Developer Docs

Time Tracking MCP Server

Connect AI assistants to your workspace with the Model Context Protocol. The same service layer that powers the REST, WebSocket, and GraphQL APIs is exposed as ~150 MCP tools across 21 domains for time tracking, tasks, invoicing, and reports.

Time Tracking MCP Server

Overview

TRCR exposes a Model Context Protocol (MCP) server so that AI assistants — such as Claude Desktop, Claude Code, OpenAI Codex, and ChatGPT — can act directly in a workspace. Through the MCP interface an assistant can track time, manage tasks, projects, and clients, create and send invoices, generate reports, and more, using roughly 150 tools across 21 domains.

The MCP server reuses the same service layer as the REST, WebSocket, and GraphQL APIs. Business logic, validation, and permissions are identical regardless of interface, and every action an assistant performs publishes the same realtime events — so changes appear instantly to other users across the web app and connected devices.

Same logic everywhere: An MCP tool call is just another caller of the shared service layer. A task created by an assistant is indistinguishable from one created in the web app, and shows up live for the whole team.

A time tracking MCP server

As far as we know, TRCR is the only time tracker with a first-class MCP server — a complete time tracking MCP server where an assistant can start and stop timers, log and edit time entries, and turn tracked hours into invoices and reports, all over one protocol and inside your permissions. The tool catalog below spans ~150 tools across 21 domains.

New here? Start with the product overview on AI time tracking, or browse the rest of the developer docs for the REST, WebSocket, and GraphQL interfaces.

Endpoint

The server speaks MCP over Streamable HTTP. Point your client at:

https://api.trcr.pro/mcp

Authentication

The MCP server accepts two kinds of credential — pick whichever fits how the client connects:

OAuth 2.1 — the standard remote-MCP connect flow. Best for AI assistants you connect interactively (Claude.ai, Claude Desktop, Claude Code, ChatGPT, the MCP Inspector). You never paste a token: the client discovers the flow, a browser opens to sign you in, you choose which organization (or organizations) to grant access to, and approve.
Personal Access Token (PAT) — a static bearer token you paste into a header. Best for scripts, CI, and headless or server-side use where no browser is available.

Both resolve to an org-scoped identity: an assistant can only do what the granting user could do, and only in the organization (PAT) or organizations (OAuth) the credential is scoped to. The MCP interface adds no permissions of its own.

OAuth 2.1 — connect with sign-in

TRCR is a full OAuth 2.1 Authorization Server for the MCP endpoint, implementing the connect flow that Claude and other MCP hosts expect. Adding the server is usually just “paste the URL and sign in.” Point any OAuth-capable client at the endpoint:

https://api.trcr.pro/mcp

The client then runs the standard flow automatically:

The first unauthenticated request receives a 401 with a WWW-Authenticate header pointing at the server's protected-resource metadata, so the client discovers where to authenticate.
The client reads the discovery documents at /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server, then registers itself via Dynamic Client Registration (RFC 7591) — there is no pre-provisioned client ID or secret to set up.
A browser opens to sign you in to TRCR (or reuses your existing session). You then choose which organization (or organizations) to grant access to and approve the request.
The client exchanges the authorization code (protected by PKCE) for an access token and refresh token and is connected — the TRCR tools appear automatically.

Now available: Native OAuth connect for Claude.ai, Claude Desktop, Claude Code, ChatGPT, and the MCP Inspector is live. A Personal Access Token is no longer required for clients that support the remote-MCP OAuth flow.

Organization scope & consent

A single OAuth connection can be scoped to one or more organizations — the ones you select on the consent screen. The consent screen shows the requesting application's name and an organization picker; approving grants that application the mcp scope for every organization you select (you must be a current member of each). The connection then acts across that org set.

When a connection is authorized for more than one organization, org-scoped tools take an org_id argument to choose which organization to act in — you can omit it only when the connection is scoped to a single organization. Call the whoami tool at any time to list the authenticated user and the organizations the connection can act in. To change which organizations a connection covers, reconnect and select a different set on the consent screen.

Tokens and lifetimes

Access tokens are short-lived (15 minutes), audience-bound to https://api.trcr.pro/mcp, and carry the mcp scope and your chosen organization set. Refresh tokens are longer-lived (7 days) and rotated on every use (with reuse detection), so the client keeps the connection alive without prompting you again. The client manages all of this — there are no tokens to copy by hand.

Authorization server endpoints

OAuth-capable clients discover these automatically; they are listed here for reference and for building a custom client. The issuer is https://api.trcr.pro, and PKCE with S256 is required.

Endpoint	Purpose
/.well-known/oauth-protected-resource	Protected Resource Metadata (RFC 9728) — names the MCP resource and its authorization server. The resource-specific variant `/.well-known/oauth-protected-resource/mcp` is also served.
/.well-known/oauth-authorization-server	Authorization Server Metadata (RFC 8414) — issuer, endpoints, supported grants (`authorization_code`, `refresh_token`), response types (`code`), PKCE methods (`S256`), token-endpoint auth methods (`none`, `client_secret_post`), and scopes (`mcp`).
/oauth/register	Dynamic Client Registration (RFC 7591) — clients self-register and receive a `client_id`.
/oauth/authorize	Authorization endpoint — starts the login and organization-consent flow (`response_type=code`).
/oauth/token	Token endpoint — exchanges the authorization code and refreshes tokens (grant types `authorization_code` and `refresh_token`).

