Hubity MCP server: connect any assistant

Hubity runs a remote Model Context Protocol (MCP) server at https://hubity.io/api/mcp. A connected assistant can bill the month (preview each invoice, then draft them for review), read projects, tasks, people, clients and deals, proposals and invoices, meetings, and time off, and search the company knowledge base, always limited to what the signed-in person may see.

Three tools change data: log_time_entry records time, create_invoice_from_proposal turns an accepted proposal into a draft invoice, and create_month_invoice_drafts drafts a month's invoices for review. None of them sends anything to a client. All three need write access (mcp:write), which is granted only when the person connecting approves it on the Hubity consent screen. Every other tool only reads.

The server implements MCP 2026-07-28 over Streamable HTTP (stateless requests, server/discover) and still accepts clients that open with the 2025-11-25 initialize handshake. OAuth 2.1 with PKCE is the primary sign-in, and every connection shows a Hubity consent screen listing exactly what the assistant may do. Read-only access codes, created in The Hub under Integrations, work for command-line clients and scripts.

Supported clients: Claude, Claude Desktop, Claude Code, ChatGPT, Microsoft Copilot (through Copilot Studio), Grok, Gemini, Cursor, VS Code, and Windsurf. Each signs you in to Hubity with OAuth and shows the consent screen, where you choose Allow access or Deny.

Claude and Claude Desktop

In Claude, open Customize → Connectors → Add → Add custom connector and paste https://hubity.io/api/mcp (on Team and Enterprise, an owner adds it under Organization settings → Connectors first). Claude Desktop uses the same connectors. Claude signs you in to Hubity and shows the consent screen; allow access and the tools appear.

To use a read-only access code in Claude Desktop instead, add a bridge entry to claude_desktop_config.json (requires Node.js):

 {
  "mcpServers": {
    "hubity": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://hubity.io/api/mcp",
               "--header", "Authorization: Bearer <access code>"]
    }
  }
}

Claude Code

Claude Code (the CLI) registers servers with a single command. To connect with browser sign-in (no code to manage):

 claude mcp add --transport http hubity https://hubity.io/api/mcp

Then run /mcp inside Claude Code and approve the Hubity sign-in. To use a read-only access code instead (handy for scripts and CI), pass it as a header:

 claude mcp add --transport http hubity https://hubity.io/api/mcp \
  --header "Authorization: Bearer <access code>"

Add --scope user to make the connection available across all your projects, or commit a project .mcp.json to share it with your team. Verify with claude mcp list.

ChatGPT

1. In ChatGPT's settings, turn on Developer mode. On a Business, Enterprise or Edu workspace, an admin may need to allow it first.
2. Create a new app or connector, name it Hubity, paste https://hubity.io/api/mcp as the MCP server URL, and choose OAuth for authentication.
3. ChatGPT signs you in to Hubity and shows the consent screen. Allow access and the tools appear in your chats.

ChatGPT connects with read access first. The first time you ask it to log time or draft an invoice, Hubity asks you to allow write access; approve it on the consent screen and the action runs.

Microsoft Copilot

In Copilot Studio, open the agent, then Tools → Add a tool → New tool → Model Context Protocol. Name it Hubity, paste https://hubity.io/api/mcp as the server URL, and choose OAuth 2.0 with Dynamic discovery. Create a new connection, sign in to Hubity, allow access, then add the tool to the agent. Step by step: Hubity for Copilot.

Grok

Go to grok.com/connectors, choose New Connector, then Custom, and paste https://hubity.io/api/mcp. Grok signs you in to Hubity and shows the consent screen. On a Grok Business or Enterprise team, an admin adds connectors first.

Gemini

At gemini.google.com, open Settings → Connected Apps, choose Add a custom app, paste https://hubity.io/api/mcp, and select Next. Hubity registers Gemini automatically, so no client credentials are needed; sign in and allow access. Google currently offers custom apps only in English, to people 18 or over in the US using a personal Google Account.

