Skip to content

DeskMonitor

by thedeskmonitor.com · remote · no sign-in to list tools · v1.7.3 · published by com.thedeskmonitor

DeskMonitor: 24 workforce-intelligence MCP tools, OAuth 2.1, free demo key included.

Deletes · 3Changes · 4
CompareRegistry entry

24 tools: 3 can delete or cancel things, 4 change things and 17 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http thedeskmonitor https://api.thedeskmonitor.com/api/mcp/v1

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnget_capabilities

    The description contains a 41-character base64 string.

    Matched text

    description: "...(Community=No MCP; Starter/Professional/Business/Enterprise=Yes MCP). Use when a..."

    What this check looks for
  • Warnstart_free_trial

    The server marks "start_free_trial" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "start_free_trial" says "start": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

24 tools

Deletes or cancels 3Claude Code: deny
  • clock_inClock the authenticated user in to start a new work session.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Clock the authenticated user in to start a new work session. Creates a TimeLog entry in DeskMonitor. Use when the user says 'clock me in', 'start my shift', 'I am starting work', or any attendance start phrase. Supports optional GPS coordinates for geofence validation. WARNING: This is a write tool — it mutates DeskMonitor data. Always confirm with the user before calling this tool. Example: tell the user what you are about to do and ask for explicit confirmation before proceeding. Calling clock_in will end any active DeskAgent desktop session for this user (cross-device handover by design). Do NOT call if the user is already clocked in — call get_dashboard_summary first to check status. Returns: { success, clock_in_time, is_within_geofence, matched_office_name, next_tap_due_at }. Requires a user-scoped API key (dm_live_* key bound to a specific user). Disabled in demo mode.

    Annotations the server declares

    • destructiveHint: true
  • clock_outClock the authenticated user out to end their current work session.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Clock the authenticated user out to end their current work session. Finalises the TimeLog and generates gap-fill blocks. Use when the user says 'clock me out', 'end my shift', 'I am done for the day', or any attendance end phrase. WARNING: This is a write tool — it mutates DeskMonitor data. Always confirm with the user before calling this tool. Do NOT call if the user is already clocked out — call get_dashboard_summary first to check status. Returns: { success, clock_in_time, clock_out_time, blocks_generated }. Requires a user-scoped API key. Disabled in demo mode.

    Annotations the server declares

    • destructiveHint: true
  • invite_staffInvite a staff member to join your DeskMonitor workspace by email.No findings

    Why it is in this group

    • The name "invite_staff" says "invite": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Invite a staff member to join your DeskMonitor workspace by email. Use when the user asks to 'add an employee', 'invite a team member', 'send a team invite', 'onboard someone new', or 'invite [name] to my workspace'. The invite is sent by email — the recipient gets a link to set up their account and join as an Employee. Only OwnerAdmin and Admin roles can invite staff. The invitee always joins as an Employee (role is display-only on the invite). WARNING: This is a write tool — it sends a real email invitation and creates a workspace account invitation. Always confirm the email address with the user before calling this tool. Disabled in demo mode. Returns: { status, message, email, name }.

    Annotations the server declares

    • destructiveHint: true
Changes things 4Claude Code: ask
  • ask_workforceUse when the user asks a free-form, open-ended question about their workforce that you are not sure which other tool answers — for example: 'Which team has the highest cost-to-outp…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when the user asks a free-form, open-ended question about their workforce that you are not sure which other tool answers — for example: 'Which team has the highest cost-to-output?', 'How is my team performing?', 'Who should I talk to first?', 'What's the biggest issue today?'. Pass the user's question VERBATIM in the 'question' field — do not paraphrase or summarize. The question is logged as admin-only product telemetry for product improvement purposes. This tool returns routing guidance pointing to the specific DeskMonitor tools most likely to answer the question. After calling this tool, call the suggested tools to retrieve real data. Note: Questions asked via this tool are logged for product improvement (admin-only, tenant-scoped, not employee data).

    Annotations the server declares

    • readOnlyHint: true
  • start_free_trialReturns the DeskMonitor free trial sign-up URL and onboarding instructions.1 finding

    Why it is in this group

    • The name "start_free_trial" says "start": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "start_free_trial" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "start_free_trial" says "start": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Returns the DeskMonitor free trial sign-up URL and onboarding instructions. Use when the user says 'I want to sign up', 'start a free trial', 'how do I get started?', 'create an account', 'I want to use DeskMonitor'. This is an informational tool — it provides the registration URL, not a write action. No authentication required.

