WorkRight MCP Server — Query Your HR Data from AI Assistants

The Model Context Protocol (MCP) is an open standard for connecting AI assistants to external tools and data. The WorkRight MCP server exposes a single tenant's HR data as MCP tools and resources, so an assistant like Claude or Cursor can answer questions about your people, leave, expenses, payroll, books and compliance directly from live data — no copy-pasting, no exports.

It is hosted: your client connects to https://api.workright.in/mcp over Streamable HTTP, the standard MCP transport for remote servers, and authenticates with the same per-workspace API token used by the WorkRight REST API. There is nothing to install or run. MCP access is part of WorkRight Pro.

The server has 114 tools. 87 only read; 27 make everyday, reversible changes — apply for leave or WFH, submit an expense or a timesheet, record an attendance punch, raise a helpdesk ticket, update goals, or create drafts such as an invoice, bill, candidate or offer. Write tools need a token with write access, and every write is audited.

By design, the most dangerous actions are never exposed to an AI client: locking a payroll run or accounting period, computing a full-and-final settlement, closing an offboarding cycle, and reading POSH complaints all stay in the dashboard behind interactive step-up authentication.

The MCP server exposes a large, capability-gated tool set. See the complete, filterable list — grouped by module, with the required capability and a read/write badge on every tool — in the MCP Tool Catalog. New to it? The quickstart walks through creating a token and the client config.

• People — the employee directory, onboarding, HR documents and the asset register, plus an employee://{id} resource (non-PII profile fields only).
• Leave, WFH and attendance — leave requests, balances, holidays, attendance, shifts and timesheets.
• Expenses and travel — claims, categories, reimbursement batches and travel pre-approvals.
• Payroll — locked payroll runs, payslips, statutory filings, TDS challans and loans. Salary data needs a token created with the explicit payroll permission.
• Accounting — invoices, bills, payments, receipts, contacts, items, journals and period locks.
• Hiring and performance — requisitions, candidates, offers, interviews, referrals, goals, reviews and feedback.
• POSH compliance — training progress, certificates, policies and annual reports, plus a policy://posh resource. POSH complaints are never exposed.

A token only sees the tools its permissions and its owner's role allow, and only for modules switched on in your workspace.

On WorkRight Pro, create a token at Settings → API tokens in the dashboard, then add the server to your client. In Claude Code:

claude mcp add --transport http workright https://api.workright.in/mcp \
  --header "Authorization: Bearer wr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

In Cursor (.cursor/mcp.json) and other clients that take a remote server as a URL with headers:

{
  "mcpServers": {
    "workright": {
      "url": "https://api.workright.in/mcp",
      "headers": {
        "Authorization": "Bearer wr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
    }
  }
}

Every request is checked against your token, workspace and role, so you can ask questions like “which employees haven't finished POSH training?” or “show me the latest locked payroll run” and the assistant calls the matching tool. Adding WorkRight as a connector in Claude Desktop or Claude.ai is coming — it needs a sign-in flow that isn't available yet. WorkRight never asks for a database address or password.

Each token is bound to one (workspace, user) pair, so an assistant can never reach another company's data. The endpoint accepts only the bearer token — never a browser session — keeps no session state, and is rate-limited per token. Statutory write-once data stays immutable, and revoking the token in the dashboard cuts off access on the next request. See the REST API for the same data over HTTP, or the plans.