oracle-hcm-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ORACLE_HCM_AUTH | No | Authentication mode: basic, oauth, bearer, or none | |
| ORACLE_HCM_WRITE | No | Set to 1 to enable immediate write operations (same as --write) | 0 |
| ORACLE_HCM_PROFILE | No | Optional multi-environment profile label | |
| ORACLE_HCM_BASE_URL | No | The base URL of the Oracle HCM REST API, e.g. https://fa-….fa.ocs.oraclecloud.com/hcmRestApi | |
| ORACLE_HCM_PASSWORD | No | Password for basic authentication | |
| ORACLE_HCM_USERNAME | No | Username for basic authentication | |
| ORACLE_HCM_CLIENT_ID | No | OAuth client ID | |
| ORACLE_HCM_SENSITIVE | No | Set to 1 to enable payslip, bank, or national-ID tools | 0 |
| ORACLE_HCM_TOKEN_URL | No | OAuth token URL for client-credentials flow | |
| ORACLE_HCM_API_VERSION | No | The API version to use (default 11.13.18.05) | 11.13.18.05 |
| ORACLE_HCM_BEARER_TOKEN | No | Bearer token for authentication | |
| ORACLE_HCM_CLIENT_SECRET | No | OAuth client secret | |
| ORACLE_HCM_APPROVAL_STORE | No | Approval store type: memory (default), file, or sqlite | memory |
| ORACLE_HCM_WEBHOOK_SECRET | No | HMAC-SHA256 secret for webhook receiver (X-HCM-Signature) | |
| ORACLE_HCM_APPROVAL_TTL_MS | No | Time-to-live for pending approval intents in milliseconds (default 900000) | 900000 |
| ORACLE_HCM_SENSITIVE_WRITE | No | Set to 1 to allow sensitive tools to skip approval when combined with --write | 0 |
| ORACLE_HCM_APPROVAL_STORE_PATH | No | Path for file or sqlite approval store | |
| ORACLE_HCM_ATOM_CHECKPOINT_PATH | No | Path for Atom CDC checkpoint JSON file |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| hcm_healthA | Check connectivity to the configured HCM REST base (unofficial MCP). |
| hcm_whoamiA | Return local auth/config identity hints (no secrets). HCM RBAC still applies. |
| hcm_list_resourcesA | List curated HCM resource roots supported by this unofficial MCP. |
| hcm_describe_resourceB | Describe a curated resource by name (workers, planBalances, …). |
| hcm_search_workersC | Search workers (q / finder / limit / offset). Example: { "q": "PersonNumber=P1001", "limit": 5 } |
| hcm_get_workerA | Get a worker by WorkerId. Example: { "workerId": "1001" } |
| hcm_get_worker_assignmentsC | Deep-read worker assignments. Prefers workers/{id} expand; falls back to workerAssignments. |
| hcm_create_workerA | Create a worker (requires approval unless --write). Example body: { "DisplayName": "New Hire", "PersonNumber": "P9" } |
| hcm_update_workerC | PATCH a worker (requires approval unless --write). |
| hcm_search_absencesC | Search absences. |
| hcm_get_absenceB | Get absence by id. |
| hcm_create_absenceC | Create an absence entry (approval unless --write). |
| hcm_update_absenceC | Update an absence (approval unless --write). |
| hcm_delete_absenceC | Delete an absence (approval unless --write). |
| hcm_absence_balanceC | Search absence plan balances via Fusion planBalances. |
| hcm_get_plan_balanceB | Get a single plan balance by id (Fusion planBalances/{id}). |
| hcm_search_aorC | Search areas of responsibility. |
| hcm_get_aorB | Get AOR by id. |
| hcm_create_aorC | Create AOR (approval unless --write). |
| hcm_update_aorC | Update AOR (approval unless --write). |
| hcm_delete_aorC | Delete AOR (approval unless --write). |
| hcm_list_checklistsC | List allocated checklists. |
| hcm_get_checklistA | Get allocated checklist by id (expand allocatedTasks when supported). |
| hcm_update_task_statusC | Update checklist task status via child/allocatedTasks/.../action/updateTaskStatus. |
| hcm_list_notificationsC | List business process notifications. Optional status/assignee filters (richer BP filters). |
| hcm_get_notificationA | Get a business process notification by task/notification id. |
| hcm_perform_bp_actionD | Perform BP action via businessProcessNotifications/action/performAction. |
| hcm_search_organizationsC | Search organizations / departments. |
| hcm_get_organizationC | Get organization by id. |
| hcm_search_locationsD | Search locations LOV. |
| hcm_get_locationB | Get location by id. |
| hcm_search_jobsC | Search jobs LOV. |
| hcm_get_jobB | Get job by id. |
| hcm_search_gradesC | Search grades LOV (optional). |
| hcm_get_gradeC | Get grade by id. |
| hcm_search_time_recordsC | Search time records (Fusion timeRecords). |