    Annotations the server declares

    • readOnlyHint: true
  • switch_to_demoSwitches to DeskMonitor demo mode with synthetic data.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Switches to DeskMonitor demo mode with synthetic data. Returns demo tenant info and suggested queries. Use when the user wants to explore without a real account. Use a dm_demo_* API key to call data tools in demo mode.

    Annotations the server declares

    • readOnlyHint: true
  • switch_to_productionSwitches back to production mode and confirms your real tenant context from your auth token.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Switches back to production mode and confirms your real tenant context from your auth token. Use when the user wants to see their real company data after exploring demo mode.

    Annotations the server declares

    • readOnlyHint: true
Only reads 17Claude Code: allow
  • get_analytics_feature_usageReturns a breakdown of which DeskMonitor MCP tools users are calling most — sourced from the internal McpAuditLogs table, grouped by ToolName (top-N tool call counts for the period…No findings

    Why it is in this group

    • The name "get_analytics_feature_usage" says "get": a word for reading.
    Description, as the server wrote it
    Returns a breakdown of which DeskMonitor MCP tools users are calling most — sourced from the internal McpAuditLogs table, grouped by ToolName (top-N tool call counts for the period). Use when the user asks: 'which MCP tools are most used?', 'which features are most popular?', 'what do AI clients do most in DeskMonitor?', 'show me feature engagement'. Do NOT use for: raw session counts or audience size (use get_analytics_overview), employee-level productivity data (use get_productivity_overview), or real-time attendance data. Auth: requires Admin or OwnerAdmin API key. Not available in demo mode. Returns: feature_areas (list with tool_name and call_count), top_events, period, as_of.

    Annotations the server declares

    • readOnlyHint: true
  • get_analytics_overviewReturns platform-level DeskMonitor analytics — AI/MCP queries served (from the internal McpAuditLogs table), web sessions, active unique visitors (1-day, 7-day, 28-day windows) and…No findings

    Why it is in this group

    • The name "get_analytics_overview" says "get": a word for reading.
    Description, as the server wrote it
    Returns platform-level DeskMonitor analytics — AI/MCP queries served (from the internal McpAuditLogs table), web sessions, active unique visitors (1-day, 7-day, 28-day windows) and top referring sources (from Cloudflare Web Analytics when configured). Use when the user asks: 'how many users does DeskMonitor have?', 'show me traffic stats', 'how many AI queries were served?', 'how many people are using DeskMonitor?', or any question about platform-level usage counts or audience size. Do NOT use for: per-tenant employee data (use get_dashboard_summary), individual timesheet data (use list_my_timesheet), or real-time attendance (use get_workload_alerts). Auth: requires an Admin or OwnerAdmin API key. Not available in demo mode. Returns: active_users_1d, active_users_7d, active_users_28d, sessions_in_period, ai_queries_served_in_period, top_sources (up to 5), period, as_of. Web traffic fields are 0 when Cloudflare Analytics is not configured (AI query count is always present).

    Annotations the server declares

    • readOnlyHint: true
  • get_analytics_questionsReturns demand intelligence captured from ask_workforce calls: recent verbatim admin questions, top question themes with counts, and the most-requested 'period' argument values acr…No findings

    Why it is in this group

    • The name "get_analytics_questions" says "get": a word for reading.
    Description, as the server wrote it
    Returns demand intelligence captured from ask_workforce calls: recent verbatim admin questions, top question themes with counts, and the most-requested 'period' argument values across all tools. Use when the admin asks: 'What questions have I asked?', 'What am I asking most?', 'What data am I looking for?', 'Show me my question history', 'What features am I using most?'. Auth: requires Admin or OwnerAdmin role. Not available in demo mode. Tenant-scoped — only returns this tenant's data.

    Annotations the server declares

    • readOnlyHint: true
  • get_capabilitiesReturns a structured list of DeskMonitor AI capabilities grouped by user role AND plan entitlements.1 finding

    Why it is in this group

    • The name "get_capabilities" says "get": a word for reading.

    Findings

    • Warn

      The description contains a 41-character base64 string.

      Matched text

      description: "...(Community=No MCP; Starter/Professional/Business/Enterprise=Yes MCP). Use when a..."

      What this check looks for
    Description, as the server wrote it
    Returns a structured list of DeskMonitor AI capabilities grouped by user role AND plan entitlements. Includes MCP / AI assistant plan entitlements (Community=No MCP; Starter/Professional/Business/Enterprise=Yes MCP). Use when a new user asks 'what can I ask you?', 'what can DeskMonitor do?', 'show me all commands', 'what AI features are available?', 'which plan includes MCP?', 'do I need a paid plan for AI access?', or any capability-discovery or plan-entitlement question. Returns role-appropriate command examples, plan entitlements, and the public capabilities page URL. No authentication required.