Personal Access Token

For scripts, CI, and any client where you supply the header yourself, use a Personal Access Token. Create one in the app under Settings → Personal Access Tokens. The plaintext token (prefixed trcr_pat_) is shown only once at creation time — copy it immediately and store it securely.

Each token is bound to a single organization. If you work across multiple organizations, create one token per organization and connect a separate MCP server entry for each.

Send the token as a Bearer credential in the Authorization header on every request:

Authorization: Bearer trcr_pat_xxxxxxxxxxxxxxxx

Connecting with OAuth

Give the client the server URL and let it run the flow. When prompted, sign in to TRCR and pick the organization (or organizations) to grant access to.

Claude.ai & Claude Desktop

Open Settings → Connectors → Add custom connector, give it a name, and paste the URL:

https://api.trcr.pro/mcp

Claude opens a browser to sign you in and choose one or more organizations. Once approved, the TRCR tools appear in the connector.

Claude Code

Add the server over HTTP without a header, then authenticate from inside Claude Code:

claude mcp add trcr --transport http https://api.trcr.pro/mcp

Run /mcp in Claude Code and choose to authenticate — a browser opens for sign-in and organization consent.

ChatGPT

Add TRCR as a custom connector / MCP server using only the URL. ChatGPT runs the OAuth flow the first time it connects:

https://api.trcr.pro/mcp

MCP Inspector

Handy for testing the connection end-to-end. Launch the Inspector, enter https://api.trcr.pro/mcp as a Streamable HTTP server, and start the OAuth flow from its UI:

npx @modelcontextprotocol/inspector

Connecting with a Personal Access Token

Replace trcr_pat_… with your token in each example below. This path suits CI, cron jobs, and headless servers.

Claude Code

claude mcp add trcr \
  --transport http https://api.trcr.pro/mcp \
  --header "Authorization: Bearer trcr_pat_…"

OpenAI Codex

Add the server to your Codex MCP configuration as an HTTP transport with the Authorization header:

[mcp_servers.trcr]
url = "https://api.trcr.pro/mcp"

[mcp_servers.trcr.headers]
Authorization = "Bearer trcr_pat_…"

Claude Desktop

Claude Desktop can also connect through the mcp-remote bridge with a token header — useful for pinning a specific organization. Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "trcr": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://api.trcr.pro/mcp",
        "--header",
        "Authorization: Bearer trcr_pat_…"
      ]
    }
  }
}

Restart Claude Desktop after saving. The TRCR tools appear in the tools menu once the connection is established.

ChatGPT

If you prefer a static token, add TRCR as a custom connector and supply the Authorization header with your PAT:

URL:    https://api.trcr.pro/mcp
Header: Authorization: Bearer trcr_pat_…

Tool Catalog

Tools are grouped into 21 domains. Tool names follow a domain_verb convention — for example tasks_create and tasks_update (both accept an optional start_date alongside due_date), tasks_dependencies_list_all (no arguments — lists every dependency edge in the token's organization), time_start_timer, and invoices_send. Use the whoami tool at any time to confirm which user and organization the active token is operating as.

Domain	Covers
tasks	Create, update (including start_date and due_date), assign, comment on, and delete tasks; checklists, dependencies, labels, status, and reordering. tasks_dependencies_list_all returns every dependency edge in the token's organization in one call.
projects	Manage projects, members, statistics, and archival.
task_groups	Board columns and sections — create, rename, reorder, and delete groups.
task_statuses	Custom workflow statuses with terminal flags, progress, and auto-advance transitions.
task_recurrences	Recurring task rules and their generated occurrences.
labels	Organization labels used to tag and filter tasks.
milestones	Standalone date markers on a Space's Gantt chart. milestones_list (project_id) lists a Space's milestones; milestones_create (project_id, title, target_date, color?, description?), milestones_update (milestone_id, title?, target_date?, color?, description?, clear_description?), and milestones_delete (milestone_id) manage them. Reads require access to the Space; create, update, and delete require manage_tasks.
time	Start, stop, and adjust timers; create, edit, and list time entries.
clients	Clients plus their contacts and activity history.
invoices	Invoices and line items; send invoices and mark them paid.
payments	Record and reconcile payments against invoices.
reports	Timesheet, revenue, utilization, and profitability reporting.
members	Organization membership, roles, and invitations.
orgs	Organization details and settings.
users	User profiles and preferences. users_update_profile updates full_name, timezone, and locale — the preferred language as a BCP-47 code (en, es, fr, pt, de, uk, it, pl, nl, ja); an empty string clears the preference back to null (browser detection).
notifications	List, read, and dismiss in-app notifications.
audit	Read the organization audit log.
chat	Team chat channels and messages.
search	Full-text search across tasks, projects, clients, and more.
git	Git integration — linked repositories, branches, and commits.
public_forms	Public intake forms and their submissions.
attachments	File attachments on tasks and other entities.

Safety

Destructive tools — those that delete, remove, or revoke data — carry the MCP destructiveHint annotation. MCP hosts use this hint to prompt the user for confirmation before the action runs, so an assistant cannot silently delete a project or revoke access.

Every tool call is authorized against the user's role and permissions in the token's organization. The MCP interface grants no additional access — an assistant can only do what the token's owner could do in the web app.