Ramp
by Ramp
Query and act on a company's corporate card spend from your AI assistant. Load tools stage Ramp data into a queryable database, execute_query runs SQL over it — and the same connector approves transactions, edits coding and mints single-use card credentials.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Ramp via MCP
https://ramp-mcp-remote.ramp.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Ramp Tools & Capabilities (17)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- This connector writes to Ramp, and the write is not local-only. Approvals, transaction and reimbursement edits, GL coding, comments, card lock/unlock/activate, and single-use card credential generation are all documented. Treat it as an actor, not a reader.
- An agent can generate real payment credentials. A single-use PAN and CVV, merchant-scoped, amount-capped, expiring on first authorization or after 12 hours. Business-level enrolment and policy control gate it, and 14 merchant category codes are blocked.
- Where the staged data lives is undocumented for the hosted server. No published statement on host, retention, per-session isolation or encryption at rest. The self-hosted open-source server is in-memory and ephemeral; that is a different deployment.
execute_queryaccepts SQL over whatever was loaded, so the effective read surface is any question about the staged copy — much larger than 17 tool names implies, and bounded only by what someone chose to load.- 100 rows per query. Clients add filters and retry automatically, which means an answer may silently reflect a narrowed query rather than the full set.
- The table budget is real but unpublished. "ETL operation limit reached" fires when too many tables are loaded; the fix is dropping unused ones. Ramp states no ceiling, so a large spend export cannot be planned against a documented number.
- Ramp's general API rate limit is 200 requests per 10-second rolling window per source IP, with 429 on exceed. Ramp publishes this for the Developer API and does not state whether the hosted MCP server is governed by the same budget.
- Requests over 60 seconds are terminated with a 504. Ramp documents this for its API and recommends pagination and backoff for large datasets.
- Employee identities and the org chart are in scope. Loaded data includes users, reporting chains and direct reports alongside merchant-level spend.
- Bill approvals are not available. Ramp routes those through a separate approvals system and says MCP coverage is on the roadmap; approve bills in the Ramp UI.
- Receipts cannot be uploaded. MCP provides no standard file-upload path, so chat attachments do not reach Ramp.
- The directory's description text contradicts its own permissions label. It calls the connector read-only; the label says "Read and write" and the vendor documentation supports the label.
- The endpoint and documentation URL in the directory are both stale. Ramp's current docs give
https://mcp.ramp.com/mcp, and the listed documentation URL renders a JavaScript shell with no matching machine-readable guide. - No tool schemas or safety annotations were readable to us. The endpoint returns 401 to an anonymous handshake, so no
readOnlyHintordestructiveHintvalues were observed for any of the seventeen. Every capability statement here is Ramp's own. - Prompts are unconfirmed. Anthropic's snapshot lists no prompt names, and the gated endpoint blocked our own check.
- Ramp calls the surface unstable. Its documentation states Ramp MCP is subject to change and that new tools ship continuously, so any list — including this one — dates quickly.
Frequently asked questions
Can the Ramp MCP server actually spend money or change a card?
No. The permissions label is accurate and this connector acts on Ramp. Ramp documents approving or rejecting transactions, reimbursements and purchase orders, editing memos and accounting codes, locking and unlocking cards, posting comments, and generating single-use Agent Card credentials. Every write lands in the Ramp Audit Log. Bill approvals are the documented exception and are not yet available.
Does execute_query run real SQL against my Ramp data?
Yes. Ramp's open-source server documents an ETL pipeline plus an ephemeral in-memory SQLite database, and describes execute_query as running arbitrary SQL against it. The load tools populate tables first, so the model composes SQL over whatever was staged rather than calling one fixed endpoint per question. Results are capped at 100 rows per query.
Where is the queryable database that Ramp MCP loads my spend into?
Ramp does not say. Its hosted documentation calls it only a queryable workspace or queryable database and never states where it runs, how long tables persist, or whether they are encrypted at rest. The open-source self-hosted server documents an in-memory SQLite database, but that is a different deployment, so treat hosted staging as undocumented.
Can an AI agent make a real purchase through Ramp MCP?
Yes, through Agent Cards. Ramp documents generating a single-use PAN and CVV at purchase time, scoped to one merchant and capped at the requested amount, expiring after the first authorization or twelve hours. Card issuance is policy-controlled per business and blocked for fourteen merchant category codes including gambling, securities brokers and pharmacies.
Which Ramp role do you need, and can a cardholder see everyone's spend?
