Skip the install. Get this working in under 2 minutes.
Start a free trial on cloud.anythingmcp.com, add the Workday in one click, then point your AI client (Claude, ChatGPT, Copilot or Cursor) at the generated MCP endpoint. No Docker, no git clone, zero engineering experience required.
Summary
Give your AI read access to Workday HCM through your own API client: search workers and their staffing, direct reports, supervisory organizations and members, job profiles and positions, time off balances, time off entries, leaves of absence and job postings. Read-only.
Try asking
Example prompts for Workday
Click any prompt to copy it. Paste into Claude, ChatGPT, Cursor, Gemini, Copilot or OpenClaw to run it against this connector.
Claude is AI and can make mistakes. Please double-check responses.
💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Workday, paste your credentials, mint an MCP API key and you're done. No Docker, no
git clone, no local server.
Workday + Gemini
Give your AI read access to Workday HCM through your own API client: search workers and their staffing, direct reports, supervisory organizations and members, job profiles and positions, time off balances, time off entries, leaves of absence and job postings. Read-only.
Prerequisites
See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:
WORKDAY_HOST, WORKDAY_TENANT, WORKDAY_CLIENT_ID, WORKDAY_CLIENT_SECRET, WORKDAY_REFRESH_TOKEN
Step 1 — Get credentials
A Workday administrator does this once, in about 15 minutes:
- Create an Integration System User (task Create Integration System User) and add it to an integration security group (task Create Security Group, type Integration System Security Group, unconstrained or limited to the organizations you want to expose).
- Give that group Get (View) access only on the domains the AI should read, for example Worker Data: Public Worker Reports, Reports: Organization, View: Supervisory Organization, Job Profile: View, Worker Position: View, Worker Data: Time Off (Time Off Balances), Worker Data: Time Off (Time Off), Worker Data: Leave of Absence and Job Postings: External. Then run Activate Pending Security Policy Changes.
- Run Register API Client for Integrations: give it a name, tick Non-Expiring Refresh Tokens and add only the scopes you need: Staffing, Organizations and Roles, Jobs & Positions, Time Off and Leave, Recruiting. Copy the Client ID and the Client Secret; the secret is shown only once.
- Run Manage Refresh Tokens for Integrations, choose the Integration System User, then Generate New Refresh Token for the API client and copy it.
- Run View API Clients. The Token Endpoint reads
https://<host>/ccx/oauth2/<tenant>/token: put the host (for examplewd5-services1.myworkday.com, withouthttps://) intoWORKDAY_HOSTand the tenant intoWORKDAY_TENANT. - Paste the client ID, the secret and the refresh token into
WORKDAY_CLIENT_ID,WORKDAY_CLIENT_SECRETandWORKDAY_REFRESH_TOKENand install the connector.
No browser sign-in: AnythingMCP exchanges the non-expiring refresh token for a short-lived access token at your tenant's token endpoint and renews it by itself. Nobody has to log in, and the connector acts as the Integration System User, not as a person.
Read-only: all 16 tools only read. The AI cannot hire, change jobs, enter or approve time off, or edit contact details.
HR data is sensitive: Workday applies the integration user's security groups to every call, so the AI sees exactly what that user may see and nothing more. Time off balances, time off entries and leaves of absence are meant for the worker, their manager or HR; the connector tells the AI to look people up only for a legitimate work reason and never to pass this data on. Leave comments are left out because they can hold health or family details. Compensation, pay slips, benefits, home addresses and national IDs are not part of this connector.
What it reads: workers by name, worker ID or work email with their staffing record, direct reports, supervisory organizations and who fills their positions (vacant ones included), other hierarchies such as companies, cost centers and regions, job profiles and filled positions, time off balances and entries with their status, leaves of absence, and job postings with the full job description.
Test connection: the Test connection button on the connector page can report an error even when the setup is right, because it calls the bare API address and every Workday path contains the tenant. The check that runs at install, a search for one worker, is the one that counts.
