# com.thedeskmonitor/mcp DeskMonitor: 24 workforce-intelligence MCP tools, OAuth 2.1, free demo key included. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.7.3 - **Author:** com.thedeskmonitor - **License:** Unknown - **Endpoints:** streamable-http https://api.thedeskmonitor.com/api/mcp/v1 - **Source:** https://thedeskmonitor.com/integrations/ai-connect - **Endpoint health:** reachable (last checked 2026-09-12T20:57:24.119Z, 4 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-12T20:57:24.119Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `list_pending_approvals` tool: Links to undeclared domain: thedeskmonitor.com ## Tools 24 declared. Observed from a live `tools/list` probe. - `get_started_guide` — Returns a role-scoped welcome message and curated sample questions to help you get started with DeskMonitor AI. Use when a new user asks 'what can I do?', 'what - `get_data_dictionary` — Returns the schema of queryable data — what fields exist, their meaning, and which tools expose them. Use when the user asks 'what data exists?', 'what fields a - `switch_to_demo` — Switches to DeskMonitor demo mode with synthetic data. Returns demo tenant info and suggested queries. Use when the user wants to explore without a real account - `switch_to_production` — Switches back to production mode and confirms your real tenant context from your auth token. Use when the user wants to see their real company data after explor - `get_demo_scenarios` — Returns 5 guided scenario walkthroughs using the demo tenant's synthetic data. Use when the user wants to see example queries or guided tours of DeskMonitor cap - `get_dashboard_summary` — Returns the dashboard KPIs for the current user — hours worked today, team productivity score, pending approvals, active headcount. Use when the user asks 'how - `list_employees` — Lists employees visible to the current user based on their role. Supports pagination and name search. Use when the user asks 'who is on my team?', 'list all emp - `get_employee_details` — Returns the full profile for a specific employee including role, team, clock-in status, and recent activity. Use when the user asks about ONE specific person. U - `list_my_timesheet` — Returns the authenticated user's time log entries for a date range. Use when the user asks 'how many hours have I worked?', 'show me my timesheet', or 'what did - `summarize_team_hours` — Aggregates hours worked by the manager's team for a given period. Requires Manager role or above. Use when the manager asks 'how many hours did my team work thi - `list_pending_approvals` — Returns timesheets pending approval in the manager's team. Requires Manager role or above. Use when the manager asks 'show me pending approvals', 'who needs sig - `list_recent_activity` — Returns a daily aggregate activity feed scoped to the authenticated user, including clock events, timesheet submissions, and approval actions. Use when the user - `get_workload_alerts` — Returns workload alerts — team members with unusual hours, employees not yet clocked in, timesheet gaps. Use when the manager asks 'who needs attention?', 'any - `get_productivity_overview` — Returns productivity scores and active/idle time ratios for an employee or team. Use when the user asks 'what's my productivity score?', 'how productive was the - `clock_in` — Clock the authenticated user in to start a new work session. Creates a TimeLog entry in DeskMonitor. Use when the user says 'clock me in', 'start my shift', 'I - `clock_out` — Clock the authenticated user out to end their current work session. Finalises the TimeLog and generates gap-fill blocks. Use when the user says 'clock me out', - `invite_staff` — Invite a staff member to join your DeskMonitor workspace by email. Use when the user asks to 'add an employee', 'invite a team member', 'send a team invite', 'o - `get_capabilities` — Returns a structured list of DeskMonitor AI capabilities grouped by user role AND plan entitlements. Includes MCP / AI assistant plan entitlements (Community=No - `get_pricing_and_plans` — Returns DeskMonitor pricing plans and subscription details including MCP / AI access entitlement per plan. Plans: Community (free, no MCP), Starter ($14/mo, MCP - `start_free_trial` — Returns the DeskMonitor free trial sign-up URL and onboarding instructions. Use when the user says 'I want to sign up', 'start a free trial', 'how do I get star - `ask_workforce` — Use when the user asks a free-form, open-ended question about their workforce that you are not sure which other tool answers — for example: 'Which team has the - `get_analytics_questions` — Returns demand intelligence captured from ask_workforce calls: recent verbatim admin questions, top question themes with counts, and the most-requested 'period' - `get_analytics_overview` — Returns platform-level DeskMonitor analytics — AI/MCP queries served (from the internal McpAuditLogs table), web sessions, active unique visitors (1-day, 7-day, - `get_analytics_feature_usage` — Returns a breakdown of which DeskMonitor MCP tools users are calling most — sourced from the internal McpAuditLogs table, grouped by ToolName (top-N tool call c ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp\": {\n \"type\": \"http\",\n \"url\": \"https://api.thedeskmonitor.com/api/mcp/v1\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.thedeskmonitor%2Fmcp - Install plan: https://forgeregistry.com/api/v1/packages/com.thedeskmonitor%2Fmcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.thedeskmonitor%2Fmcp - HTML page: https://forgeregistry.com/registry/com.thedeskmonitor%2Fmcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.