Bamboohr MCP Server (Encore Shao)
BambooHR data and time-tracking access via a TypeScript-based MCP interface.
Data last scanned today · Reviewed today
Overview
BambooHR MCP Server allows AI models to interact directly with BambooHR API endpoints. It provides a suite of helper functions and TypeScript interfaces for managing employee directories, retrieving out-of-office statuses, and submitting work hours programmatically.
Our verdict
With a security score of 18/100, this server carries a high risk level. The project is community-maintained rather than vendor-backed, has not been updated in over 450 days, and lacks a designated read-only mode, meaning all installations operate with full write access to your BambooHR instance. Given these factors, this tool should be treated as experimental and is not recommended for production environments or sensitive corporate data integrations.
- Includes fully defined TypeScript types for API models
- Provides promise-based helper functions for major API endpoints
- Small dependency footprint with only three direct dependencies
- No read-only mode to limit potential write operations
- Inactivity of over 450 days suggests lack of maintenance
- Single contributor increases the bus-factor risk
Setup
{
"mcpServers": {
"encoreshao-bamboohr-mcp": {
"args": [
"-y",
"bamboohr-mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| fetchWhosOut | Fetch who is out today. | low |
| fetchProjects | Fetch available projects. | low |
| submitWorkHours | Submit work hours. | medium |
| getMe | Get current user information. | low |
| fetchEmployeeDirectory | Fetch employee directory. | low |
| fetchTimeEntries | Fetch time entries. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What credentials are required to use this MCP server?
You need a BambooHR API token, your company's BambooHR domain, and your specific employee ID.
›How can I obtain a BambooHR API token?
Generate a new token by navigating to the API Keys section within your BambooHR profile settings.
›Where do I find my company domain?
The company domain is the subdomain found in your BambooHR URL, which is the segment preceding .bamboohr.com.
›Is it mandatory to use environment variables for configuration?
No, you can either store your credentials in environment variables or pass them directly as arguments to the API methods.
Badge
Maintain this server? Add the live badge to your README.