> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hr-easy.nlead.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting an AI assistant

> Let Claude read your own HR data — or, for HR staff, the data your role may see — through the HR Easy MCP connector.

HR Easy can act as a **remote MCP server** (Model Context Protocol), so an AI
assistant such as Claude can answer questions like "how many vacation days do I
have left?" or "which applications moved to interview this week?" against your
installation — under your own permissions, with every call recorded.

The connector is **off by default** per installation and, when on, only
available to people who sign in with the company Microsoft account (Entra
SSO). Magic-link sign-ins cannot connect an assistant.

## What the assistant can read

Everything the assistant sees passes through the same role and permission
checks as the web app, re-read on every call. Two scope families exist:

| Scope                | Who        | What                                                                                                         |
| -------------------- | ---------- | ------------------------------------------------------------------------------------------------------------ |
| `self:read`          | everyone   | Your own summary, leave balances and requests, time entries, sick leave, payslip periods, holidays, closures |
| `hr:read:people`     | HR, admins | People search, employee master data, positions, pending approvals, the HR overview                           |
| `hr:read:recruiting` | HR, admins | Applications and their stage                                                                                 |

Managers hold the HR scopes for their **direct reports only**.

Some things never cross the connector, whatever the role: AHV numbers, bank
details, withholding-tax data, dates of birth, private contact details, salary
amounts and bands, AI fit scores, private recruiting notes, e-mail bodies and
file names. Payslips are listed by period with a link to the portal; the
document itself opens only in your browser session. Text a person typed — a
leave reason, a cover letter, a note — is returned only when the assistant asks
for it explicitly, capped and marked as data for you to read.

The full tool list with schemas is in the
[MCP connector reference](/api-reference/mcp-connector).

## Connect Claude

1. In the Claude desktop or web app open **Settings → Connectors → Add custom
   connector** and enter your installation's connector URL:
   `https://<your HR Easy host>/api/mcp`.
2. Click **Connect**. Your browser opens HR Easy, asks you to sign in with
   your company Microsoft account again, and shows a consent screen naming
   the assistant (by its web address) and the scopes it requests.
3. Approve. Claude returns to the conversation; the connector is ready.

Ask Claude "who am I in HR Easy?" first — the `whoami` tool tells it which
tools your connection may use.

## Review and revoke

* **Portal → Connections** lists your connected assistants with the date of
  their last call and a **Revoke** button. Revoking takes effect on the
  assistant's next call.
* The same page shows **assistant accesses**: which assistant read your record,
  when, and on whose behalf — your own connection or an HR colleague's.
* Connections expire on their own after 30 days without use (8 hours for
  privileged roles) and after 90 days at the latest. Leaving the company
  ends every connection.

## For administrators

**Settings → Connected assistants** holds the installation policy:

* whether assistants may register themselves (off by default), and which
  vendors are approved automatically (Claude by default);
* a **pause** switch that refuses every assistant at once without deleting
  connections;
* the daily allowance of person records one connection may read (default
  1 000); a connection that reads 50 or more different people in a day is
  flagged in the audit log as an export;
* every registered application and every connection, each with a revoke
  action.

Before switching the connector on, check the controller duties listed in the
[data-protection guide](/swiss/data-protection): a data-processing agreement
with the assistant vendor, the entry in the processing register, and informing
staff about the new processing.