AI Assistants (MCP)

EOS Hub has an MCP server, so AI assistants such as Claude, ChatGPT or Claude Code can work with your EOS data. You can ask "What are my open to-dos and how did our Scorecard do this week?", or "Add an issue about the delayed release to the Leadership Team", and the assistant answers from EOS Hub or makes the change for you.

MCP (Model Context Protocol) is the open standard AI assistants use to connect to other applications.

INFO

An assistant works with your rights, never more. It sees and changes exactly what you can see and change in the web app, and only in organizations that allow AI assistants. A Read only connection cannot change anything.

Before You Start: the Organization Must Allow It

AI assistants are off in every organization until an Owner or Admin allows them:

1. Open Organization settings > General.
2. Turn on Allow AI assistants (MCP) and confirm.

While it is off, assistants don't see the organization at all; your other organizations are not affected. Switching it off takes effect immediately and keeps everyone's connections, so switching it back on restores access.

The platform operator can also switch MCP off for the whole platform (Platform > MCP), for example during an incident.

Connecting an Assistant

Open Settings > AI assistants (MCP) and copy the Server URL. It is your EOS Hub address followed by /mcp, for example https://eoshub.pixon.eu/mcp.

Claude (claude.ai and Claude Desktop)

1. In Claude open Settings > Connectors and choose Add custom connector.
2. Enter a name (for example EOS Hub) and paste the server URL.
3. Click Connect. A window with EOS Hub opens.
4. Sign in to EOS Hub, with Google or your password, unless you are signed in already.
5. Review the request and click Allow (see The Consent Screen).

The window closes and Claude can use EOS Hub. On a Team or Enterprise plan, an owner of the Claude organization may have to add the connector first.

ChatGPT

1. In ChatGPT open Settings > Apps & Connectors > Advanced settings and turn on Developer mode.
2. Create a connector with the server URL and OAuth authentication.
3. Sign in to EOS Hub and click Allow.

Claude Code

Run:

claude mcp add --transport http eos-hub https://eoshub.pixon.eu/mcp

Then type /mcp in Claude Code, choose eos-hub and sign in to EOS Hub in the browser window that opens.

Other Tools and Scripts (API Key)

Tools that can't sign in through a browser can use an API key instead. They send it in the Authorization: Bearer ak_… header to the server URL. The key's access (read only or read & write) applies, as on the REST API.

The Consent Screen

When an assistant connects, EOS Hub shows what it is asking for:

• The app's name and where you will return, for example claude.ai. The app chooses its own name, so check the address: if you didn't start the connection yourself, click Deny.
• Access:
  • Read only: the assistant can read to-dos, issues, Rocks, Scorecards, meetings and the V/TO.
  • Read and change: it can also create and update to-dos, issues, Rocks, Scorecard values and meeting notes.
• Platform administration (platform operators only, unticked by default): read the platform's organizations, users and feedback, handle the feedback, and appoint platform admins.
• Your organizations, each marked as available or switched off for AI assistants.

What an Assistant Can Do

Area	Read	Change (Read and change)
Orientation	who you are, your organizations and teams with your roles, today, the current Scorecard week and quarter; a team overview	—
To-dos	your to-dos across teams, a team's to-dos, overdue ones	create, edit, complete, reopen, delete
Issues	a team's issues by status, priority, or short-term/long-term	create, edit, move between short-term and long-term, change status (Open, Solving, Solved), delete
Rocks	team and company Rocks with milestones	create, edit, report status (on/off track, done), add and complete milestones, delete
Scorecard	metrics with goals and the last 1–26 weeks	add a metric with its goal (or without one, to only track it), owner and unit; enter or clear a week's value with a note (met or missed follows from the goal)
Meetings	meetings with ratings and their comments, segues, headlines, cascading messages, guests, and the to-dos and issues created in them	schedule a meeting on a day or record one that already happened (start and length; team admins), add a customer, employee or company headline or a cascading message, rate a meeting; team admins also set a member's rating (with a comment) or attendance and write the meeting's notes
Everything in the REST API	any operation of the REST API, found by search	the same, with the user's rights -- e.g. importing a team's history
Reference	V/TO (the company vision and the team's traction), Accountability Chart, People Analyzer, documents	—
Feedback	—	send a problem or an idea to the platform's operators
Platform (operators)	organizations, users, feedback	set a feedback entry's status and internal note; make a user a platform admin or a plain user

When an assistant reads a team's V/TO, it gets the company vision shared by all teams of the organization, the team's 1-year plan, the current quarter's Rocks and the team's open long-term issues (both live), and the archive of old hand-written lists, if there is one -- the same data as GET /teams/{teamId}/vision in the REST API. When it lists, creates, or updates issues, it can tell short-term issues (for the weekly meeting) from long-term ones (for the V/TO), for example "Put the office move on the Leadership Team's long-term issues". This applies from server version 1.7.0.

