Deel MCP Server: Tools, Setup and Security

The Deel MCP server lets an AI app work with your Deel account: list contracts, look up people, file time-off requests, review invoices and manage IT assets. Deel publishes and hosts it. Deel's docs say it exposes Deel platform operations "as tools that AI agents and assistants can call directly."

Checked against: Deel's MCP developer docs on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

Deel sorts tools into three kinds. Organization tools see company-wide data and need organization-level scopes. Worker tools act for one worker and need worker-level authentication. Public tools return reference data.

The tools reference groups them like this:

• Contracts and hiring: listOfContracts, retrieveASingleContract, createANewContract, createContractForEOR, amendContract and signContract.
• People and HRIS: getListOfPeople, getHrisProfilePerson and updatePersonalInformation.
• Time off and scheduling: getTimeOffRequests, createTimeOffRequest, updateTimeOffRequest, cancelTimeOffRequest and getShifts.
• Payments and invoices: getInvoiceList, getContractPaymentDates, createInvoiceAdjustment and AddOffCyclePaymentForContract.
• Payroll: getEORWorkerPayslips and getGPWorkerPayslips, both read-only.
• Hiring intelligence: calculateEmploymentCost and calculateTakeHomePay.
• Benefits, compliance and immigration: retrieveBenefitsByCountry, checkVisaRequirement and immigrationCaseDetails.
• Organization and reference data: getCurrentOrganization, getLegalEntityList, retrieveCountries and retrieveSupportedCurrencies.
• Deel IT: asset, order, hardware policy, seat and clearance tools, such as it_asset_list, createItOrder_beta and approveItOrder_beta.

How to connect it

Deel's connecting clients guide gives these configs.

Cursor (~/.cursor/mcp.json) and Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "deel": {
      "url": "https://api.letsdeel.com/mcp"
    }
  }
}

VS Code (.vscode/mcp.json):

{
  "servers": {
    "deel": {
      "type": "http",
      "url": "https://api.letsdeel.com/mcp"
    }
  }
}

These clients run the OAuth2 flow when you first use a Deel tool. For ChatGPT, Deel says to enable MCP in your account (Pro, Plus, Business, Enterprise or Education) and create a custom connector with the server URL and OAuth.

Other clients without OAuth can send a personal access token:

{
  "mcpServers": {
    "deel": {
      "url": "https://api.letsdeel.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_PERSONAL_ACCESS_TOKEN"
      }
    }
  }
}

Security notes

• Prefer OAuth. Deel recommends OAuth2 over personal access tokens where your client supports it. A token in a config file is easier to leak.
• Scopes matter. Deel's authorization page maps scopes such as contracts:read, contracts:write and people:read to tools, and says, "Request only the scopes your application requires."
• Token lifetimes. Deel says OAuth access tokens last one hour, and refresh tokens last 30 days and are single-use. The flow uses PKCE with S256.
• Protect tokens. Deel says to keep personal access tokens out of version control and use environment variables or a secrets manager.
• Powerful writes. The server can create, amend and sign contracts and add off-cycle payments. Require approval in your client for every write.
• Beta tools. Deel says _beta tools are new endpoints whose behavior may change until the stable date given in each tool's description.
• Errors. Failed calls return an isError flag, so clients should handle errors rather than retry blindly.

Read our guides to token passthrough and excessive permissions, and the MCP security center.

Alternatives

• Rippling, an HR and IT platform with admin-controlled MCP access.
• Gusto, for US small-business payroll.

See more in the MCP server directory.

Next step

Want contracts and payroll data in an AI workflow without oversharing? Our MCP readiness audit is the place to start.

Frequently asked questions