How do I connect Claude or ChatGPT to ASHR.work?

What you can ask

Once connected, the assistant answers from your live workspace, not from a copy. Reading:

• Leave — your balance, your requests and their status, holidays, and who is out this week or on a given day.
• People — the directory, a colleague's role, manager and team, the org chart.
• Documents — your generated letters and the templates your workspace has.
• Recruiting, helpdesk, assets, feed — open roles and candidates, your tickets, the asset register and announcements, where your role can see them.

And acting, within your role:

• Apply for leave, or cancel a request you made.
• Approve or reject a leave request, if you are the approver.
• Add a candidate to an open role, or move one along, if you recruit.
• Generate a letter from a template, if your role can.

Some things are never available to a connected assistant, whatever it asks for: running payroll, grievances and data-subject requests, platform administration, stored credentials and billing. Those are not settings you could switch on by mistake — they are absent from the connected surface.

Connect from Claude (claude.ai)

1. Open Connectors

   In Claude, open Settings → Connectors and choose Add custom connector.

2. Enter the URL

   Server URL: https://www.ashr.work/api/mcp — no trailing slash. Leave authentication on OAuth and let Claude register a client automatically; add no custom headers.

3. Sign in

   Claude opens the ASHR.work consent screen. Sign in as yourself — the same email and password (or SSO) you use for ASHR.work.

4. Choose a workspace

   If you belong to more than one workspace, pick the one the assistant may reach. It is fixed for this connection.

5. Allow

   Review the permission groups, each marked read only or can change, and choose Allow. You are sent back to Claude, and the ASHR.work tools appear in the conversation.

Adding a custom connector needs a Claude plan that allows it (Pro, Max, Team or Enterprise at the time of writing; on Team and Enterprise an organisation admin may have to enable custom connectors first). ASHR.work charges nothing extra.

Claude Desktop

Claude Desktop shares connectors with claude.ai: a connector you add in Settings → Connectors on either one appears in both. Follow the steps above, then enable the ASHR.work connector in the chat's tools menu.

If you prefer a local configuration file instead, see For developers below — the stdio bridge is a one-line entry in claude_desktop_config.json.

Claude Code

From a terminal:

claude mcp add --transport http ashr https://www.ashr.work/api/mcp

Then, in a Claude Code session, run /mcp and choose ashr to sign in. The same consent screen opens in your browser; allow it and the tools are available in that project. To use the connection in every project, add --scope user.

ChatGPT

1. Open Connectors

   In ChatGPT, open Settings → Connectors (on some plans it is under Apps, and you may need to turn on developer mode first).

2. Add the connector

   Choose Create or Add, and enter https://www.ashr.work/api/mcp as the MCP server URL. Choose OAuth when asked how to sign in.

3. Sign in and allow

   The same ASHR.work consent screen opens: sign in, choose your workspace, allow the permissions.

ChatGPT verifies that the domain belongs to the company behind the connector. That verification is done once, by ASHR.work, not by you — if a verification step appears in your organisation's ChatGPT settings, it is asking for something we have already provided, and you can continue.

What the assistant can see

Exactly the permission groups you allowed on the consent screen, in the one workspace you picked, and nothing else. The groups are:

| Group | What it covers | Can change? | |---|---|---| | Your profile & directory | Colleagues, org chart, employee records | Yes, where your role can | | Leave | Balances, holidays, requests; apply, cancel, approve | Yes, where your role can | | Attendance | Attendance records and punches | Read only | | Pay & payslips | Salary structures, payslips, payout ledgers | Read only — nothing can be run or paid | | Documents | Templates and generated documents; generate letters | Yes, where your role can | | Performance & growth | Reviews, check-ins, talent, growth plans, surveys | Read only | | Recruiting | Jobs and candidates; draft openings, add or move candidates | Yes, where your role can — publishing stays in the app | | Offboarding | Exit cases and their tasks | Read only | | Assets & announcements | The asset register and the company feed | Read only | | Helpdesk | Your tickets; raise a ticket | Yes |

"Can change" means the assistant may be granted that; whether an action succeeds is still decided by your own role in the workspace, exactly as it would be on screen. Tools your role cannot use are not shown to the assistant at all.

Every request the assistant makes is recorded in your workspace's audit log under your name, whether it succeeded or was refused.

Disconnecting

Go to Settings → Connected assistants. Each entry names the assistant, the workspace it reaches, the permissions you allowed and when it was last active. Choose Disconnect — every token the assistant holds is revoked at that moment, and its next request is refused. It can only come back by sending you through the consent screen again.

An HR admin sees every assistant connected to the workspace, with the name of the person who connected it, and can disconnect any of them. They cannot see your conversations. See Which AI assistants are connected to my account?.

For developers

The connector is a standard MCP server over Streamable HTTP, guarded by OAuth 2.1 (authorization code + PKCE, dynamic client registration, RFC 8414 and RFC 9728 discovery). Anything that speaks MCP can use it.

API keys still work. The same endpoint accepts an API key or a client-credentials token as Authorization: Bearer dmk_… — see API keys and OAuth2. A key belongs to a workspace rather than a person, so write tools called with a key name the acting employee with actor_employee_id; a connection you allowed as yourself never needs it.

The stdio bridges. For clients that only speak stdio, mcp/ashr-mcp.mjs (read) and mcp/ashr-write-mcp.mjs (write) in the public repository forward every message to the HTTP endpoint unchanged. Configure them with ASHR_MCP_URL (defaults to the URL above) and ASHR_API_KEY or ASHR_ACCESS_TOKEN. Claude Desktop, for example:

{
  "mcpServers": {
    "ashr": {
      "command": "node",
      "args": ["mcp/ashr-mcp.mjs"],
      "env": { "ASHR_API_KEY": "dmk_live_…" }
    }
  }
}

The discovery documents live at https://www.ashr.work/.well-known/oauth-authorization-server and https://www.ashr.work/.well-known/oauth-protected-resource; an unauthenticated request to the endpoint answers 401 with a WWW-Authenticate header that points at them, so a client can find its way in without reading this page.

Troubleshooting

• The assistant says it is not authorised (401) — the connection was disconnected, expired, or you changed your password. Remove the connector in the assistant and add it again; you will go through the consent screen once more.
• "Unknown tool" or a tool you expected is missing — tools outside your role or outside the permissions you allowed are not shown. Check your role in the workspace, and reconnect if you denied a group you now want.
• "Your workspace is read-only" or a billing message — the workspace's subscription has lapsed. Reads continue through the grace period; writes are refused until an admin reactivates the plan in Admin → Plan & Billing.
• It answers about the wrong workspace — you allowed a different one. Disconnect and connect again, choosing the right workspace. A connection cannot be talked into switching.
• The assistant cannot reach ASHR.work — check the URL is exactly https://www.ashr.work/api/mcp, with www and no trailing slash. The bare ashr.work domain redirects, and some clients do not follow a redirect on the first request.
• Claude says the client is unknown — the connector was added with a hosted client id. Remove it and add it again letting Claude register a client automatically.