Deel MCP connector for AI agents

Tools your HR ops agent reaches for on Deel, scoped per user.

CALL ANY TOOL

Run global payroll and HR workflows: people records, contracts, invoices, timesheets, time off, and payroll cycles, every call scoped per user.

deelmcp_get_all_profile_worker_relations

Get all profile worker relations

List of worker relations.

Parameters

Name

Type

Required

Description

hrisProfileOid

string

Required

HrisProfile ID

deelmcp_update_worker_relation_type

Update worker relation type

deelmcp_org_get

Org get

deelmcp_update_worker_relation_type_external_id

Update worker relation type external id

deelmcp_goal_list

Goal list

deelmcp_goal_create

Goal create

deelmcp_goal_update

Goal update

deelmcp_invoice_get

Invoice get

deelmcp_lookup_list

Lookup list

deelmcp_task_update

Task update

deelmcp_contract_get

Contract get

deelmcp_invoice_list

Invoice list

deelmcp_contract_sign

Contract sign

deelmcp_contract_list

Contract list

deelmcp_milestone_get

Milestone get

deelmcp_milestone_list

Milestone list

deelmcp_timesheet_get

Timesheet get

deelmcp_timesheet_list

Timesheet list

deelmcp_contract_create

Contract create

deelmcp_contract_update

Contract update

deelmcp_contract_preview

Contract preview

deelmcp_invoice_download

Invoice download

deelmcp_milestone_create

Milestone create

deelmcp_milestone_delete

Milestone delete

deelmcp_timesheet_create

Timesheet create

deelmcp_timesheet_delete

Timesheet delete

deelmcp_timesheet_review

Timesheet review

deelmcp_timesheet_update

Timesheet update

deelmcp_workflow_trigger

Workflow trigger

deelmcp_it_asset_get

It asset get

Build your Agent

Same auth pattern across LangChain, OpenAI, Anthropic, and Google ADK.

import { ScalekitClient } from "@scalekit-sdk/node";
import { createReactAgent } from "@langchain/langgraph/prebuilt";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

// Deel tools scoped to this user
const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"], toolNames: [
    "deelmcp_org_person_list",
    "deelmcp_contract_list",
    "deelmcp_timeoff_request_list"] },
  pageSize: 100,
});

const agent = createReactAgent({ llm, tools });
await agent.invoke({ messages: [{ role: "user", content: "Who is on PTO next week?" }] });

import OpenAI from "openai";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"] }, pageSize: 100,
});

const res = await openai.chat.completions.create({
  model: "gpt-5",
  messages: [{ role: "user", content: "List active contractor contracts in Germany." }],
  tools,
});

// Execute the tool call with the user's vaulted Deel credential
await sk.tools.executeTool(res.choices[0].message.tool_calls[0], "user_123");

import Anthropic from "@anthropic-ai/sdk";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"] }, pageSize: 100,
});

const msg = await anthropic.messages.create({
  model: "claude-sonnet-5",
  max_tokens: 1024,
  messages: [{ role: "user", content: "Which timesheets are pending review this week?" }],
  tools,
});

// Tool call runs with the user's vaulted Deel credential
await sk.tools.executeTool(msg.content, "user_123");

import { Agent } from "@google/adk/agents";
import { ScalekitClient } from "@scalekit-sdk/node";

const sk = new ScalekitClient(env.SCALEKIT_ENV_URL, env.SCALEKIT_CLIENT_ID, env.SCALEKIT_CLIENT_SECRET);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["deelmcp"] }, pageSize: 100,
});

const agent = new Agent({
  name: "deel_hr_agent",
  model: "gemini-2.5-pro",
  instruction: "Answer HR and payroll questions for the signed-in user.",
  tools,
});

await agent.run("Which payroll cycles close this month?");

Try these prompts

Copy any prompt into your agent. Each maps directly to a Deel tool. Click to copy, paste into your agent, done.

People and contracts

Copy the prompt

Copied

List everyone in the org and the team they belong to.

Copy the prompt

Copied

Show all active contractor contracts in Germany.

Copy the prompt

Copied

Pull the full contract record for Lena, including compensation.

Time and attendance

Copy the prompt

Copied

Which timesheets are pending review this week?

Copy the prompt

Copied

File a time-off request for Marco from March 3 to March 7.

Copy the prompt

Copied

List all approved time-off requests for Q2.

Payroll and invoices

Copy the prompt

Copied

Which payroll cycles close this month?

Copy the prompt

Copied

Show paid invoices for February.

Copy the prompt

Copied

List open payroll cycles for the UK entity.

SEE HOW AUTH WORKS

Your users connect once. Their Deel credentials stay vaulted, every call is scope-checked, and every action is logged.

Authorize

Your user connects

Deel MCP

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

Deel MCP

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

Deel MCP

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

Deel MCP

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

See the same per-user auth pattern across other finance and HR connectors.

People Ops and HR teams

Offer letter routing agent

Drafts the offer in PandaDoc, blocks on the hiring manager's approval in Slack, then emails the candidate their e-signature link. Every call runs as the recruiter who triggered it, never a shared HR bot.

People Ops and HR teams

Performance review collector

Collects review feedback from Airtable and Google Forms scoped to each manager's direct reports, writes per-employee summaries to Notion, and DMs the manager a Slack digest.

Support and Ops Teams

Meeting prep

Pulls agenda, participant context, and open action items before every meeting.

GTM and RevOps Teams

Revenue forecast commentary

Pulls open pipeline from Salesforce and HubSpot, calculates coverage against quota, flags at-risk stages, posts commentary to Slack, and logs every snapshot to Google Sheets.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Shared tokens break per-user analytics

A shared Deel key looks fine in a demo. In production every contract lookup and time-off approval looks like one service account, and you cannot tell who touched a worker's payroll record. Scalekit resolves the credential of the actual user who triggered the agent, never a shared bot.

// shared key
audit → bot_service_account

// scalekit
audit → user_abc ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

Deel today. Ten connectors tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access Deel as the user or through a shared key?

As the user. Scalekit resolves the credential of the person who triggered the agent at request time, so every contract lookup and time-off change in your audit trail is attributed to a real user, not a shared service account.

Where is the Deel API key stored?

In an AES-256 encrypted vault with per-tenant namespacing. Keys are resolved at request time, never enter LLM context, and can be revoked from one dashboard.

Can I limit what the agent does in Deel?

Yes. Filter by tool name in listScopedTools to expose only what you want, for example read-only listing without timeoff_request_create. Scalekit also enforces scope checks before every API call.

What happens when a user revokes access?

The credential is invalidated at the next tool call. The call fails closed, other users' connections are unaffected, and the revocation is logged in the audit chain.

Compensation data is sensitive. Who can the agent see?

Only what the connected user's own Deel role permits. Scalekit resolves that user's credential per call, so contract and payroll reads like contract_get and payroll_cycle_list inherit Deel's role permissions, and every read is logged with the user's identity.

On this page

Tool and actions Framework Compatibility Starter Prompt Auth Lifecycle Try Other Agents Why Scalekit