The Whole REST API: search_api, read_api, write_api

For what the tools above don't cover, the assistant reaches the REST API through three generic tools instead of dozens of special ones:

• search_api finds operations by words ("metric values batch", "meeting guests") and describes one in full: its parameters, request body and responses.
• read_api sends GET requests -- one, or up to 20 at once.
• write_api sends POST, PUT, PATCH and DELETE requests -- one, or up to 100 in order, optionally stopping at the first error. Each can be a dry run: carried out and rolled back, so the assistant sees what would be saved.

The calls run as the signed-in user inside EOS Hub (no API key needed) with the connection's rights: a read-only connection gets only search_api and read_api, and an organization that hasn't allowed AI assistants refuses them like every other tool. They have their own limit of 600 calls a minute. Changes are limited to a team's work -- to-dos, issues, Rocks, Scorecard, meetings, documents, the V/TO -- and undoing imports: who belongs to an organization or team, roles, settings, the Accountability Chart, People Analyzer and the platform are changed only by people in the app.

This is how an assistant imports a team's history, e.g. "Import the SW team's last 14 meetings from this spreadsheet": it sends externalId and importBatchId with what it creates, so a repeated run creates nothing twice and the whole import can be undone (see Importing History). This applies from server version 1.11.0.

Some things stay in the web app and the REST API: running an L10 meeting step by step, editing, reordering and deleting Scorecard metrics, editing the V/TO, editing the Accountability Chart, People Analyzer entries, documents, and organization and platform settings.

There is also a ready-made prompt, Prepare a Level 10 meeting. In Claude, pick it from the connector's prompts and enter the team. The assistant gathers the Scorecard, Rocks, overdue to-dos and open issues and drafts the agenda.

Deleting asks for confirmation in most assistants; EOS Hub marks those actions as destructive.

Managing Connections

Settings > AI assistants (MCP) > Connected apps lists every assistant you connected, with its access, when it was connected and when it was last used. Click Disconnect (the plug icon) to end a connection: the assistant loses access immediately.

Connecting the same app again replaces its earlier connection.

With many connections, search by the app's name or filter by App, and click a column header to sort. These filters are separate from the ones of the API keys list on the same page -- see Filtering Lists.

The platform operator sees each user's connection count in Platform > Users and can disconnect a connection there, for example if a device was lost.

Platform > MCP gives the operator the whole picture:

• Connected apps: every active connection. It shows the user, the app and its kind (Claude, ChatGPT, an app on a computer such as Claude Code or Cursor, or another app with its domain) and the rights granted. It also lists the organizations the user belongs to (those with AI assistants off are marked), when the connection was made and last used, and how long its sign-in lasts (the current access token, and until when it renews itself). Disconnect stops its tokens at once.
• Registered apps: the apps that registered with the sign-in server. For each you see the name, client ID, where it sends the sign-in, when and from which IP it registered, when it was last used and how many connections it has. Disconnect and delete disconnects everyone who uses the app and removes its registration. Apps register themselves, so the app can register again; its users then have to consent again. Delete unused registrations removes registrations older than a day that never got a connection, for example from a sign-in that was not finished; apps whose users only disconnected stay registered.

Which tools an assistant called is not recorded yet.

Security

• EOS Hub uses OAuth 2.1 with PKCE. Your password or Google account is never shared with the assistant, which only gets tokens issued by EOS Hub.
• Access tokens are valid for one hour. The assistant renews them with a refresh token that is valid for 30 days and replaced on every renewal. If an old refresh token is ever used again, EOS Hub assumes it was copied and ends the connection.
• Tokens work only for the MCP server, never for the REST API, and EOS Hub stores only fingerprints (hashes) of them.
• Your access follows your current roles. If you are removed from a team or an organization, the assistant loses that access at once. A suspended organization is read only.

Troubleshooting

Problem	What to do
The assistant sees no organization	An Owner or Admin must allow AI assistants in Organization settings > General. The settings page lists your organizations where it is still off.
"This connection can't be set up"	The app asked to return to an address it didn't register. Start the connection again from the app.
"AI assistants are switched off"	The platform operator switched MCP off. Try again later.
An action fails with forbidden	Your role doesn't allow it (for example, a Viewer can't add to-dos), or the connection is Read only.
An action fails with orgSuspended	The organization is suspended and read only.
The assistant stops working after a while	The connection was disconnected or expired after 30 days without use. Connect again.