Shapes
by Shapes
Query live HR data — headcount, org charts, time off, reviews and surveys — from your AI assistant. 35 read-only tools, OAuth sign-in, your existing Shapes permissions carry through.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Shapes via MCP
https://mcp.shapes.co/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Shapes Tools & Capabilities (35)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- Read-only, on the vendor's word rather than ours. The 401 blocked any schema or annotation read, so we could not confirm the read-only claim from MCP safety annotations. What we can say is that no name among the 35 is a write verb, and that Anthropic's directory records the permissions field as the exact string "Read only".
- The directory's tool names are stale. 31 of Anthropic's 34 listed names no longer exist under those names. Anything written against them will fail to match.
- The enumerated 35 is a floor. Shapes' own page claims "35+ tools and built-in skills" while listing 35, so an unknown number of tools are described nowhere public.
- Survey and performance tools depend on paid add-ons. Shapes sells Surveys, Performance and Compensation separately from its Core and Plus base plans, so eleven of the 35 tools cover modules a given account may not have.
- No rate limits or usage metering are published. Neither Shapes' MCP page, its help-centre article, nor its pricing page states a call quota, rate limit or per-call charge for MCP use. We found no metering statement of any kind, which is a gap rather than an assurance.
- Knowledge-base and helpdesk content is user-generated.
search_knowledge_baseandread_helpdesk_articlereturn free text written by people at your company. That text enters the assistant's context as untrusted input, and Shapes publishes no statement about sanitising it. - Data residency and retention are not documented for the connector. Shapes' security page covers the platform — SOC 2 Type II, GDPR, ISO 27001, ISO 42001 in progress, and a statement that customer data is not used to train off-the-shelf models — but says nothing specific about MCP.
search_in_hierarchyis unaccounted for. The directory lists it; Shapes' reference does not, and we could not establish whether it was renamed or removed.
Frequently asked questions
Who has to set up the Shapes connector, an admin or each employee?
Both, in that order. Shapes documents a two-part setup: an organisation admin in Claude adds the Shapes connector once for the whole company, then every employee separately connects their own Shapes account. Shapes says this keeps permissions intact, because each person authorises individually rather than sharing one organisation-wide credential.
Can the Shapes connector change my HR data?
No. Shapes states plainly that every tool is read-only and that no data is modified through the MCP server. The tool surface bears that out: all 35 documented tool names start with list, get, aggregate, search or read, and none creates, updates, deletes or sends anything. Nothing the connector does is visible to your colleagues.
Will Claude see employee records I am not allowed to view?
No. Shapes documents that your existing Shapes permissions carry through to every conversation, so the connector returns only what your own account can already reach. Two tools are marked admin-scope in Shapes' own tool table, which suggests some listings need elevated rights. Shapes publishes no per-tool permission map beyond that.
Do I need an API key for the Shapes MCP server?
No. Shapes uses OAuth 2.0 with PKCE, and states there are no API keys or tokens to manage. Your MCP client opens a browser window on first use, you sign in with your Shapes account, and the client handles tokens automatically. We confirmed the server advertises PKCE with S256 and dynamic client registration.
Does the Shapes connector need a paid plan or add-on?
It needs a Shapes subscription, and some tool groups sit behind paid add-ons. Shapes prices two base plans, Core and Plus, and sells Surveys, Performance and Compensation as separate purpose-built apps priced per seat. Tools that read survey and performance-review data will only return anything if your account includes those modules.
Sources
- Shapes MCP server documentation, served at the endpoint host root (retrieved 2026-08-21) · retrieved 2026-08-21
- Shapes Help Center, "Connect Shapes to Claude" (retrieved 2026-08-21) · retrieved 2026-08-21
- Shapes MCP product page (retrieved 2026-08-21) · retrieved 2026-08-21
- Shapes pricing (retrieved 2026-08-21) · retrieved 2026-08-21
- Shapes security and compliance (retrieved 2026-08-21) · retrieved 2026-08-21
- Anthropic Connectors Directory entry (snapshot 2026-08-16) · retrieved 2026-08-16
- Live OAuth posture check: anonymous request returned 401 with a
WWW-Authenticatechallenge; RFC 9728 metadata atmcp.shapes.co/.well-known/oauth-protected-resourceand/.well-known/oauth-protected-resource/mcp; authorization server metadata at/.well-known/oauth-authorization-server(2026-08-21) · retrieved 2026-08-21 shapes.co/robots.txtpublishes only a sitemap reference, with no disallow rule and noContent-Signaldirective (2026-08-21) · retrieved 2026-08-21
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Productivity
- Developer
- Shapes
- Tools
- 35
- Domain
- mcp.shapes.co
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.