Setup

This page covers the most common MCP clients. Any HTTP-based MCP client follows the same pattern: point it at https://mcp.vacationtracker.io and let the built-in OAuth flow do the rest.

Server endpoint

https://mcp.vacationtracker.io

The older https://mcp.vacationtracker.io/mcp endpoint is deprecated but still supported, so existing connections keep working. Use the root URL for new connections.

The authorization server is advertised at https://mcp.vacationtracker.io/.well-known/oauth-protected-resource. MCP clients discover it on their own, so you do not configure an auth URL manually, unless your tool needs a client ID and secret.

Claude Desktop

1. Open Claude Desktop → Settings → Connectors (or Custom Connectors, depending on your version).
2. Click Add custom connector.
3. Fill in the form:
   • Name: Vacation Tracker (or anything you prefer)
   • URL: https://mcp.vacationtracker.io
4. Save the connector.
5. Claude Desktop opens your browser to the Vacation Tracker consent screen.
6. Log in with your Vacation Tracker account and click Allow to grant the requested scopes.
7. The browser redirects back to Claude Desktop. You should see the connector listed as Connected.

You can now ask questions like:

• "Who's on vacation next week?"
• "Find people in the Engineering department."
• "When is the next public holiday in our Belgrade office?"
• "What leave types does our workspace have?"

Claude Code

Claude Code supports MCP servers via claude mcp add. From any terminal:

claude mcp add --transport http vacationtracker https://mcp.vacationtracker.io

The first time you invoke an MCP tool, Claude Code opens your browser for the OAuth flow. It's the same consent screen the desktop app uses.

Cursor

1. Open Cursor → Settings → MCP.

2. Click Add new global MCP server.

3. Add an entry for Vacation Tracker:

   {
     "mcpServers": {
       "vacationtracker": {
         "url": "https://mcp.vacationtracker.io"
       }
     }
   }

4. Cursor will prompt you to sign in; the flow is identical to Claude Desktop.

ChatGPT

1. Open Settings → MCP servers → Add server.
2. Name it Vacation Tracker, choose Streamable HTTP as the transport, and enter https://mcp.vacationtracker.io.
3. Save, then select Restart.
4. Select Authenticate next to the server in the list and approve the scopes on the Vacation Tracker consent screen.

Type /mcp in the composer to see the connected servers and the tools they offer.

Codex

codex mcp add vacationtracker --url https://mcp.vacationtracker.io
codex mcp login vacationtracker

codex mcp login opens the consent screen. There is no client ID to supply: Codex chooses a registration method on its own and falls back to Dynamic Client Registration, which is what Vacation Tracker supports. To pin it, pass --oauth-client-registration dcr.

GitHub Copilot CLI

copilot mcp add --transport http vacationtracker https://mcp.vacationtracker.io

Start copilot and run /mcp. The CLI connects on startup, opens your browser for the consent screen, and lists Vacation Tracker as connected once you approve.

Two things that trip people up:

• copilot mcp add writes to your user configuration. A copilot session that was already running won't see the new server until you restart it.
• Add --tools get_leaves,get_holidays to expose only some tools. The default is *, every tool your role can use.

GitHub Copilot in VS Code

Add the server to .vscode/mcp.json in your workspace, or to your user mcp.json to make it available in every project:

{
  "servers": {
    "vacationtracker": {
      "type": "http",
      "url": "https://mcp.vacationtracker.io"
    }
  }
}

Reload the window. VS Code starts the server, opens the consent screen on first use, and the Vacation Tracker tools appear in the tools picker in agent mode. If you share the file with your team, use .mcp.json with mcpServers as the top-level key instead: each person signs in as themselves, and no credentials are stored in the file.

Microsoft Copilot Studio

1. Open your agent → Tools → + New tool → Model Context Protocol.
2. Fill in the form:
   • Server name: Vacation Tracker
   • Server description: anything that describes it to the agent
   • Server URL: https://mcp.vacationtracker.io
   • Authentication: OAuth 2.0, then Type: Dynamic discovery
3. Select Create, then sign in and approve the scopes on the Vacation Tracker consent screen.

Dynamic discovery is the simplest type. Vacation Tracker supports Dynamic Client Registration, so Copilot Studio registers itself and you never type a client ID or secret.

Manual works too, with a client ID and secret you create in Vacation Tracker. Use it when your organization wants one connector that everyone signs in through. Create a company client (see Client ID and secret) and enter its authorization URL, token URL, client ID, secret, and scopes in the Copilot Studio form. If the form asks for a refresh URL, use the token URL.

