Deel MCP connector for AI agents

CALL ANY TOOL

Run global payroll and HR workflows: people records, contracts, invoices, timesheets, time off, and payroll cycles, every call scoped per user.

deelmcp_org_person_list

List people

Return a paginated list of people records in the organization, filterable by search term, teams, and custom fields.

Parameters

Name

Type

Required

Description

band_placements

array

Optional

Employee's current band placement.

comparative_ratios_from

number

Optional

Employee's minimum band placement

comparative_ratios_to

number

Optional

Employee's maximum band placement

fields

array

Optional

Pick the fields you want to see in the response in order to avoid a bloated people list output. Supports dot notation (e.g., 'employments[0].contract_status') to access nested fields.

hiring_statuses

array

Optional

Employee's current hiring status.

hiring_types

array

Optional

Filter people by hiring types

limit

integer

Optional

Return a page of results with given number of records.

offset

integer

Optional

Return a page of results with given number of records.

person_statuses

array

Optional

Filter people by person (worker profile) lifecycle status.

search

string

Optional

Include a contract if by name or contractor name contains given search term.

sort_by

string

Optional

Sort people by given field name.

sort_order

string

Optional

Order direction of results; ascending or descending.

teams

array

Optional

Filter the results based on the team(group) the users contract is associated with

deelmcp_contract_list

List contracts

deelmcp_contract_get

Get contract

deelmcp_invoice_list

List invoices

deelmcp_timesheet_list

List timesheets

deelmcp_timeoff_request_list

List time-off requests

deelmcp_timeoff_request_create

Create time-off request

deelmcp_payroll_cycle_list

List payroll cycles

Build your Agent

Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.

import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Deel tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"], toolNames: [
    "deelmcp_org_person_list",
    "deelmcp_contract_list",
    "deelmcp_timeoff_request_list"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Who is on PTO next week?" }] });

import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "List active contractor contracts in Germany." }],
  tools,
});

// Execute the tool call with the user's vaulted Deel credential
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");

import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Which timesheets are pending review this week?" }],
  tools,
});

// Tool call runs with the user's vaulted Deel credential
await sk.tools.executeTool(msg.content, "user_123");

import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"] }, pageSize: 100,
});

const agent = new Agent({
  name: "deel_hr_agent",
  model: "gemini-2.5-pro",
  instruction: "Answer HR and payroll questions for the signed-in user.",
  tools,
});

await agent.run("Which payroll cycles close this month?");

Try these prompts

Copy any prompt into your agent. Each maps directly to a Deel tool. Click to copy, paste into your agent, done.

People and contracts

Copy the prompt

Copied

List everyone in the org and the team they belong to.

Copy the prompt

Copied

Show all active contractor contracts in Germany.

Copy the prompt

Copied

Pull the full contract record for Lena, including compensation.

Time and attendance

Copy the prompt

Copied

Which timesheets are pending review this week?

Copy the prompt

Copied

File a time-off request for Marco from March 3 to March 7.

Copy the prompt

Copied

List all approved time-off requests for Q2.

Payroll and invoices

Copy the prompt

Copied

Which payroll cycles close this month?

Copy the prompt

Copied

Show paid invoices for February.

Copy the prompt

Copied

List open payroll cycles for the UK entity.

SEE HOW AUTH WORKS

Your users connect once. Their Deel credentials stay vaulted, every call is scope-checked, and every action is logged.

1

Authorize

Your user connects

Deel MCP

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

2

Store

Their

Deel MCP

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

3

Resolve

When your agent calls a

Deel MCP

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

4

Audit

Every

Deel MCP

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same per-user auth pattern across other finance and HR connectors.

No items found.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

Other connector libraries treat auth as a demo afterthought. Scalekit starts with identity, scope enforcement, and audit. Connectors follow.

01.

Shared tokens break per-user analytics

A shared Deel key looks fine in a demo. In production every contract lookup and time-off approval looks like one service account, and you cannot tell who touched a worker's payroll record. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.

// shared key
audit → bot_service_account

// scalekit
audit → user_abc ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

Deel today. Ten connectors tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access Deel as the user or through a shared key?

As the user. Scalekit resolves the credential of the person who triggered the agent at request time, so every contract lookup and time-off change in your audit trail is attributed to a real user, not a shared service account.

Where is the Deel API key stored?

In an AES-256 encrypted vault with per-tenant namespacing. Keys are resolved at request time, never enter LLM context, and can be revoked from one dashboard.

Can I limit what the agent does in Deel?

Yes. Filter by tool name in listScopedTools to expose only what you want, for example read-only listing without timeoff_request_create. Scalekit also enforces scope checks before every API call.

What happens when a user revokes access?

The credential is invalidated at the next tool call. The call fails closed, other users' connections are unaffected, and the revocation is logged in the audit chain.

Compensation data is sensitive. Who can the agent see?

Only what the connected user's own Deel role permits. Scalekit resolves that user's credential per call, so contract and payroll reads like contract_get and payroll_cycle_list inherit Deel's role permissions, and every read is logged with the user's identity.

Deel MCP

Tools your HR ops agent reaches for on Deel, scoped per user.