It inherits the signed-in user's Ramp role. Ramp states the assistant sees only data and actions that user could already perform, so employees see their own spend while admins see company-wide data. Most company-wide load tools need admin or business-owner permission. Admins can further restrict access by role, department or user.
Why do I only see a couple of Ramp tools in my AI client?
Ask your Ramp admin to check your role. Ramp documents this exact symptom as meaning the account lacks admin or business-owner permissions, which most company-wide transaction, bill, reimbursement and spend tools require. Access is also separately restrictable under Company, Integrations, Ramp MCP, Manage Access. Reconnecting alone will not add tools your role cannot reach.
What does the Ramp MCP "ETL operation limit reached" error mean?
Too many data tables are loaded into the queryable database at once. Ramp's documented fix is asking the assistant to clear unused tables, then retrying; persistent errors resolve within minutes as running operations finish. Ramp does not publish the actual table ceiling, so there is no documented number to plan a large spend export against.
Sources
- Ramp MCP developer guide — https://docs.ramp.com/developer-api/v1/ramp-mcp (fetched 2026-08-19 as machine-readable text at
/llms-guides/ramp-mcp.txt; the directory'sdocumentationURLdocs.ramp.com/developer-api/v1/guides/ramp-mcp-remotereturns a JavaScript shell with no matching guide file) · retrieved 2026-08-19 - Ramp AI Agents guide — https://docs.ramp.com/developer-api/v1/build-for-ai-agents (fetched 2026-08-19 via
/llms-guides/build-for-ai-agents.txt) · retrieved 2026-08-19 - Ramp Agent Cards guide — https://docs.ramp.com/developer-api/v1/agent-cards (fetched 2026-08-19 via
/llms-guides/agent-cards.txt; source of the single-use PAN/CVV terms and the blocked merchant category code table) · retrieved 2026-08-19 - Ramp MCP support article — https://support.ramp.com/hc/en-us/articles/45516494479891-Ramp-MCP (fetched 2026-08-19; source of the full capability reference, role gating and troubleshooting) · retrieved 2026-08-19
- Ramp MCP overview — https://docs.ramp.com/developer-api/v1/mcp (fetched 2026-08-19 via
/llms-guides/mcp.txt; states Ramp ships three MCP servers) · retrieved 2026-08-19 - Ramp Developer MCP guide — https://docs.ramp.com/developer-api/v1/developer-mcp (fetched 2026-08-19) · retrieved 2026-08-19
- Ramp rate limits and timeouts — https://docs.ramp.com/developer-api/v1/rate-limiting (fetched 2026-08-19; 200 requests per 10-second rolling window, 504 at 60 seconds) · retrieved 2026-08-19
ramp_mcpopen-source server README — https://github.com/ramp-public/ramp_mcp (fetched 2026-08-19; documents the ETL pipeline plus ephemeral in-memory SQLite database and arbitrary SQL viaexecute_query, for the self-hosted deployment) · retrieved 2026-08-19docs.ramp.com/robots.txtallows the whole site with an emptyDisallow, and carries noContent-Signaldirectives (fetched 2026-08-19).docs.ramp.com/llms.txtpublishes an explicit machine-readable index and instructs agents to read the/llms-guides/text files rather than the rendered HTML (fetched 2026-08-19) · retrieved 2026-08-19- Live RFC 9728 protected-resource descriptor — https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp (fetched 2026-08-19; 45 scopes, 24 read and 20 write. The root form also returns 200 with an identical scope list and a bare-host
resource; the path-insert form returns 404) · retrieved 2026-08-19 - Live RFC 8414 authorization-server metadata — https://ramp-mcp-remote.ramp.com/.well-known/oauth-authorization-server (fetched 2026-08-19; issuer is the MCP host, token endpoint is
https://api.ramp.com/developer/v1/token/pkce) · retrieved 2026-08-19 - Live anonymous probe — 2026-08-19: POST to the endpoint returns HTTP 401
{"detail":"No access token provided"}withwww-authenticate: Bearer resource_metadata="https://ramp-mcp-remote.ramp.com/.well-known/oauth-protected-resource/mcp". No authentication was attempted and no tool was called · retrieved 2026-08-19 - Ramp privacy policy — https://ramp.com/legal/privacy-policy · Support — developer-support@ramp.com
- Anthropic connector directory — https://claude.ai/directory/61bac03c-3f98-4b3c-affb-1b99533fa82c (snapshot 2026-08-16) · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Finance
- Developer
- Ramp
- Tools
- 17
- Domain
- ramp-mcp-remote.ramp.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.