Skip to content
Submit a request
  • There are no suggestions because the search field is empty.

Shape MCP: use your Shape projects in Claude

Ask Claude about your projects, issues and shift reports. Shape MCP can only read data, and your existing Shape permissions always apply.

Shape MCP connects Shape to Claude. Once you connect it, you can ask Claude questions about your projects and get answers from your live Shape data, without leaving the conversation.

This article explains what Shape MCP can see and how to connect it. The section For IT and security teams covers sign-in, permissions, data handling and how to remove access.


In this article:

 

What Shape MCP can see

Shape MCP can read the following from the projects you're a member of:

Area What Claude can read
Projects The projects you're a member of, and their details
Issues Issues, including their status, and search across issues
Shift reports Shift reports and the activities recorded in them
Weekly work plans Weekly work plans for a project
Documents Documents stored in Shape, and search across them
Locations and disciplines A project's locations and disciplines
People Who is on a project's team and their role
Contracts and potential changes Contracts and potential changes, where your project uses them
Custom fields The custom fields set up on a project

Claude sees the same records you'd see if you signed in to Shape yourself. If you can't see a project or record in Shape, Claude can't see it either.

 

What Shape MCP can't do

Shape MCP can only read data. It can't:

  • Create, edit or delete anything in Shape, such as issues, shift reports or documents.
  • Change project, organisation or account settings.
  • See projects you aren't a member of.
  • Reach sign-in, password or account operations.

 

How to connect Shape MCP

You need a Shape account and a Claude account.

Note: On a Claude Team or Enterprise plan, an organisation Owner may need to add Shape MCP for your organisation before you can connect it. If you can't find Shape in Claude, ask your Claude administrator.

 

Connect from the Claude directory

  1. In Claude, open Settings and select Connectors.
  2. Select Browse connectors and search for Shape.
  3. Select Connect. A Shape sign-in page opens.
  4. Sign in to Shape the way you normally do. If your company uses single sign-on (SSO) for Shape, you'll sign in through your company's provider.
  5. Shape asks whether Claude can access your Shape account. Check it's the account you meant to use and select Allow access.

You're returned to Claude, and Shape MCP is ready to use.

 

Connect by URL (custom connector)

If your organisation adds connectors by URL instead, use this server address:

https://mcp.shape.construction/mcp

The sign-in and permission steps are the same as above.

 

Things you can ask

Start by naming the project, so Claude knows where to look. For example:

  • “What issues are still open on the Riverside project?”
  • “Summarise this week's shift reports for Riverside.”
  • “What's on next week's work plan, and what's behind?”
  • “Find the latest fire strategy document.”
  • “Who's on the Riverside project team?”

 

For IT and security teams

This section is for administrators deciding whether to approve Shape MCP for their organisation.

How sign-in works

Shape MCP uses OAuth 2.0, the standard way to let an app access an account without sharing a password.

  • Each person signs in with their own Shape account on Shape's own sign-in page. Claude never sees their Shape password.
  • Your existing sign-in rules apply. If your company requires single sign-on for Shape, people can't use a password instead, and locked accounts can't connect.
  • Before access is granted, Shape shows a consent screen naming the app and the Shape account it will access. Nothing is granted until the person selects Allow access.
  • Shape uses the authorisation code flow with PKCE (S256). Older, less secure OAuth flows are turned off.
  • Access tokens are short-lived. Refresh tokens are replaced each time they're used, and expire if they go unused for two weeks.
  • Tokens and app secrets are stored in hashed form, so they can't be read back from Shape's database.

 

Permissions Claude asks for

Claude asks for Shape's standard api permission. It works within the person's own Shape access, so Claude never reaches more than they can see in Shape.

Shape MCP is read-only by design. Every tool it offers reads data, and it blocks any request that would create, change or delete anything before the request reaches Shape. Claude can't change your Shape data through Shape MCP.

Access control

  • Shape checks each request against the signed-in person's own permissions, in the same way as the Shape app.
  • Shape MCP can only reach the parts of Shape its tools are built for: a fixed set of read requests. Claude can't send Shape MCP anywhere else.
  • Sign-in, password, account and terms-acceptance operations can't be reached through Shape MCP.

Where your data goes

  • Shape MCP doesn't store your data. It reads from Shape when Claude asks and keeps nothing between requests.
  • Your data stays hosted where it is today. Shape MCP reads each project from the Shape region where it's hosted.
  • What's sent to Claude: the results of each request, such as a list of issues or the text of a shift report, become part of the Claude conversation. From that point, Anthropic handles them under your organisation's agreement with Anthropic.
  • What Shape records: for each request, Shape logs which tool was used, the project, the connected app, how long it took and whether it succeeded. Shape doesn't log the content returned, and never logs access tokens. These logs are kept for up to 12 months.

For more detail, see Shape's Privacy Policy and Trust Center.

 

Hosting and security

  • Shape MCP runs on Amazon Web Services in London (eu-west-2), behind Cloudflare.
  • All traffic uses HTTPS.
  • Each person has rate limits and a limit on how much data a single request can return, to prevent bulk export.
  • The service is monitored, with alerts for errors, sign-in failures and unusual load.

 

Removing access

  • A person can disconnect at any time in Shape: go to My account › Sign-ins and connected apps and select Disconnect next to Claude. This cuts off Claude's access to Shape. They can also remove the connector in Claude.
  • Signing out of Shape doesn't disconnect Claude. Connected apps stay connected when you log out of Shape, so disconnect the app to cut off access.
  • Organisation-wide: on Claude Team and Enterprise plans, organisation Owners decide which connectors members can use, from Claude's organisation settings.
  • When a person leaves your company, removing their Shape account removes their access through Shape MCP.

 

Limits

  • Read-only: to create or change anything, use the Shape app.
  • Large results are shortened: if a request would return too much data, Shape MCP returns part of it and says so. Ask a narrower question, such as a date range or a single location.
  • Rate limits: if someone makes a very large number of requests in a short time, Shape MCP slows them down for a while.

 

 

Troubleshooting

Problem What to do
Claude can't find a project Check that you're a member of the project in Shape. Claude only sees projects you can see.
You can't sign in with a password Your company requires single sign-on for Shape. Use your company's sign-in option.
Shape MCP stopped working Claude may have been disconnected in My account › Sign-ins and connected apps, or your Shape access changed. Reconnect from Claude.
Claude says a result was shortened Ask a narrower question, such as one location or a shorter date range.

 

Need help?

Submit a request to the Shape support team, or check the Shape status page.

 

Related articles