings.

Troubleshooting

Error	Likely cause	Fix
Sign-in works but tools return an access error	MCP access is off for this entity	Turn it on under Settings → General → Pleo AI
A user sees fewer expenses than expected	Pleo applies the user’s own permissions	Expected; change the user’s role in Pleo if needed
Check sign-in asks for a client ID	Dynamic registration unavailable	See the caution in step 2