workday-mcp 0.1.0

package/.claude-plugin/marketplace.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "workday-mcp",
+  "owner": {
+    "name": "Chris Hall",
+    "email": "chris.c.hall@gmail.com"
+  },
+  "metadata": {
+    "description": "Read-only MCP server for Workday — fetch your tasks, pay, benefits and compensation data. Routes through the user's signed-in Workday tab via the fetchproxy browser extension, reusing their existing SSO-authenticated session.",
+    "version": "0.1.0"
+  },
+  "plugins": [
+    {
+      "name": "workday-mcp",
+      "displayName": "Workday",
+      "source": "./",
+      "description": "Read-only MCP server for Workday — fetch tasks, pay, benefits and compensation through your signed-in session",
+      "version": "0.1.0",
+      "author": {
+        "name": "Chris Hall"
+      },
+      "homepage": "https://github.com/chrischall/workday-mcp",
+      "repository": "https://github.com/chrischall/workday-mcp",
+      "license": "MIT",
+      "keywords": ["workday", "hr", "payroll", "benefits", "mcp"],
+      "category": "productivity"
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -0,0 +1,16 @@
+{
+  "name": "workday-mcp",
+  "displayName": "Workday",
+  "version": "0.1.0",
+  "description": "Read-only Workday access for Claude — fetch your tasks, pay, benefits and compensation through your signed-in session",
+  "author": {
+    "name": "Chris Hall",
+    "email": "chris.c.hall@gmail.com"
+  },
+  "homepage": "https://github.com/chrischall/workday-mcp",
+  "repository": "https://github.com/chrischall/workday-mcp",
+  "license": "MIT",
+  "keywords": ["workday", "hr", "payroll", "benefits", "mcp"],
+  "skills": "./SKILL.md",
+  "mcp": "./.mcp.json"
+}

package/.mcp.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "workday": {
+      "command": "node",
+      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/bundle.js"]
+    }
+  }
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Hall
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,59 @@
+# workday-mcp
+
+Read-only MCP server for [Workday](https://www.workday.com/). Fetches your
+Workday tasks and data cards — pay, benefits, compensation — and returns them as
+structured JSON. Every request routes through your own signed-in
+`*.myworkday.com` tab via the [fetchproxy](https://github.com/chrischall/fetchproxy)
+browser extension, reusing your existing SSO-authenticated session.
+
+> ⚠️ Workday gives employees no personal API. This server reads the same internal
+> `*.htmld` endpoints the Workday web app calls, dispatched through your own
+> signed-in browser tab. It is **read-only** and touches only your own data.
+> Check your employer's acceptable-use policy. Use at your own discretion.
+>
+> 🤖 This project was developed and is maintained by AI (Claude Code).
+
+## Why a bridge instead of the official API?
+
+The official Workday REST/SOAP API requires a tenant administrator to register
+an OAuth API client + Integration System User — an employee can't self-provision
+it. Tenants also sit behind corporate SSO (Ping/Okta/Entra) with MFA, so there's
+no server-side login. The only surface an employee can reach for their own data
+is their **live browser session**, which is what this server relays.
+
+## Install
+
+See [SKILL.md](./SKILL.md) for full setup. In brief:
+
+```json
+{
+  "mcpServers": {
+    "workday": {
+      "command": "npx",
+      "args": ["-y", "workday-mcp"],
+      "env": { "WORKDAY_TENANT": "your-tenant-slug" }
+    }
+  }
+}
+```
+
+Then install the fetchproxy extension and sign into Workday in your browser.
+
+## Tools
+
+| Tool | What it does |
+| --- | --- |
+| `workday_get_task` | Read a Workday task/data card by path → title, fields, references, related tasks, export links |
+| `workday_healthcheck` | Verify the bridge + session end-to-end with an actionable hint |
+
+## Development
+
+```bash
+npm install
+npm test          # vitest
+npm run build     # tsc --noEmit + esbuild bundle → dist/bundle.js
+```
+
+The widget-tree parser (`src/parse.ts`) is the durable core; see
+[docs/WORKDAY-API.md](./docs/WORKDAY-API.md) for the captured endpoint shapes and
+schema. License: MIT.

