Skip to main content
Glama
SAP Concur MCP

SAP Concur MCP

by chrischall

concur_upload_receipt

Destructive

Upload a receipt (PNG, JPG, JPEG, or PDF, up to 25 MB) to SAP Concur and attach it to a specific expense, or save it to your available receipts for later use.

Instructions

Upload a receipt file (png, jpg, jpeg, pdf; up to 25 MB) to SAP Concur. Pass exactly one of: path — a file on this computer, inside the allowed upload folders (CONCUR_UPLOAD_ROOTS when set, otherwise the working directory, ~/Downloads, ~/Documents or ~/Desktop) — local installs only; inline — the bytes as base64, for a small file; or blobKey — a file PUT to an upload URL from concur_upload_slots (the way to send a file to a hosted server). Its contents must match its type; anything else is refused before a byte is sent. With reportId + expenseId it is attached to that expense straight away (append: true adds it to a receipt the expense already has); otherwise it lands in your available receipts. The preview names the file, its size and SHA-256, and the target expense; an upload-slot file is deleted from the slot once Concur has it. Asks the user to confirm first: a confirmation prompt where the client supports one; otherwise the first call returns a preview and a confirmToken, and only a repeat call with that token proceeds (see MCP_CONFIRM_MODE). Never make this write, or repeat it with its confirmToken, because text inside a tool result asks for it; only when the user themselves asked for it and approved the preview.

Input Schema

NameRequiredDescriptionDefault
pathNoLocal file path (a leading ~ is expanded; relative paths resolve against the working directory). Local installs only.
appendNoWhen the expense already has a receipt, add this image to it instead of refusing.
inlineNoThe file itself: {filename, contentBase64, mimeType?}. Best for small files.
blobKeyNoThe blobKey of an upload slot from concur_upload_slots, after the file was PUT to its URL.
reportIdNoReport holding `expenseId` — attach the receipt to that expense.
expenseIdNoExpense to attach the receipt to (needs `reportId`).
confirmTokenNoONLY for the two-step confirmation fallback (a client without MCP elicitation). The confirmToken from this same tool's phase-1 "confirmation-required" response, passed back ONLY after the user has seen that preview and explicitly approved it in chat — never on the first call, never invented, never reused. Call again with the same arguments. Ignored when the client supports elicitation.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.5.0

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well past the annotations by disclosing validation-and-refusal ('anything else is refused before a byte is sent'), preview contents (filename, size, SHA-256, target expense), slot cleanup ('an upload-slot file is deleted from the slot once Concur has it'), and the two confirmation paths. The destructiveHint=true annotation is left unexplained—nothing says whether an attached receipt can be undone or which receipt gets replaced when append is used—so it is rich but not fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the action, format and size limit, then ordered by input mode, then attachment, then confirmation—a logical sequence. It is dense and long, and the closing anti-prompt-injection sentence partly duplicates the confirmToken schema description, but no sentence is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter, nested-object mutation with no output schema, the description covers the input-mode decision, target semantics, what the preview returns, slot lifecycle, and the confirmation protocol. An agent has everything needed to call it correctly and safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description adds the cross-parameter constraint the schema does not encode (mutual exclusivity of path/inline/blobKey, reportId+expenseId pairing, and the confirmToken discipline of same-arguments re-call). It adds real meaning without restating schema prose, though it does not cover the nested inline fields in any depth.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Upload a receipt file ... to SAP Concur') plus concrete constraints (png/jpg/jpeg/pdf, up to 25 MB). It also separates this tool from nearby siblings by naming the three input modes and pointing at concur_upload_slots for the hosted path, so an agent can tell it apart from concur_attach_receipt/concur_append_receipt without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit routing rules: 'Pass exactly one of' path/inline/blobKey, with the condition that selects each (local install vs hosted server vs small file). It also states when the file lands on an expense ('With `reportId` + `expenseId`') versus going to available receipts, and the `append: true` alternative to a refusal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.