WorkTracker › Features › Agent access (MCP)

Your AI agent can use WorkTracker too

A built-in MCP server lets Claude, ChatGPT, Gemini and any other MCP-capable agent read your timeline, check your tracked time and manage your todos — with a personal, revocable token.

One endpoint, any agent

WorkTracker speaks the Model Context Protocol — the open standard AI assistants use to reach external tools — over plain HTTP. Create a token under Profile → Agent access, point your agent at the endpoint, and it can answer questions like “what did I work on Tuesday?”, “how much time did I track on ACME this month?” or “add a todo to follow up the review”.

Endpoint:       https://time.itcm.se/api/mcp
Authentication: Authorization: Bearer <your token>

What your agent can do — and what it cannot

• Read any day: every collected event with source, project, duration and its AI summary.
• Summarize tracked time per project for a day or a date range.
• See the company project vocabulary (projects with their clients).
• List, add and complete todos on your todo list.
• It cannot create or edit tracked time, push to Toggl, or see items you hid — the write surface is deliberately todos-only, so no agent can fabricate billable hours.

Connect Claude

In Claude Code, add WorkTracker as an HTTP MCP server with your token as a header:

claude mcp add --transport http worktracker \
  https://time.itcm.se/api/mcp \
  --header "Authorization: Bearer wtk_…"

Connect ChatGPT

In ChatGPT enable developer mode under Settings → Connectors, then add a connector with the endpoint URL and your token as the Authorization header. ChatGPT discovers the tools automatically.

Connect Gemini

For the Gemini CLI, add the server to ~/.gemini/settings.json:

{
  "mcpServers": {
    "worktracker": {
      "httpUrl": "https://time.itcm.se/api/mcp",
      "headers": { "Authorization": "Bearer wtk_…" }
    }
  }
}

Connect anything else

Any client that implements MCP over the streamable HTTP transport works the same way: POST JSON-RPC to the endpoint with your bearer token. No SDK, no webhook setup, no OAuth dance — one URL and one header.

Secure by construction

• Tokens are personal: an agent sees exactly what its owner sees, never other members’ data.
• Only a hash of the token is stored, and every token is revocable with one click under Profile → Agent access.
• Hidden items never reach an agent, and privacy-filtered content was already removed before any agent could ask — the same guarantees as at /privacy.