Connect AI agents

Every Resourcecloud instance serves its own MCP endpoint at /mcp. One line and one URL - no source code, no Node, no binary.

Overview

The endpoint speaks the Model Context Protocol over streamable HTTP (stateless, no event stream). An agent signs in with your user name and an API token and acts as you: it sees exactly what you see and may do exactly what you may do. A tool call runs the same code as the REST API, so there is no second set of rules.

Not hosted: dispatching a task to a local coding-agent harness needs your local repository and stays in the Node server of mcp-server/.

1. Create a token

  1. Open your Profile and go to API Keys.
  2. Click Add new API token, give it a description (for example My AI agent).
  3. Choose the access. Read only is the default and is right for most agents: they can look up tasks, time, leave, capacity, incidents and files, and change nothing. Choose Read and write only when the agent should book time, create tasks or comments, and so on.
  4. Copy the token. It is shown once.

An agent reads text that other people wrote (task descriptions, comments, incident reports). Such text can contain instructions aimed at the agent. A read-only token makes sure that no such instruction can change anything.

2a. Command-line client

claude mcp add --transport http resourcecloud https://YOUR-INSTANCE/mcp \
  --header "Authorization: Basic $(printf 'USERNAME:TOKEN' | base64)"

Check with claude mcp list, or ask: "Which of my tasks are due this week?"

2b. Desktop apps and other clients

Clients that only speak stdio can use the mcp-remote bridge (needs Node on that computer):

{
  "mcpServers": {
    "resourcecloud": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://YOUR-INSTANCE/mcp",
               "--header", "Authorization: Basic BASE64_OF_USERNAME:TOKEN"]
    }
  }
}

Any client with a field for HTTP headers works the same way: URL https://YOUR-INSTANCE/mcp, header Authorization: Basic base64(username:token).

How tasks are written

A task's Description is only a short subheader of its name. The full brief - objective, hints, plan - is the task's first comment. Later comments may add details. The endpoint tells the agent so when it connects: to implement a task it reads all comments, and when it creates a task it keeps the Description short and writes the brief as the first comment. Comments are HTML, not Markdown (for example <h4>, <ul>, <p>).

Tools

AreaTools
Tasks, projects, stories, commentslist_tasks, get_task, create_task, update_task, delete_task, and the same for projects, stories, comments, services, solutions
Teams, users, customerslist_teams, get_team, list_team_members, list_users, get_user, list_customers, ...
Timelist_time_entries, book_time, update_time_entry, delete_time_entry, get_timer, start_timer, stop_timer
Leavelist_leave, request_leave, submit_leave, cancel_leave, withdraw_leave, list_absences
Capacityget_capacity, list_reservations, create_reservation, ...
Incidentslist_incidents, get_incident, get_incident_sla, raise_incident, list_sla_violations, list_problems
Meetings, fileslist_meetings, get_meeting_minutes, list_files, get_file, list_file_versions
Planninglist_story_tasks, list_story_blockers, set_story_blockers, add_task_to_story, remove_task_from_story (a milestone is a story with team 0 and a date), list_task_dependencies, add_task_dependency, remove_task_dependency, list_subtasks, create_subtask
Custom fields, project templateslist_custom_fields, create_custom_field, ... (see the custom fields guide); list_project_templates, get_project_template, save_project_as_template, update_project_template, delete_project_template, and create_project with template_id (see the project templates guide)
Webhooks (read only)list_webhook_events, list_webhooks, list_webhook_deliveries (see the webhooks guide); creating a webhook and its secret stays in the web UI and the REST API
Agilelist_sprints, plan_sprint, list_sprint_tasks, list_epics, list_releases, ...

A read-only token is offered the read tools only. The tools correspond one to one to the routes in api/openapi.yaml.

Security

Limits