Connect Gusto to Microsoft Copilot via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Gusto, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Gusto + Microsoft Copilot

Let your AI read your Gusto payroll and HR data: the company, its locations and admins, employees with their jobs and pay rates, contractors, departments, pay schedules and pay periods, processed payrolls with totals, contractor payments, time off policies and requests, earning types and benefits. Read-only for payroll; it can only create and rename departments. Gusto OAuth sign-in, demo or production.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

GUSTO_CLIENT_ID, GUSTO_CLIENT_SECRET, GUSTO_API_URL

Step 1 — Get credentials

1. Create a free account on the Gusto Developer Portal at https://dev.gusto.com and create an application. A new application starts in the demo environment, which runs against test companies.
2. In the application settings, add the redirect URI https://cloud.anythingmcp.com/api/mcp-oauth/callback (if you host AnythingMCP yourself: <your AnythingMCP URL>/api/mcp-oauth/callback). Demo redirect URIs can be edited in the portal; for a production application, Gusto changes them on request.
3. Copy the application's Client ID and Secret into GUSTO_CLIENT_ID and GUSTO_CLIENT_SECRET.
4. Set GUSTO_API_URL to https://api.gusto-demo.com for a demo application, or to https://api.gusto.com once Gusto has approved your application for production. The keys only work in their own environment.
5. To try it first, create a demo company in the Developer Portal. It comes with sample employees, contractors and payrolls.
6. Install the connector, click Authorize with Provider and sign in to Gusto as a primary or full-access admin. Gusto asks which company to connect: one authorization covers one company, so install the connector again for a second one.
7. Run gusto_get_token_info. It shows the company the other tools work on and what your application may read.

Payroll is read-only: the AI reads payrolls with totals, taxes and deductions per employee, pay schedules, pay periods and contractor payments, but it cannot prepare, calculate, submit or cancel a payroll, pay contractors, add or terminate employees or change pay. The only changes it can make are creating a department (gusto_create_department) and renaming one (gusto_update_department, switched off at install), and it confirms both with you first.

What it reads: the company, its locations and admins, employees with their jobs, pay rates and employment history, contractors, departments, time off policies with balances, time off requests, earning types and company benefits. Payroll lists default to processed regular payrolls of the last six months, with up to one year per request.

Permissions come from Gusto: you do not pick scopes at sign-in. Gusto assigns them to your application, broadly in the demo environment and in production after its review. Pay rates need the compensations:read scope, and benefits with health information need the :phi scopes. A call outside your application's scopes answers 403.

Tokens: access tokens last two hours and are renewed automatically. Gusto replaces the refresh token on every renewal, so do not use the same authorization in another tool at the same time: one of the two would have to sign in again.

Common errors: 401 means the authorization was revoked, so click Authorize with Provider again. 403: your application lacks the scope, or the company is not the one you authorized. 406: the API version the connector sends is outside what your application allows (the Developer Portal shows its minimum version). 429: more than 200 requests in a minute, so wait a minute.

The connector does not run payroll, pay contractors, onboard or terminate people, change pay or benefits, or read tax forms and documents. Gusto Embedded is a different product and is not covered.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Microsoft Copilot

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Microsoft Copilot uses MCP servers through agents built in Copilot Studio: you add AnythingMCP to an agent as a tool, then publish the agent to Microsoft 365 Copilot and Teams. Copilot Studio connects from Microsoft's cloud over Streamable HTTP, which AnythingMCP supports.

1. In Copilot Studio, open your agent (or create one), go to Tools and choose Add a tool → New tool → Model Context Protocol.
2. Enter a Server name (for example AnythingMCP), a Server description that says what the connector does, and the Server URL https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID. Copilot Studio uses the description to decide when to call the server.
3. Under authentication, choose API key, set Type to Header and the header name to X-API-Key, then select Create.
4. In Add tool, choose Create a new connection, paste an MCP API key from AnythingMCP (MCP Servers → your server → API keys) and select Add to agent.
5. Try it in the agent's Test pane: ask for something that needs the Gusto tools.
6. Select Publish, then Channels → Microsoft 365 and Microsoft Teams, keep Make agent available in Microsoft Copilot selected and choose Add channel. See agent in Teams installs it for you; in Microsoft 365 Copilot, type @ and pick the agent.

Prefer per-user sign-in? Choose OAuth 2.0 → Dynamic discovery instead of an API key: each user then signs in to AnythingMCP the first time the agent calls it.

Self-hosting? Use your instance's public HTTPS address instead of https://cloud.anythingmcp.com. Copilot Studio connects from Microsoft's cloud, so localhost does not work.

Available tools

Example prompts

• "Sum up our last processed payroll: gross pay, taxes and net pay per employee."
• "Who is off next week, and which time off requests are still pending?"
• "List our active contractors and what we paid each of them this quarter."
• "How many employees do we have per department, and who joined in the last 90 days?"

FAQ

Which Copilot is this for? Microsoft 365 Copilot at work, through agents built in Copilot Studio. The Microsoft Copilot app for personal accounts has no option to add your own MCP server.

What do I need? A work account with access to Copilot Studio (a license or a trial) to build the agent. People who use it in Microsoft 365 Copilot or Teams need access to the agent: share it with them, or ask an admin to publish it to the organization. If your organization applies data policies to Power Platform connectors, they cover MCP servers too.

The agent doesn't call the tools. Check that the header name is exactly X-API-Key and that the key belongs to the same MCP server as the URL, and make the server description specific: Copilot Studio uses it to decide when to call the server. Publish the agent again after each change; in an open chat, type "start over" to get the new version.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Cursor
• Connect to Gemini
• Connect to Meta Muse