DaySight MCP

Security and privacy

Your assistant gets your access, not more

How access works, what stays on your computer and what to check before you roll it out.

Two layers on every request

1

Your API Client sets the outer limit

When you register the client you choose its scopes. The server can only reach resources inside them, whoever signs in.

2

You set what comes back

You sign in with your own Workday account and approve the client. Workday then applies your security permissions to every call.

Analytics are summaries

  • Workforce analytics returns aggregates only. No names and no individual pay.
  • Groups smaller than three people are rolled into "Other" or hidden, and a selection that small returns nothing.
  • Pay figures need groups of five or more.
  • Leaders appear as the organization they lead plus an opaque code, never by name.
  • Diversity fields stay off until the owner of the install switches them on.

What stays on your computer

  • The client secret is kept in Claude Desktop's secure storage.
  • Your login token is stored encrypted in your Windows user profile.
  • Secrets and tokens never go into tool arguments, results or logs, so the model never sees them.
  • There is no generic "call any URL" tool. Your assistant can only use the Workday operations the server exposes.
  • Audit logs record the tool name, argument names, status and duration, never values.

Claude Enterprise for privacy and safety

Whatever your assistant retrieves is sent to the AI provider as part of the conversation. For HR data, use Claude Enterprise, which does not use your conversations to train models, and check your company's policy on sending HR data to an AI service.

A checklist before you start

  • Register your own API Client and never share its secret.
  • Give it the smallest set of scopes that covers your questions.
  • Start on a sandbox or implementation tenant.
  • Use Claude Enterprise rather than a consumer account.
Read the security checklist in the guide

Licence

DaySight MCP is source-available, not open source. It is free for non-commercial use under the PolyForm Noncommercial License 1.0.0. Commercial use is not permitted. The download is a 30-day trial for each Workday tenant and API client; after that a licence key is needed to continue. The trial check runs on your computer: it stores only hashes of your tenant and client ID, never your client secret, and sends nothing anywhere. The server source code is not published in this repository.

Try it on your own Workday tenant

Download the extension, register your own API Client and ask your first question. A test or implementation tenant is the best place to start.

How to installDownload