Common errors: invalid_grant: the refresh token was revoked or belongs to another API client; generate a new one. invalid_client: wrong client ID or secret. 401: the host or the tenant does not match the token endpoint. 403 or an empty list: the security group lacks the domain, or the API client lacks the scope. 503 Service unavailable usually means the tenant name does not exist on that host.
Not covered: writes of any kind, compensation and payroll, benefits, performance and talent data, candidates and prospects, and Workday Query Language reports.
Step 2 — Install the adapter
curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d
Step 3 — Add the connector in Gemini
Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (
https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide showsYOUR_SERVER_ID.
Gemini CLI reads MCP servers from ~/.gemini/settings.json (on Windows %USERPROFILE%\.gemini\settings.json). Add:
{
"mcpServers": {
"anythingmcp": {
"httpUrl": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
"headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
}
}
}
- Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of
YOUR_MCP_API_KEY. - Save the file and restart
gemini. - Run
/mcpinside Gemini CLI (orgemini mcp listin your shell):anythingmcpshould show as connected. - Start prompting: Gemini CLI can now call the
Workdaytools.
Available tools
| Tool | What it does |
|---|---|
workday_search_workers | Find workers (employees and contingent workers) in Workday by name, worker ID or work email, or page through everyone the integration user… |
workday_get_worker | Get one worker's current staffing record: name, worker ID, worker type, primary job (business title, job profile, supervisory organization… |
workday_list_direct_reports | List the direct reports of a manager: Workday id, name, business title, whether they manage people themselves, supervisory organization… |
workday_list_supervisory_organizations | List supervisory organizations (the teams of the reporting hierarchy): Workday id, name, organization code, whether it is inactive, and its… |
workday_get_supervisory_organization | Get one supervisory organization: name, code, whether it is inactive and its managers |
workday_list_organization_members | List the positions in one supervisory organization and who fills them: position id, business title, worker name and Workday id, job… |
workday_list_organization_types | List the organization types configured in the tenant (for example Company, Cost Center, Region, Supervisory) with their Workday ids |
workday_list_organizations | List the organizations of one type, for example all cost centers or all companies: Workday id and name |
workday_list_job_profiles | List job profiles (the generic job definitions positions are based on): Workday id, name and whether it is inactive |
workday_get_job_profile | Get one job profile: name, default job title, summary and job description, job level, management level, job category, job families, whether… |
workday_list_jobs | List jobs (filled positions) across the tenant: position id, business title, the worker who fills it, job profile, job type, supervisory… |
workday_get_time_off_balances | Get a worker's absence balances: per time off plan, absence table or leave type the balance (quantity) and its unit (hours or days), as of… |
workday_list_time_off_entries | List a worker's time off entries (requested and taken days or hours) in a date range: date, time off type, quantity and unit, status… |
workday_list_leaves_of_absence | List a worker's leaves of absence: leave type, status, first day of leave, last day of work, estimated and actual last day of leave, and… |
workday_list_job_postings | List job postings (open jobs posted from job requisitions): Workday id, title, job site, start and end date, primary location, time type… |
workday_get_job_posting | Get one job posting with its full job description, plus title, job site, dates, locations, time type, job type, remote type and the… |
Example prompts
- "Who reports directly to Maria Schneider, and which of them manage a team themselves?"
- "Show the supervisory organization Sales DACH with its managers and every position in it, including the vacant ones."
- "I am Lukas Weber's manager. How many vacation days does he have left this year, and are any of his time off requests still waiting for approval?"
- "List our open job postings for software engineers with location, remote type and the external link."
- "Compare the job profiles Senior Software Engineer and Staff Engineer: job level, management level and job family."
FAQ
Where does Gemini CLI look for MCP servers? In ~/.gemini/settings.json for your user, or in .gemini/settings.json inside a project. gemini mcp list shows each server and whether it connects.
Next steps
Was this guide helpful?