Cursor

Add Hubity to ~/.cursor/mcp.json, then sign in when Cursor prompts:

 {
  "mcpServers": {
    "hubity": { "url": "https://hubity.io/api/mcp" }
  }
}

VS Code

Add Hubity to .vscode/mcp.json, then sign in when VS Code prompts:

 {
  "servers": {
    "hubity": { "type": "http", "url": "https://hubity.io/api/mcp" }
  }
}

Windsurf

Add Hubity to ~/.codeium/windsurf/mcp_config.json, then sign in when Windsurf prompts:

 {
  "mcpServers": {
    "hubity": { "serverUrl": "https://hubity.io/api/mcp" }
  }
}

Endpoint

 POST https://hubity.io/api/mcp
Content-Type: application/json
Authorization: Bearer <access code>
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search_knowledge

Discovery

• /.well-known/mcp/server-card.json: the server card, with every tool and its input schema, plus the prompts and resources. Also served at /.well-known/mcp.
• /api/mcp/server.json: the Official MCP Registry entry.
• /.well-known/oauth-authorization-server: OAuth 2.1 authorization server metadata (RFC 8414).
• /.well-known/oauth-protected-resource/api/mcp: protected resource metadata for the MCP endpoint (RFC 9728).

OAuth 2.1 (recommended)

• Authorization endpoint: https://hubity.io/api/mcp/oauth/authorize
• Token endpoint: https://hubity.io/api/mcp/token
• Client registration: Client ID Metadata Documents (an HTTPS client_id, preferred), or RFC 7591 registration for public clients at https://hubity.io/api/mcp/oauth/register
• Every authorization shows a consent screen; write access (mcp:write) is granted only there
• PKCE is required; code_challenge_method must be S256
• Refresh tokens rotate on every use

Access codes

For scripts and command-line use, an admin creates a read-only, company-scoped access code at The Hub → Integrations → Connect an AI assistant. A code can be scoped and given an expiry when it is created, and turned off at any time. Every request is recorded in the company activity log.

Scopes

• knowledge:read: search and read company knowledge documents
• mcp:read: read access across projects, tasks, staff, invoicing, CRM, meetings, and time off
• mcp:write: the three write tools (time entries, invoices from accepted proposals, a month's invoice drafts)

The authoritative tool list, with each tool's input schema, is tools/list over the live MCP protocol or the tools array in the server card. Categories:

Every list tool except list_pto_requests also reads one record in full when given its id from an earlier result, and search_knowledge does the same for one document.

Knowledge

• search_knowledge

Projects & tasks

• list_projects, get_project_profitability
• list_tasks

Staff & organization

• list_staff, including who each person reports to
• list_pto_requests

Finance & CRM

• list_invoices
• list_proposals, create_invoice_from_proposal (write, needs mcp:write)
• list_deals
• forecast_cash_flow, get_utilization_report
• preview_month_billing, what billing a month would draft; create_month_invoice_drafts (write, needs mcp:write)

Meetings

• list_meetings

Time

• log_time_entry (write, needs mcp:write)

Beyond tools, the server offers ready-made prompts for the jobs a firm runs (for example, billing the month, month-end work in progress, collections, who is over capacity, or a standup) and resources an assistant can read directly for context, such as today's meetings, a knowledge document, or a single project. Both follow the same permissions as the tools.

The current lists are prompts/list, resources/list and resources/templates/list over the live MCP protocol, and the prompts, resources and resourceTemplates arrays in the server card.

• Every response carries the negotiated MCP-Protocol-Version header (2026-07-28 or 2025-11-25).
• Every write is recorded in the company activity log with the person who authorized it.
• Tenant isolation: each connection is scoped to a single company; cross-company reads are rejected at the permission layer.
• Encryption: data is encrypted when stored (AES-256) and in transit (TLS).
• Sensitive content (archived, personal-visibility, encrypted-at-field-level) is never returned over MCP.
• Rate limits: 1,000 requests per hour per connection by default, with higher negotiated budgets for enterprise companies. Anonymous discovery and OAuth endpoints carry their own lower per-IP limits to deter abuse.

• General support: [email protected]
• Security issues: [email protected] (90-day coordinated disclosure)
• Abuse: [email protected]
• Status: hubity.io/status
• Privacy policy: /privacy
• Terms: /terms