MCP overview
Connect an AI client (Claude Code, Cursor, and others) directly to your Apploye organization's data using the Model Context Protocol (MCP), instead of calling the REST API yourself. The AI client calls MCP tools — one per read operation (list_timesheets, get_project, and so on) — and Apploye enforces the same per-organization scoping and auth as the REST API underneath.
See Connecting an AI client for setup steps once you have a key.
Streamable HTTP endpoint: https://mcp.apploye.com/mcp
MCP keys vs. your partner API key
An MCP key is a separate credential from your existing partner API key (the one you use for direct REST calls). Both live in the same underlying key store, but as distinct rows — creating, rotating, or revoking one never affects the other. An MCP key carries its own scopes, described below, which control exactly which data domains an AI client connected with that key can see.
Use your MCP key only with MCP clients, sent as the same X-APPLOYE-API-KEY header your partner key already uses — see Authentication guide for the header mechanics, which are identical for both key types.
Scopes
Every MCP key is granted one or more scopes. A client connected with a key only sees tools for the scopes that key was granted — everything else is hidden from the tool list entirely, not just rejected when called.
| Scope | Covers |
|---|---|
timesheets:read | Timesheets, idle time, live-tracking status, and each member's latest activity |
reports:read | Clock-in/out records, time-activity and manual-entry reports, activity trends, and hours/idle-time comparisons across projects and members |
apps_urls:read | App and URL usage reports (including org-wide top-usage) and suspicious-activity logs |
projects:read | Projects, tasks, project memberships, billable rates, and each client's project list |
payroll:read | Invoices, payment logs, payment settings, payables, and payroll summaries |
leaves:read | Leave applications, assignments, balances, periods, policies, and types |
screenshots:read | Screenshot records — opt-in only, see below |
organizations:read | Organization details, members, teams, and client records |
screenshots:read is unchecked by default when a key is created, unlike the other 7 scopes — screenshots are image data that can contain personal information, so exposing them to an AI client requires an explicit choice, not a default.
Read-only in v1
Every scope above is read-only. No MCP tool can create, update, or delete anything in your Apploye organization today — an AI client connected via MCP can only look up and summarize data, the same way it could by reading a report you generated yourself.