    Annotations the server declares

    • readOnlyHint: true
  • get_dashboard_summaryReturns the dashboard KPIs for the current user — hours worked today, team productivity score, pending approvals, active headcount.No findings

    Why it is in this group

    • The name "get_dashboard_summary" says "get": a word for reading.
    Description, as the server wrote it
    Returns the dashboard KPIs for the current user — hours worked today, team productivity score, pending approvals, active headcount. Use when the user asks 'how is my team today?', 'am I clocked in?', 'what's my summary?'. Do NOT use for historical timesheet data — use list_my_timesheet for that.

    Annotations the server declares

    • readOnlyHint: true
  • get_data_dictionaryReturns the schema of queryable data — what fields exist, their meaning, and which tools expose them.No findings

    Why it is in this group

    • The name "get_data_dictionary" says "get": a word for reading.
    Description, as the server wrote it
    Returns the schema of queryable data — what fields exist, their meaning, and which tools expose them. Includes the RetentionPolicy entity — how long screenshots and monitoring data are kept per plan. Use when the user asks 'what data exists?', 'what fields are available?', 'what is a productivity score?', or 'what is the data retention policy?'. NOT for querying live data — use the analytics tools for live results.

    Annotations the server declares

    • readOnlyHint: true
  • get_demo_scenariosReturns 5 guided scenario walkthroughs using the demo tenant's synthetic data.No findings

    Why it is in this group

    • The name "get_demo_scenarios" says "get": a word for reading.
    Description, as the server wrote it
    Returns 5 guided scenario walkthroughs using the demo tenant's synthetic data. Use when the user wants to see example queries or guided tours of DeskMonitor capabilities.

    Annotations the server declares

    • readOnlyHint: true
  • get_employee_detailsReturns the full profile for a specific employee including role, team, clock-in status, and recent activity.No findings

    Why it is in this group

    • The name "get_employee_details" says "get": a word for reading.
    Description, as the server wrote it
    Returns the full profile for a specific employee including role, team, clock-in status, and recent activity. Use when the user asks about ONE specific person. Use list_employees for multiple people. Use 'me' as employee_id for the authenticated user's own profile.

    Annotations the server declares

    • readOnlyHint: true
  • get_pricing_and_plansReturns DeskMonitor pricing plans and subscription details including MCP / AI access entitlement per plan, and per-plan retention periods for screenshots and monitoring data.No findings

    Why it is in this group

    • The name "get_pricing_and_plans" says "get": a word for reading.
    Description, as the server wrote it
    Returns DeskMonitor pricing plans and subscription details including MCP / AI access entitlement per plan, and per-plan retention periods for screenshots and monitoring data. Plans: Community (free, no MCP), Starter ($14/mo, MCP included), Professional ($27/mo, MCP included), Business ($51/mo, MCP included), Enterprise (Contact Sales — no public price). Use when the user asks 'how much does DeskMonitor cost?', 'what plans are available?', 'is there a free trial?', 'what\'s the pricing?', 'which plan has MCP?', 'what is the Enterprise price?', 'how long are screenshots kept?', 'what is the data retention policy?'. Returns plan names, features, pricing, retention periods, and pricing page URL. Safe to call without authentication.

    Annotations the server declares

    • readOnlyHint: true
  • get_productivity_overviewReturns productivity scores and active/idle time ratios for an employee or team.No findings

    Why it is in this group

    • The name "get_productivity_overview" says "get": a word for reading.
    Description, as the server wrote it
    Returns productivity scores and active/idle time ratios for an employee or team. Use when the user asks 'what\'s my productivity score?', 'how productive was the team?', or 'show me active vs idle time'. Employee sees own data only. Manager+ can query other team member IDs. Privacy: scoring is category-based (app-usage duration only) -- DeskMonitor does NOT track keystrokes, content, or individual URLs browsed. The response always includes a privacy_note field with this clarification.

    Annotations the server declares

    • readOnlyHint: true
  • get_started_guideReturns a role-scoped welcome message and curated sample questions to help you get started with DeskMonitor AI.No findings

    Why it is in this group

    • The name "get_started_guide" says "get": a word for reading.
    Description, as the server wrote it
    Returns a role-scoped welcome message and curated sample questions to help you get started with DeskMonitor AI. Use when a new user asks 'what can I do?', 'what can I ask?', or 'how do I get started?' Call this first when connecting. Do NOT use for querying live workforce data.

