Skip to main content
Glama
anevjes

HR MCP Server

by anevjes
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

HR MCP Server

An HR MCP Server built with FastMCP that exposes employee directory, profile, salary, and PII data through scope-based authorization.

Scopes

Scope

Description

reader

Access non-PII employee data (name, department, job title, office, etc.)

writer

Update employee records

restricted

Access PII / sensitive data (salary, address, tax info, bank details, etc.)

Scope mapping to tools

Tool

Required Scopes

list_employees

reader

get_employee_profile

reader

search_employee_directory

reader

get_org_chart

reader

get_employee_pii

restricted

get_employee_salary

restricted

get_employee_full_record

restricted

get_department_salary_summary

restricted

update_employee_profile

writer

update_employee_salary

writer + restricted

update_employee_contact

writer + restricted

whoami

(any authenticated user)

Related MCP server: Internal Data MCP Server

Setup

pip install fastmcp

Running

# STDIO mode (for MCP clients)
python server.py

# Or via FastMCP CLI
fastmcp run server.py

Mock Data

The server ships with 7 mock employees across departments (Engineering, Data Science, HR, Finance, Operations, Executive). All data is in-memory via hr_data.py.

Deploying to Azure Container Apps

Prerequisites

  • Azure CLI (az) installed and logged in

  • Docker installed

  • An existing Azure Container Registry (ACR)

  • An existing Container App Environment

1. Build and push the Docker image

.\build-and-push.ps1 -AcrName <your-acr-name>

This builds the image and pushes it as <your-acr-name>.azurecr.io/hr-mcp-server:latest.

2. Deploy the Container App

az deployment group create `
  --resource-group <your-rg> `
  --template-file infra/container-app.bicep `
  --parameters `
    environmentId="/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.App/managedEnvironments/<env-name>" `
    acrLoginServer="<your-acr-name>.azurecr.io" `
    appInsightsConnectionString="<optional-connection-string>"

The Bicep template (infra/container-app.bicep) creates a Container App with:

  • External ingress on port 8000

  • System-assigned managed identity for ACR pull

  • Application Insights telemetry (optional)

3. Grant ACR pull permissions

After deployment, assign the AcrPull role to the Container App's managed identity:

# Get the principal ID from the deployment output
$principalId = (az containerapp show --name hr-mcp-server --resource-group <your-rg> --query identity.principalId -o tsv)

az role assignment create `
  --assignee $principalId `
  --role AcrPull `
  --scope /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.ContainerRegistry/registries/<your-acr-name>

4. Restart the Container App

After the role assignment propagates, restart to pull the image with the managed identity:

az containerapp revision restart --name hr-mcp-server --resource-group <your-rg>

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Resources

Related MCP Connectors

  • HubSpotOAuth
    com.hubspot.app

    The HubSpot MCP Server acts as a bridge that enables AI assistants and Large Language Models to securely interact with HubSpot CRM data through natural conversation, without requiring users to understand complex API structures. It provides read-only access to standard CRM objects (contacts, companies, deals, tickets, products, invoices, and more) and their associations, secured via OAuth 2.0, allowing AI agents to perform tasks like summarizing deals, fetching company updates, and looking up record changes.

    Customer Data PlatformsDatabasesMarketing
    3
  • Remote MCPA
    com.remote-mcp.mcp

    The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.

    Developer ToolsSearchAgent Orchestration
    13
  • isolved-jobs-apiOAuth
    io.github.johnisanerd

    isolved and ApplicantPro jobs, tenant discovery, and change detection as an MCP server.

    Monitoring
    1
  • MANDATE Credential BrokerB
    io.github.projetnanocorp

    MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.

    Security
    111

Related MCP Servers

  • HR MCP Server

    gabrielrojasnyc
    A
    license
    D
    quality
    D
    maintenance
    A Model Context Protocol server that enables Claude Desktop to access structured employee data and perform HR operations including employee lookups, searches, and global leave requests.
    3
    1
    MIT

  • Internal Data MCP Server

    GRChetanReddy
    F
    license
    Not graded
    quality
    D
    maintenance
    Exposes internal employee directories and project management systems to AI models through standardized tools and resources. It enables AI assistants to search for team members, query project statuses, and explore organizational hierarchies with secure role-based access control.
    -

  • DunderMifflin MCP Server

    Ashutosh-nagaria
    A
    license
    Not graded
    quality
    B
    maintenance
    An MCP server providing role-based access control for HR policies, exposing tools to list, retrieve, and check access to policy sections while filtering sensitive data by role.
    MIT