Authentication on the hosted path is enforced only when `MCP_API_KEY` is present — convenient for local development, and a wide-open HR database if you carry that default onto a public URL. Generate a random value and set it in the platform's environment before the first deploy. Locally, the single API key is the whole access story, and it inherits whatever permissions Breathe HR granted it. This is a community project and is not officially supported by Breathe HR.
A Breathe HR server covering the people data an HR question usually needs: who works here, who is off, what the org structure looks like — plus the ability to submit a leave request rather than only read them.
- `list_employees` returns a paginated list with filters, `get_employee` returns one in detail, and `search_employees` finds people by query
- `list_absences` returns absence records with date and type filtering, and `get_employee_absences` narrows to one person
- `create_leave_request` submits a new request
- `get_departments` lists the organisational structure and `get_account_info` returns company account details
An API key from your Breathe HR account — Settings, then Integrations, then API. Install from a checkout with uv: clone the repo and `uv sync`; the client launches `python -m breathe_hr_mcp` through `uv run --directory`, with the key in `BREATHE_HR_API_KEY`. Python 3.12+. A remote deployment is also documented, running under uvicorn behind an `MCP_API_KEY` bearer token — note that when that variable is unset the deployed server accepts unauthenticated requests.
One command plus a key — curl -X POST https://your-service.onrender.com/mcp/ -H Content-Type: application/json -H Authorization: Bearer YOUR_MCP_API_KEY_HERE -d @-, then supply credentials