Connect an AI assistant

TimerOS runs a hosted MCP (Model Context Protocol) server at https://api.timeros.ai/mcp, so an AI assistant you already use can read your work and, if you allow it, make a bounded set of changes. There is nothing to install. The assistant acts as you: every request runs through the same routes, guards and permissions your own sign-in has, so it can never see more than you can. It is available on every plan — Freelancer, Startup and Enterprise — at no extra cost, and it is tested with Claude: claude.ai on the web, the Claude desktop app and Claude Code.

How to connect

1. 1In TimerOS, open Settings → Connections (desktop or web app) and copy the connector URL — or use https://api.timeros.ai/mcp directly.
2. 2In Claude, open Settings → Connectors → Add custom connector and paste the URL.
3. 3A TimerOS sign-in page opens. Sign in with your TimerOS email and password, then your 2FA code if your account has two-factor enabled. A workspace that requires 2FA refuses accounts that have not enrolled yet.
4. 4On the consent page, check the assistant’s name, your workspace name and the access it asked for — read, or read and write — next to the fixed list of things it can never do. Click Allow access to approve, or Cancel to refuse.
5. 5Expect an email confirming the new connection. It names the assistant and the scope, and tells you where to disconnect it.

What it can do

With read access, the assistant can summarise a project, find tasks, and look up teams, people, goals, clients, invoices, expenses and the profit report — reading never changes anything. With read and write, it can also add and update tasks and subtasks, change task status, add notes, record operating expenses, create projects with phases, and attribute your own unassigned tracked hours to your tasks.

Small changes — a status, a note, a new task — are written in one call. The bigger ones (creating a project, adding a phase, creating a batch of subtasks, attributing hours) go through a plan first, then apply step: the assistant receives a plan it shows you, then applies it in a separate call that hands the plan’s acknowledgement text back verbatim. A plan expires after 10 minutes and applies exactly once. Attributing hours is the only time-related write there is: it assigns minutes you have already tracked but not yet allocated to your own tasks. It never creates time, never moves time between tasks and never edits a day’s totals.

What it can never do

These are not permissions you grant or withhold — the tools simply do not exist.

• Change milestone status (which can mint a client invoice), log or edit time beyond the attribution above, assign people, set budgets or rates, create or send invoices, edit clients or employees, write goals, record transactions or vendor bills, or delete anything.
• See pay, salaries, tax IDs, dates of birth, home addresses or emergency contacts — those fields are stripped from every response.
• Read client-authored surfaces: portal change requests, chat and incidents. Client names, descriptions and invoice notes are treated as data, never as instructions.
• Bypass your permissions or reach another workspace.

Managing connections

Settings → Connections lists every assistant connected to your account: its name, scope, when it was connected, when it was last used and how many changes it has written. Expand a connection for its Activity list — every change the assistant made, each with the call that undoes it. Disconnect is one click, and access stops on the assistant’s very next request.

• Access tokens last 15 minutes; refresh tokens last 30 days and rotate on every use. A replayed refresh token disconnects that one connection.
• Your assistant traffic has its own limit of 100 requests per 60 seconds — shared by every assistant connected to your account, and separate from your own use of the app.
• If your workspace’s subscription lapses, you can still disconnect assistants; the tools themselves refuse until the subscription is active again.

For owners and admins: the workspace switch

A workspace owner or admin can turn Allow AI assistant connections off for the whole workspace from Settings → Connections (desktop app from 1.19.1, web app from 1.4.1). Turning it off disconnects every live connection in the workspace immediately, blocks new sign-ins on the connector, and emails the people affected; members see a notice that it was turned off by an administrator. The switch is on by default and is workspace-wide, not per person.

Looking for a developer API, personal access tokens or webhooks? Those are still on the roadmap — see the API reference for where things stand.