| hcm_get_time_recordA | Get a time record by id. |
| hcm_search_talent_profilesC | Search talent person profiles. |
| hcm_get_talent_profileA | Get talent person profile by id. |
| hcm_update_talent_profileC | Light PATCH of a talent person profile (approval unless --write). |
| hcm_search_payroll_relationshipsC | Search payroll relationships (read-only). |
| hcm_get_payroll_relationshipA | Get payroll relationship by id (read-only). |
| hcm_rest_getB | Allowlisted generic GET under HCM resources. Blocked for CE/generative-AI/internal paths. |
| hcm_rest_mutateC | Allowlisted generic mutate (POST/PATCH/PUT/DELETE). Requires approval unless --write. |
| hcm_list_pending_approvalsA | List pending write intents awaiting human approval. |
| hcm_approve_writeA | Approve and execute a pending write by approval_id. |
| hcm_deny_writeB | Deny a pending write by approval_id. |
| hcm_list_atom_feedsB | List known Atom / change-detection feeds (collection-oriented). Dummy exposes workers/absences/all. |
| hcm_get_atom_feedB | Get an Atom feed as JSON entries (or request format=atom for XML via dummy). Supports since ISO filter. |
| hcm_list_atom_entriesC | List Atom feed / change-detection entries (Fusion atomfeeds). Dummy returns mock change events. |
| hcm_get_atom_entryA | Get a single Atom entry by EntryId. |
| hcm_detect_changesC | Summarize recent Atom/change entries since an optional ISO timestamp (client-side filter on feed). |
| hcm_atom_pollA | Poll Atom feed for entries after the stored checkpoint cursor (or since). Does not advance cursor. |
| hcm_atom_consumeB | Consume (poll + advance checkpoint) Atom entries after cursor. Persists checkpoint to file store. |
| hcm_atom_get_checkpointC | Get Atom CDC checkpoint(s) from local store. |
| hcm_atom_reset_checkpointA | Clear Atom CDC checkpoint for a collection (or all). Local store only. |
| hcm_search_requisitionsC | Search recruiting job requisitions. |
| hcm_get_requisitionC | Get recruiting job requisition by id. |
| hcm_search_candidatesC | Search recruiting candidates. |
| hcm_get_candidateA | Get recruiting candidate by id. |
| hcm_search_benefit_enrollmentsC | Search benefits enrollments. |
| hcm_get_benefit_enrollmentB | Get benefits enrollment by id. |
| hcm_allocate_checklistB | Allocate a checklist to a person (approval unless --write). |
| hcm_force_close_checklistC | Force-close an allocated checklist (approval unless --write). |
| hcm_create_worker_assignmentB | Create nested worker assignment under workRelationships/.../assignments (approval unless --write). |
| hcm_update_worker_assignmentC | PATCH a worker assignment (approval unless --write). |
| hcm_lov_finderB | LOV finder helper — runs finder= on an allowlisted LOV root (organizations, locations, jobs, grades, positions, absenceTypes, workers, absences, …). |
| hcm_lov_findA | Structured ADF finder call: resource + finder name + params object (builds finder=name;k=v,…). Prefer over raw finder strings. |
| hcm_describe_finderA | Describe curated ADF finder parameters for a resource (or list all finders). Unofficial catalog — not full Fusion metadata. |
| hcm_resolve_uniq_keyB | Resolve a Fusion-style uniq key / business key to a primary id via q= on an allowlisted resource. |
| hcm_setup_statusA | Setup status: public config view, write/sensitive flags, tool counts (no secrets). |
| hcm_test_connectionB | Probe HCM connectivity via workers?limit=1 (same as hcm_health, explicit setup name). |
| hcm_emit_mcp_configB | Emit a redacted Cursor mcp.json fragment for oracle-hcm / oracle-hcm-write (secrets as placeholders). |
| hcm_export_configA | Export public (non-secret) config JSON for multi-env profiles / backup. |
| hcm_search_public_workersC | Search publicWorkers. |
| hcm_get_public_workerC | Get publicWorker by id. |
| hcm_search_contactsD | Search hcmContacts. |
| hcm_get_contactC | Get contact by id. |
| hcm_search_phonesC | Search worker phones. |
| hcm_search_emailsC | Search worker emails. |
| hcm_get_work_relationshipC | Get nested work relationship for a worker. |
| hcm_search_positionsC | Search positions LOV. |
| hcm_get_positionB | Get position by id. |
| hcm_list_direct_reportsA | List direct reports for a manager person number (dummy: filters workers by ManagerPersonNumber). |
| hcm_get_org_hierarchyA | Return a simple org hierarchy tree rooted at organizationId (dummy parent/child). |
