Altitude MCP reads card activity within account permissions
Altitude MCP connects AI assistants to workspace balances and transactions, with PDF and CSV exports. Access follows the currently signed-in account: MCP neither adds nor removes permissions. Even when that account can make payments, MCP cannot create, approve or submit payments, change workspace settings or move money.
Workspace read access covers account balances and permitted transactions. Card-only access covers the user's own card spending, refunds and statuses, including history for deleted cards. It excludes other people's cards, card top-ups, withdrawals, cashback and non-card activity. For Altitude Card users, the same request for a spending summary can therefore return different coverage depending on the account's permissions.
A card-only total cannot represent total company spending. If an assistant cannot see a transaction or a field has no value, counting it as 0 would turn an access limit into a false accounting result. Before calculating a total, the assistant needs to read every page of results and distinguish refunds and transaction statuses; a partial page or an unqualified sum can distort spending even within the visible cards.
Exports remain restricted to the requester for viewing and downloading, with current membership and permissions checked again. Creating an export does not remove the access checks that apply when retrieving it.
Connections are managed under “Settings → My account → MCP connections”. Disconnect revokes that client's access across all workspaces without signing the user out of Altitude. Before using a summary for reconciliation, check its permission scope, pagination coverage and treatment of refunds and statuses.
Sources: MCP launch, card transaction access, MCP overview, MCP permissions.
