Skip to content
/
Introduction
Last updated

MCP Connector

The WebWork MCP connector lets AI assistants work with your WebWork data in natural language. It is a standard Model Context Protocol server, so it works with any MCP-compatible client — Claude, Cursor, VS Code, and others — using the same connection.

  • Connector URL: https://mcp.webwork-tracker.com/mcp
  • Authentication: OAuth 2.1 + PKCE, using the same authorization server as the REST API.
  • Built on: the REST API V2 — every tool runs as the signed-in user, with the same permissions and rules.

What you can do

Ask in plain language and the assistant calls the right tools. For example:

  • Projects and tasks — "List my projects", "What are the open tasks in the Mobile App project?", "Create a task and assign it to Maria."
  • Time — "What is Alex tracking right now?", "Start the timer for Alex", "Add 2 hours to yesterday."
  • Approvals — "Show pending timesheets", "Approve this week's timesheets", "Reject this leave request with a reason."
  • Reports — "Tracked-hours report for last week", "Activity report for June 1–15", "Who was late yesterday?"
  • People — "List members", "Invite jordan@example.com as a Regular User."

The connector exposes 66 tools across workspaces, projects, tasks, members, contracts, time tracking, timesheets, time requests, leaves, expenses, time entries, project viewers, and reports.

Requirements

  • A WebWork account that is a workspace Owner or Executive Manager.
  • A verified email address.

The connector never exceeds your role; a tool you are not permitted to use returns a permission error.

How it works

The connector is a thin proxy in front of the REST API V2. When you ask your assistant to do something:

  1. It calls the matching MCP tool with your OAuth token.
  2. The connector forwards the request to the REST API V2 as you.
  3. The result is returned to your assistant, which answers you.

It stores no separate copy of your data. See the Privacy Policy for details.

Permissions and safety

  • You grant read, write, and/or admin access during sign-in, and your AI client lets you approve tools individually.
  • Destructive actions (delete and archive) require an explicit confirmation.
  • Some actions send real emails (member and project-viewer invitations, leave approvals) — the assistant tells you first.
  • You can disconnect at any time to revoke access.

Ready to connect? See the Quickstart.

Delete Custom Field

Quickstart