Connecting the MetronHR MCP server to an AI assistant

MetronHR ships an MCP server. An assistant only needs the address app.metronhr.de/mcp, signs in through the browser and can then read hours, absences, projects and shifts. Whether that is allowed, who may connect and whether writing is permitted are decided beforehand by the business, in three separate steps.

As of:15. September 2026

The address and the revision

The server is stateless and speaks revision2026-07-28 of the Model Context Protocol, plus the two revisions before it, because the clients in common use today open with the older handshake. A client that knows both notices nothing of the difference.

  • MCP endpoint

    Address
    https://app.metronhr.de/mcp

  • Resource metadata

    Address
    app.metronhr.de/.well-known/oauth-protected-resource, to RFC 9728

  • Authorisation server

    Address
    app.metronhr.de/.well-known/oauth-authorization-server, to RFC 8414

  • Self-registration

    Address
    app.metronhr.de/oauth/register, to RFC 7591. The client finds it through the metadata, nobody has to type it in.

As of 15. September 2026. The transport is Streamable HTTP, that is a POST to the endpoint. SSE is not served; the specification withdrew that transport in 2025.

Setting it up per assistant

The same address, three different places it belongs in.

MetronHR in ChatGPT

The assistant many businesses already use. Its own connector, sign-in through OAuth.

See the setup

MetronHR in Microsoft Copilot

For businesses on Microsoft 365. An agent in Copilot Studio, plus GitHub Copilot in VS Code.

See the setup

MetronHR in Claude

Claude Desktop for reporting at the desk, Claude Code for the integration.

See the setup

What an assistant can see and do

32 reading and13 writing tools, plus3 reference lists and2 ready-made reports. They cover the same16 resources as the REST API, and what can be changed is the same5.

  • Time entries

    Read
    yes, with a filter on period and person
    Change
    yes, create, change, delete

  • Absences

    Read
    yes, type and period
    Change
    yes, request and decide

  • Clients, services, projects

    Read
    yes
    Change
    yes

  • People and departments

    Read
    yes, personal data without pay and without health information
    Change
    no

  • Contracts, holiday accounts, working time models

    Read
    yes
    Change
    no

  • Shifts, areas, definitions

    Read
    published ones only
    Change
    no

  • Public holidays, allowances, service records

    Read
    yes
    Change
    no

As of 15. September 2026. A tool without a right is not in the list the assistant receives. What is binding is the app's OpenAPI document, not this overview.

Three decisions before the first assistant connects

They sit in the company settings under Integrations and are deliberately separate. Withdrawing one withdraws it at once: a running connection loses the right with its next request.

  • AI connections

    What it decides
    Whether an assistant may connect at all.
    Default
    aus

  • Roles allowed to connect

    What it decides
    Who may. Empty means nobody, even with the switch on.
    Default
    leer

  • Writing

    What it decides
    Whether an assistant may change things too, with its own list of roles.
    Default
    aus

As of 15. September 2026. Every tool call is in the business's log, with the tool and the client, but without the content of the answer. A connection can be disconnected on its own.

Where the server deliberately stops

  • No way around the rights. A tool without a right does not appear in the list, and the call then passes the same check a second time.
  • No data under Art. 9 GDPR. Neither health information nor the reason for a sick note leaves the product.
  • No creating of people. A person comes about through an invitation, not through a tool call.
  • No planning of shifts. A shift has to hold up against the working time model, the rest period and availability, and that is the planner's answer.

Signing in runs through OAuth 2.1 with PKCE. An access token is valid for one hour, the refresh token for 30 days and is exchanged on every use. Disconnecting makes both invalid at once. The technical framing is set out on the page about the REST API, webhooks and MCP.

Questions about the MCP server

What we are asked most often about it.

A fixed address an AI assistant can ask at, instead of having to guess. The Model Context Protocol is the shared standard for it; MetronHR speaks revision 2026-07-28 and the two older ones as well, because that is how the clients in common use open.

No. The server runs at our end, and the client only needs the address app.metronhr.de/mcp. There is no client ID and no secret to type in: the client registers itself and then runs the sign-in flow in the browser.

No. It sees what its access allows, and the rights hang per resource on "read" or "read and change". Bank details, date of birth, social insurance number and any disability status go through no interface at all. For absences the type goes along, not the note.

Writing is a separate release with its own list of roles, and without it an assistant can only read. A write call takes the same route as an entry in the product, so through the same rules: lock periods, collision checks, holiday balance. Every call is in the business's log.

Whoever management decides. AI connections are off out of the box. Whoever switches them on also says which roles may connect; an empty list means nobody, even with the switch on. Each person connects with their own rights, not with the business's.

Nothing extra. It belongs to the Professional plan, like the REST API and the webhooks, at no extra charge and with no minimum number of licences. It is not included in the Team plan.

The assistant fetches what the person asks for and processes the answer at its own provider. That is the decision that comes before the connection, and it belongs in the data processing agreement with that provider. MetronHR itself hosts in Germany and passes nothing on of its own accord.

Question not answered here? Every step is explained in the help centre.

Connect your assistant to your own figures

The release sits in the company settings, and the address is app.metronhr.de/mcp.

See the prices

No credit card, cancel any time

Related

Where to go from here, and what waits for you there.