Gemini Enterprise

Gemini Enterprise doesn't register itself with the MCP server. It asks for a client ID and secret, even though it also uses PKCE.

1. In Vacation Tracker, an admin creates a company client in Integrations → MCP (see Client ID and secret). Add the redirect URL that Gemini Enterprise shows for the connector.
2. In Gemini Enterprise, add a custom MCP server with the server URL https://mcp.vacationtracker.io.
3. Enter the authorization URL, token URL, client ID, secret, and scopes from Vacation Tracker, and turn PKCE on.
4. Save. Each person in your company signs in to Vacation Tracker as themselves the first time they use the connector.

Client ID and secret

Most clients on this page register themselves, so you don't need a client ID or secret. You need one when your tool asks for them, for example Gemini Enterprise, Copilot Studio with Manual authentication, or a tool that doesn't support Dynamic Client Registration.

There are two kinds:

• Personal client: anyone can create one. Only the person who created it can sign in through it. You can have up to 10.
• Company client: only admins can create one. Everyone in your company can sign in through it. Use it for tools that set up one connector for all employees. A company can have up to 20.

Create them in Vacation Tracker under Integrations → MCP. When you create a client, you choose:

• who can sign in (personal or company),
• the tool you are connecting. Vacation Tracker fills in that tool's redirect URLs for you,
• a name, shown on the sign-in screen,
• the access: Read only or Read and change,
• the redirect URLs. You can change the ones filled in. Each must match exactly and use https, or http on localhost or 127.0.0.1.

These are the redirect URLs Vacation Tracker fills in for each tool:

Copilot Studio and ChatGPT show their redirect URL only after you enter a client ID and secret. For these two, create the client first, enter its values in the tool, then copy the redirect URL the tool shows. Back on the MCP page, choose Edit redirect URLs on the client and paste it in.

After you create the client, Vacation Tracker shows every value your tool asks for:

Turn PKCE on in your tool if it has the option. Always fill in the scopes: a tool that connects with no scopes shows no tools.

A read only client only ever gets read access, whatever other clients the person has approved. Deleting a client disconnects everyone who signed in through it the next time their token refreshes.

Other clients

The server implements the standard MCP Streamable HTTP transport. A client can connect if it supports:

• the Streamable HTTP transport,
• OAuth2 Authorization Code Grant, with either Dynamic Client Registration (RFC 7591) or a client ID and secret you create in Vacation Tracker,
• PKCE (S256), and
• MCP protocol 2026-07-28 or any 2025 revision (2025-03-26, 2025-06-18, 2025-11-25).

Clients that use Dynamic Client Registration find the authorization server on their own through the RFC 9728 oauth-protected-resource metadata. See Troubleshooting if your client is missing one of these pieces.

What the server sees

The Bearer token carries:

• your Vacation Tracker user ID and company ID (as custom claims)
• the scopes granted on the consent screen. MCP clients can request the full set (mcp:workspace:read, mcp:users:read, mcp:leaves:read, mcp:workspace:write, mcp:users:write, mcp:leaves:write); if a client asked for fewer and later calls a write tool, the server's insufficient_scope challenge makes the client ask you to consent again

Tool calls are authorized against your role the same way the web app is. A non-admin user calling find_users only sees people they can see in the Vacation Tracker UI, and write tools (creating or approving a leave request, editing a user) are unavailable to roles that can't do the equivalent action in the app: the token carries the write scope, but your role decides whether it takes effect. There is no separate "MCP permissions" layer to configure.

If your client ever shows a re-consent or "additional permission needed" prompt for a tool, it's asking for a scope your existing token doesn't have yet (for example, a token issued before write tools shipped). Approve it once and the client won't ask again.

Revoking access

An AI connections (MCP) page is planned for the Vacation Tracker add-ons section. Once it ships, you'll see every AI client you've authorized, when it was last used, and a one-click revoke.

Until then:

• In your AI client, disconnect the Vacation Tracker connector from its settings. This stops the client from sending the Bearer token but does not invalidate the token server-side.
• For immediate server-side revocation, email developers@vacationtracker.io with the approximate date you authorized and the client (e.g. "Claude Desktop"). Support will revoke the underlying OAuth client.

Access tokens expire after 60 minutes, refresh tokens after 365 days.