package/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: workday-mcp
+description: Read your Workday HR data — tasks, pay, benefits, compensation — via MCP through your own signed-in session. Triggers on phrases like "check my workday", "what's in my workday", "read my workday compensation", "my workday benefits", "pull this workday page", or any request involving your Workday tasks, pay, or benefits. Read-only. Requires workday-mcp installed and the fetchproxy extension active (see Setup below).
+---
+
+# workday-mcp
+
+Read-only MCP server for Workday. Fetches your Workday tasks and data cards
+(pay, benefits, compensation) and returns them as structured JSON. Every request
+routes through your own signed-in `*.myworkday.com` tab via the fetchproxy
+browser extension, reusing your existing SSO-authenticated session.
+
+- **npm:** [npmjs.com/package/workday-mcp](https://www.npmjs.com/package/workday-mcp)
+- **Source:** [github.com/chrischall/workday-mcp](https://github.com/chrischall/workday-mcp)
+
+> ⚠️ Workday does not give employees a personal API. This server reads the same
+> internal `*.htmld` endpoints the Workday web app calls, dispatched through your
+> own signed-in browser tab via the fetchproxy extension. It is **read-only** and
+> touches only your own data. Check your employer's acceptable-use policy. Use at
+> your own discretion.
+
+## Setup
+
+### 1. Install workday-mcp
+
+`.mcp.json` (project) or `~/.claude/mcp.json` (global):
+
+```json
+{
+  "mcpServers": {
+    "workday": {
+      "command": "npx",
+      "args": ["-y", "workday-mcp"],
+      "env": {
+        "WORKDAY_TENANT": "your-tenant-slug",
+        "WORKDAY_HOST": "wd5.myworkday.com"
+      }
+    }
+  }
+}
+```
+
+- `WORKDAY_TENANT` (**required**) — the path segment after the host, e.g. for
+  `https://wd5.myworkday.com/acme` it is `acme`.
+- `WORKDAY_HOST` (optional) — your data-center host; defaults to `wd5.myworkday.com`.
+- `WORKDAY_WS_PORT` (optional) — override the fetchproxy port (default 37149).
+
+### 2. Install the fetchproxy extension (one-time, shared across fetchproxy MCPs)
+
+```bash
+git clone https://github.com/chrischall/fetchproxy
+cd fetchproxy
+npm ci
+npm --workspace=@fetchproxy/extension-chrome run build
+```
+
+Load `fetchproxy/packages/extension-chrome/dist` as an unpacked extension in
+`chrome://extensions`. On the first request you'll be asked to approve a pairing
+code in the extension popup (one-time, per server identity).
+
+### 3. Sign into Workday
+
+Open `https://<host>/<tenant>` in your browser and complete SSO. workday-mcp
+reuses that live session — there is no separate login.
+
+## Tools
+
+- **`workday_get_task`** — read a Workday task or data card by path. Returns
+  title, current user, each section's `label`/`value` fields, navigable
+  `references` (with instance ids + drill-in uris), related tasks, and export
+  links. The path comes from a prior result's `references[].uri` /
+  `relatedTasks[].uri`, or from pasting the URL of a Workday page you have open
+  (a `/{tenant}/d/...` SPA URL is normalized to its data endpoint automatically).
+- **`workday_healthcheck`** — verify the bridge + session end-to-end and get a
+  plain-English hint distinguishing "bridge down" from "extension not connected"
+  from "Workday session expired (re-sign-in)".
+
+## How navigation works
+
+Workday data-card paths carry opaque, page-context-bound tokens, so you don't
+construct them — you **crawl**: open a Workday page you care about, paste its URL
+into `workday_get_task`, then follow the `references[].uri` / `relatedTasks[].uri`
+it returns into deeper tasks.
+
+## Status
+
+v1 is **read-only**. Apps/worklet discovery, typed pay/benefits/compensation
+tools, and (later) `confirm`-gated writes are planned — see `docs/WORKDAY-API.md`.