MCP server

OfficeHero runs a Model Context Protocol (MCP) server so AI agents can call read-only OfficeHero tools on a company's behalf.

Status: limited availability. Access tokens for the MCP server are issued by OfficeHero on request — there is no self-service screen for them yet. Contact support. For your own systems, use the Integrations API instead.

Endpoint and transport

https://mcp.officehero.io/mcp speaks MCP over Streamable HTTP (JSON-RPC 2.0 on POST /mcp). The server does not offer a server-initiated stream: GET /mcp answers 405. Supported methods: initialize, ping, tools/list, tools/call.

POST /mcp HTTP/1.1
Host: mcp.officehero.io
Authorization: Bearer oht_…
X-OH-Tenant: northwind-transport
Content-Type: application/json

{ "jsonrpc": "2.0", "id": 1, "method": "initialize",
  "params": { "protocolVersion": "2025-06-18", "capabilities": {},
              "clientInfo": { "name": "my-agent", "version": "1.0" } } }

Credentials

MCP requests carry an oht_… access token and the company in X-OH-Tenant (its slug or id). These tokens are not Integrations API keys: an oh_live_ key is refused by the MCP server, and an oht_ token is refused by the Integrations API.

Which tools an agent sees depends on two things, checked on every call: the token’s scopes must name the tool, and the person who created the token must still hold the permission the tool needs. Removing that person’s access removes the agent’s.

Tools

The tools are read-only (list, get, search, summarise, recent). Which tool families are switched on depends on the deployment — call tools/list and use what it returns rather than assuming a fixed set.

Legacy REST surface

Clients that do not speak JSON-RPC can use the same tools over plain HTTP with the same headers:

Limits

Requests are rate-limited per caller; when throttled you get 429 with Retry-After.