Skip to main content

AI Assistants — Introduction

Use ShiftControl from inside your AI assistant — Claude, Cursor, ChatGPT, Windsurf, and more.

Overview​

ShiftControl exposes an MCP server at https://mcp.shiftcontrol.io/mcp. Once you connect your AI assistant to it, you can hand it most of the day-to-day admin work you'd do in the web app, across Google Workspace and JumpCloud:

  • "Onboard Priya Sharma. Create her account, add her to Sales and the all-staff group, give her Salesforce and Slack, and send her the sign-in email."
  • "Marcus leaves Friday at 5pm. Schedule his suspension."
  • "Who has access to Figma, and how did they get it?"
  • "Approve the pending access requests for Notion."
  • "I just got the Notion renewal invoice. Update the subscription to $1,200 per year."

The AI does the API calls behind the scenes using your existing ShiftControl permissions. There's no service account, no API key to manage, and no separate role: your AI sees and can change exactly what you can. It covers people, groups, apps and access, requests, and org structure. What your AI can do lists it all, area by area.

What you get​

CapabilityWhat it is
MCP serverA remote server at https://mcp.shiftcontrol.io/mcp that exposes more than 70 tools (list_users, create_user, update_group_members, assign_to_app, approve_work_item, and more) to any MCP-aware AI client.
SkillsPre-built workflows you can install — instruction sets that combine MCP tools with multi-step logic for common SaaS-management tasks. In Claude they arrive as one plugin that carries the MCP server with them.
OAuth sign-inOne browser sign-in per client. No API keys, no service accounts. Tokens are scoped to your ShiftControl user and respect your role.

How permissions work​

Your AI assistant inherits your ShiftControl permissions exactly. If you're a viewer, the AI is a viewer. If you can edit groups, the AI can edit groups. Employees without an admin role can use it too, for things like seeing their own apps and requesting access.

Every tool that changes something requires an explicit confirmation in the call itself: the tool only runs with confirm: true, and your AI is told to describe the exact change and wait for your yes before it sets it. Looking things up never changes anything. Changes made this way are recorded in the audit log, marked as made through an AI assistant (MCP).

Sessions are OAuth-authenticated against ShiftControl's platform. Your AI client stores the access token; ShiftControl validates it on every call. When it expires, your client silently refreshes — or, if the refresh fails, you'll see a one-line "sign in again" prompt in the AI tool.

Where to start​

New here

If you've never connected an MCP server to your AI tool before, Connect your AI tool walks through it for every supported client. If you have, the endpoint is https://mcp.shiftcontrol.io/mcp and OAuth discovery is at /.well-known/oauth-authorization-server — Dynamic Client Registration and Client ID Metadata Documents are both supported.

  • What your AI can do — the admin work your AI can do, area by area, with example requests
  • Connect your AI tool — install paths for Claude Desktop, Claude Code, Cursor, Windsurf, Cline, Continue.dev, ChatGPT, Gemini CLI, and any generic OAuth-MCP client
  • Skills — pre-built workflows you can install on top of the MCP server, and the catalog of what's available today