Why are we doing MCP?

MCP is a protocol that lets agents discover and execute tool capabilities autonomously, based on user intent — as opposed to an API, which requires explicit, manual calls. MCP connectors let an agent select and trigger whichever tool it needs on its own, rather than a person or system calling a specific endpoint by hand.

What are we exposing?

Five tools are on for every tenant that has MCP enabled:

• Career Paths
• Course Search
• Jobs Search
• Profile Skills (view, add, remove, and highlight skills)
• Roles (search roles)

To enable more tools, contact Eightfold.

Two defining properties:

• Identity is per-user. Every request carries a bearer token that resolves to one Eightfold user in one tenant. Tool visibility and every downstream permission check use that user, exactly as the web app would.
• Capability is derived, not granted. Which tools a tenant sees is computed from its existing product entitlements, then re-checked per tool at call time. You cannot grant MCP access to something the tenant isn't already entitled to.

Browse the full list of tools at /docs at https://mcp.eightfold.ai/docs

• The catalog lists every tool, not only the tools on for your tenant. The full catalog is EA only. GA scope includes limited tools and subtools for Talent Management only. To enable another tool, contact Eightfold.
• See the same tool list the server actually exposes, with each tool's description and full input schema.
• Filter with ?scope=talent_management,talent_acquisition. No scope specified defaults to talent management.
• Filter by tool-catalog version with ?version=1.0.0.

Supported clients and requirements

What the Eightfold MCP server does vs. what your AI model handles:

Tool catalog and example use cases

Only the five tools in the release scope are on by default.

Write actions: The profile_skills tool's add, remove, and highlight subtools change data immediately, with no confirmation step on the Eightfold side. Customers should set their AI client to ask before running tools that change data. Highlights are capped at 10 per profile by default.

Example use cases, by area:

• Career development — "What roles can I transition to from my current position?" → 3–5 personalized next-step roles with skill gap analysis.
• Job search and mobility — "Find remote software engineering jobs" → relevant listings with titles, departments, skills, links. "Set up a weekly alert for data analyst positions" → saved search with weekly email notifications.
• Learning and courses — "Find Python courses under 10 hours" → filtered course list with providers, durations, difficulty, enrollment links.
• Managing Profile Skills — removing or adding specific skills.

Production endpoints — use the one matching the tenant's region:

Regions not listed in this table are not supported. However, they can be deployed on request, through a support ticket. A month's notice is preferred.

Data residency follows the region — a request is served, and its audit trail written, in the tenant's own region.

Per-region OAuth endpoints — use the authorize and token URLs matching your tenant's region:

• US: https://app.eightfold.ai/oauth/authorize and https://app.eightfold.ai/oauth/token

• EU: https://app.eightfold-eu.ai/oauth/authorize and https://app.eightfold-eu.ai/oauth/token

• WU: https://app.eightfold-wu.ai/oauth/authorize and https://app.eightfold-wu.ai/oauth/token

• Gov: https://app.eightfold-gov.ai/oauth/authorize and https://app.eightfold-gov.ai/oauth/token

• APAC: https://app.eightfold-ap.ai/oauth/authorize and https://app.eightfold-ap.ai/oauth/token

• Canada: https://app.eightfold-ca.ai/oauth/authorize and https://app.eightfold-ca.ai/oauth/token

The Admin Console doesn't show the MCP URL or the OAuth endpoints. This doc is the only source.

Where it sits in the client ecosystem

It's a standard remote MCP server — point any MCP-compatible client at it: Cursor, Claude Code, VS Code/Copilot, Claude.ai/Desktop, ChatGPT, M365 Copilot/Copilot Studio, or a generic client via the mcp-remote proxy.

FAQs

• Does the AI inherit the user's permissions (role-based access control)?

Yes. The MCP server acts as the signed-in user, through OAuth on that user's behalf. The AI can see and do only what that user can.

• Can admins limit OAuth and MCP scopes?

Yes. Admins register each OAuth client and set its allowed scopes. That list is an enforced ceiling, so a client can't get more. Admins can also turn personal access tokens on or off.

• Is there an audit log of AI actions?

Yes. Every MCP call is logged in its own stream, separate from regular UI activity. Each entry records the user, token, tool, timestamp, and result. Customers can query the log through Data Hub. Data Hub shows MCP tool calls only.

• Are there API rate limits?

Yes. Usage is counted per user and per tenant, against limits set platform-wide. Per-customer limits aren't configurable today.

• What transport does the MCP server use?

Streamable HTTP. The bearer token goes in the Authorization header. Clients can't register themselves automatically (no dynamic client registration), so credentials must be set up by hand.

• What happens to data returned to the AI assistant?

Results are processed under that AI vendor's own data-handling terms, not Eightfold's.

• What errors will clients see?

401 with a WWW-Authenticate header — the bearer token is missing, expired, or invalid. A missing tool in tools/list means the tool isn't enabled for the user or tenant, not a server error. 429 — rate-limited; retry after the Retry-After interval. From the token endpoint: unauthorized_client (the client ID isn't registered or was deleted) and invalid_scope (the requested scope isn't allowed for this client).

• What does the Data Hub audit trail not show?

The mcp_server_log_analytics view holds tools/call rows only, with no arguments and no subtool name. "Add skill" and "remove skill" look the same in the log.

• What if a client secret is lost?

Secrets can't be rotated or retrieved. Delete the client, register a new one, and have users reconnect.