    Annotations the server declares

    • readOnlyHint: true
  • get_workload_alertsReturns workload alerts — team members with unusual hours, employees not yet clocked in, timesheet gaps.No findings

    Why it is in this group

    • The name "get_workload_alerts" says "get": a word for reading.
    Description, as the server wrote it
    Returns workload alerts — team members with unusual hours, employees not yet clocked in, timesheet gaps. Use when the manager asks 'who needs attention?', 'any anomalies today?', 'any warnings?', or 'are there any issues?'.

    Annotations the server declares

    • readOnlyHint: true
  • list_employeesLists employees visible to the current user based on their role.No findings

    Why it is in this group

    • The name "list_employees" says "list": a word for reading.
    Description, as the server wrote it
    Lists employees visible to the current user based on their role. Supports pagination and name search. Use when the user asks 'who is on my team?', 'list all employees', or wants a roster. Use get_employee_details for information about ONE specific person.

    Annotations the server declares

    • readOnlyHint: true
  • list_my_timesheetReturns the authenticated user's time log entries for a date range.No findings

    Why it is in this group

    • The name "list_my_timesheet" says "list": a word for reading.
    Description, as the server wrote it
    Returns the authenticated user's time log entries for a date range. Use when the user asks 'how many hours have I worked?', 'show me my timesheet', or 'what did I work on yesterday?'. Cannot query another person's timesheet — use summarize_team_hours for team-level hours.

    Annotations the server declares

    • readOnlyHint: true
  • list_pending_approvalsReturns timesheets pending approval in the manager's team.No findings

    Why it is in this group

    • The name "list_pending_approvals" says "list": a word for reading.
    Description, as the server wrote it
    Returns timesheets pending approval in the manager's team. Requires Manager role or above. Use when the manager asks 'show me pending approvals', 'who needs sign-off?', or 'any outstanding timesheets?'. Read-only -- this tool LISTS pending items only; it cannot approve them. To approve, direct the user to the DeskMonitor dashboard: https://thedeskmonitor.com/timesheets/pending

    Annotations the server declares

    • readOnlyHint: true
  • list_recent_activityReturns a daily aggregate activity feed scoped to the authenticated user, including clock events, timesheet submissions, and approval actions.No findings

    Why it is in this group

    • The name "list_recent_activity" says "list": a word for reading.
    Description, as the server wrote it
    Returns a daily aggregate activity feed scoped to the authenticated user, including clock events, timesheet submissions, and approval actions. Use when the user asks 'show me recent activity', 'what happened today?', or 'what did I do yesterday?'. Not a real-time stream — data reflects completed events within the selected time window.

    Annotations the server declares

    • readOnlyHint: true
  • summarize_team_hoursAggregates hours worked by the manager's team for a given period.No findings

    Why it is in this group

    • The name "summarize_team_hours" says "summarize": a word for reading.
    Description, as the server wrote it
    Aggregates hours worked by the manager's team for a given period. Requires Manager role or above. Use when the manager asks 'how many hours did my team work this week?', 'show me team hours', or 'who worked the most hours?'. Do NOT use for an individual employee's timesheet — use list_my_timesheet for personal timesheets.

    Annotations the server declares

    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.7.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http thedeskmonitor https://api.thedeskmonitor.com/api/mcp/v1

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__thedeskmonitor__get_started_guide",
      "mcp__thedeskmonitor__get_data_dictionary",
      "mcp__thedeskmonitor__get_demo_scenarios",
      "mcp__thedeskmonitor__get_dashboard_summary",
      "mcp__thedeskmonitor__list_employees",
      "mcp__thedeskmonitor__get_employee_details",
      "mcp__thedeskmonitor__list_my_timesheet",
      "mcp__thedeskmonitor__summarize_team_hours",
      "mcp__thedeskmonitor__list_pending_approvals",
      "mcp__thedeskmonitor__list_recent_activity",
      "mcp__thedeskmonitor__get_workload_alerts",
      "mcp__thedeskmonitor__get_productivity_overview",
      "mcp__thedeskmonitor__get_capabilities",
      "mcp__thedeskmonitor__get_pricing_and_plans",
      "mcp__thedeskmonitor__get_analytics_questions",
      "mcp__thedeskmonitor__get_analytics_overview",
      "mcp__thedeskmonitor__get_analytics_feature_usage"
    ],
    "ask": [
      "mcp__thedeskmonitor__switch_to_demo",
      "mcp__thedeskmonitor__switch_to_production",
      "mcp__thedeskmonitor__start_free_trial",
      "mcp__thedeskmonitor__ask_workforce"
    ],
    "deny": [
      "mcp__thedeskmonitor__clock_in",
      "mcp__thedeskmonitor__clock_out",
      "mcp__thedeskmonitor__invite_staff"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as thedeskmonitor. Review it before you use it.