| hcm_find_locationsC | Location finder helper (finder + country filter). |
| hcm_search_absence_typesC | Search absence types LOV. |
| hcm_search_absence_plansC | Search absence plans LOV. |
| hcm_get_absence_type_balanceD | getAbsenceTypeBalance-style helper via planBalances finder. |
| hcm_submit_time_cardC | Submit a time card (approval unless --write). |
| hcm_search_schedulesC | Search work schedules. |
| hcm_get_scheduleB | Get work schedule by id. |
| hcm_search_goalsC | Search talent goals. |
| hcm_get_goalC | Get goal by id. |
| hcm_search_performance_documentsC | Search performance documents. |
| hcm_get_performance_documentC | Get performance document by id. |
| hcm_search_learning_enrollmentsC | Search learning enrollments. |
| hcm_get_learning_enrollmentB | Get learning enrollment by id. |
| hcm_search_payslipsC | Search payslips. SENSITIVE: requires ORACLE_HCM_SENSITIVE=1 + approval (unless SENSITIVE_WRITE). |
| hcm_get_payslipC | Get payslip by id. SENSITIVE gate. |
| hcm_search_national_identifiersC | Search national identifiers. SENSITIVE: requires ORACLE_HCM_SENSITIVE=1 + approval (unless SENSITIVE_WRITE). |
| hcm_get_national_identifierB | Get national identifier. SENSITIVE gate. |
| hcm_search_bank_accountsC | Search bank accounts. SENSITIVE: requires ORACLE_HCM_SENSITIVE=1 + approval (unless SENSITIVE_WRITE). |
| hcm_get_bank_accountB | Get bank account. SENSITIVE gate. |
| hcm_search_payment_methodsB | Search payment methods. SENSITIVE: requires ORACLE_HCM_SENSITIVE=1 + approval (unless SENSITIVE_WRITE). |
| hcm_search_compensationC | Search compensation history. SENSITIVE: requires ORACLE_HCM_SENSITIVE=1 + approval (unless SENSITIVE_WRITE). |
| hcm_get_compensationC | Get compensation row. SENSITIVE gate. |
| hcm_search_element_entriesC | Search payroll element entries (read-only specialist; not sensitive-gated). |
| hcm_search_calculation_cardsC | Search calculation cards (read-only specialist). |
| hcm_bulk_bp_dry_runA | Dry-run bulk approve/deny for notification ids — returns planned actions without executing. |
| hcm_bulk_approve_notificationsB | Bulk approve BP notifications (approval unless --write). Prefer dry-run first. |
| hcm_bulk_deny_notificationsC | Bulk reject/deny BP notifications (approval unless --write). |
| hcm_list_audit_trailA | List in-process MCP audit trail (tool invocations; not Fusion transaction history). |
| hcm_explain_toolB | Explain a curated MCP tool: class (read/write/sensitive), related resource, usage hints. |
| hcm_dry_run_mutateA | Dry-run an allowlisted mutate: validates path/method/body shape; does not call Fusion. |
| hcm_probe_capabilitiesB | Tenant capability probe — lists curated resources and whether dummy/seed responds. |
| hcm_rbac_hintA | RBAC hint: reminds that HTTP auth ≠ HCM privileges; returns whoami + sensitive/write flags. |
| hcm_start_webhook_receiverA | Start localhost webhook receiver. When ORACLE_HCM_WEBHOOK_SECRET (or secret arg) is set, requires X-HCM-Signature HMAC-SHA256. |
| hcm_list_webhook_eventsB | List events received by the local webhook stub. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 119 tools
While most tools target a distinct resource+action, there are notable overlaps: hcm_health and hcm_test_connection are explicitly the same operation, and hcm_lov_finder/hcm_lov_find plus resource-specific searches blur boundaries. The massive set also includes multiple near-duplicate Atom and balance helpers that make selection error-prone.
All tools share the hcm_ prefix and most follow a consistent verb_noun pattern (search_*, get_*, create_*, update_*, delete_*, list_*). Minor deviations like hcm_health, hcm_lov_finder, hcm_atom_poll, and hcm_test_connection are in the minority and still readable.
119 tools is extreme over-scoping for a single MCP server, far beyond the 1-5 well-scoped range and into the 50+ territory. Even for a broad HCM domain, the surface is bloated with duplicate helpers, generic rest tunnels, and setup/probe tools that could be consolicated.
The tool surface is remarkably broad, covering workers, absences, talent, payroll, recruiting, benefits, organizations, time, notifications, webhooks, audit, and Atom change detection. Minor gaps exist (e.g., no worker delete, no update/delete for several read-only resources), but core HCM workflows are largely represented.