SumhourDevelopers
Open Sumhour

Connect an AI assistant

Sumhour is an MCP server. Point any MCP client at

https://app.sumhour.com/mcp

The first time, the client opens Sumhour in the browser: you sign in, pick the workspace and untick anything you do not want to share. The assistant then acts as you, never beyond your role, and every change it makes is logged as via MCP with the client's name. Disconnect it any time under API tokens → Connected apps.

Claude (claude.ai and the desktop app)

Customize → Connectors, then + → Add custom connector, paste the URL above and Add. Leave the OAuth fields under Advanced settings empty. Works on every plan; the Free plan allows one custom connector. On Team and Enterprise an owner adds it for the organization first.

Claude Code

claude mcp add --transport http sumhour https://app.sumhour.com/mcp

Then run /mcp in a session and choose Authenticate. Without a browser (CI, a remote box), use an API token instead:

claude mcp add --transport http sumhour https://app.sumhour.com/mcp --header "Authorization: Bearer sh_pat_..."

The Sumhour plugin for Claude Code bundles this connection with a skill that logs a coding session as time entries (/sumhour:log-session). It installs from the Sumhour repository once it is public.

ChatGPT

Settings → Security and login → turn on Developer mode. Then open ChatGPT Plugins, press + and connect the URL above.

Cursor

Add Sumhour to Cursor, or put this in .cursor/mcp.json:

{ "mcpServers": { "sumhour": { "url": "https://app.sumhour.com/mcp" } } }

VS Code

.vscode/mcp.json:

{ "servers": { "sumhour": { "type": "http", "url": "https://app.sumhour.com/mcp" } } }

Tools

The assistant sees only the tools its permissions and your role allow. Each tool is marked as reading, changing or deleting, so clients can ask before the risky ones.

Tool What it does Kind Permission
me_get Who am I reads
projects_list List projects reads projects:read
projects_tasks A project's tasks reads projects:read
clients_list List clients reads projects:read
timer_get Running timer reads time:read
timer_start Start a timer changes time:write
timer_stop Stop the timer changes time:write
entries_list List time entries reads time:read
entries_create Log time changes time:write
entries_update Change a time entry changes time:write
entries_delete Delete a time entry deletes time:write
timesheets_get A week's timesheet reads time:read
timesheets_submit Submit a week changes time:write
expenses_categories Expense categories reads expenses:read
expenses_list List expenses reads expenses:read
expenses_create Add an expense changes expenses:write
invoices_list List invoices reads invoices:read
invoices_get An invoice reads invoices:read
invoices_create_draft Draft an invoice changes invoices:write
invoices_record_payment Record a payment changes invoices:write
reports_run Run a report reads reports:read
approvals_list Weeks waiting for review reads approvals:read
approvals_approve Approve a week changes approvals:write
approvals_reject Send a week back changes approvals:write
people_list List people reads team:read
clients_create Add a client changes projects:write
projects_create Add a project changes projects:write

Prompts

  • Log my day: paste a rough note of your day; the assistant proposes entries and logs them after you confirm.
  • Check my week: finds short days, entries without notes and running timers before you submit.
  • Month end (accountants and admins): what is uninvoiced, what is overdue and which drafts to create.

How sign-in works

OAuth 2.1 with Sumhour as the authorization server. For client developers:

  • Protected resource metadata: https://app.sumhour.com/.well-known/oauth-protected-resource/mcp (an unauthenticated call to /mcp answers 401 pointing there).
  • Authorization server metadata: https://app.sumhour.com/.well-known/oauth-authorization-server/api/auth, issuer https://app.sumhour.com/api/auth.
  • Clients identify with a Client ID Metadata Document URL, or register dynamically. PKCE is required. Access tokens are audience-bound JWTs for an hour; refresh tokens come with offline_access.
  • Scopes are the permissions on the overview. A client that asks for none is offered all of them, and the person can untick any.