PointOne MCP Server

Connect PointOne to an AI assistant: Claude, ChatGPT, or any other MCP-capable app — and it can answer questions about your time, your matters, and the billing rules that apply to them, using live data from your PointOne account.

Connect at: https://mcp.pointone.com/mcp

What an assistant can do

Six capabilities: "tools", in MCP terms. An assistant picks the right ones on its own; you just ask a question in plain language.

Tools

• get_user_info: Confirms whose PointOne account is connected, and supplies today's date, your time zone, and your firm's billing increment. Assistants call this first to orient themselves.

• search_clients_matters: Finds a client or matter by name, number, or description — "the antitrust work for Acme". This is how an assistant turns a name you said into the right matter.

• list_time_entries: Reads your own time entries for a date range, or specific entries. Includes hours, narratives, matter, billable status, rate and amount — and PointOne's not-yet-logged suggestions from your captured activity.

• search_rules: Returns the billing rules and outside-counsel guidelines that apply to a matter, a client, or the whole firm — including the citation and source document they came from.

• list_codes: Lists the classification codes your firm uses on time entries (task codes, activity codes, and any custom sets), including which sets are required.

• get_compliance_results: Reports what PointOne has already flagged on your entries — what would likely get written off, and which rule says so.

Questions this answers well

• "What did I bill on the Acme matter last month, and how much of it was non-billable?"

• "What did I work on yesterday that isn't logged yet?"

• "Are there any compliance problems in my time this week?"

• "What are Acme's billing guidelines on block billing?"

• "Which task codes should I be using on this matter?"

Questions it can't answer

• "How many hours did the associates bill last quarter?" — a connection reads only your own time, never a colleague's or the firm's.

• "Log two hours to the Acme matter." — for now, this connection is read-only. Use the PointOne app.

Connecting

1. Add the server to your assistant. In whichever app you're using, add a custom MCP connector and paste in https://mcp.pointone.com/mcp. Most apps need nothing else.

2. Sign in to PointOne. The app opens a PointOne login window. Use your normal account.

3. Review and approve access. You'll see exactly which categories of data the app is asking for (see Permissions below). Approve, and you're connected.

4. Ask a question. The assistant handles the rest, and stays connected until you disconnect it.

To disconnect, remove the connector in your assistant app or revoke the connection from PointOne. Access stops within about a minute.

Permissions

At the approval screen you'll be asked for some or all of three permissions. An app gets only what it asks for and you approve, and a tool it lacks permission for simply doesn't work.

Compliance findings need both Time and Rules — a finding is a rule applied to one of your entries, so an app missing either half can't see it.

What it can and can't access

Reach is not uniform, and the difference matters:

• Your time is yours alone. Time entries and compliance findings cover the connected user and nobody else. There's no way to ask for a colleague's time or a firm-wide total — not through a setting, and not by being a firm administrator. An assistant asked for someone else's hours will say it can't, rather than quietly answering with yours.

• Clients, matters, rules, and codes are firm-wide. Anyone at the firm can look up any client or matter and read the rules and codes that apply to it.

• Ethical walls are enforced. A matter you're screened from stays invisible here too — it won't appear in searches, and its entries and rules aren't reachable. The same walls you see in the PointOne app apply, enforced in the database rather than by the assistant.

• Firm administrators get no extra reach. Authority you hold inside PointOne isn't automatically handed to a third-party app you connected. Broader access would require a permission you were actually shown and approved, and none is offered today.

Security

• Your firm and identity come from your login, never from anything the connected app sends. There's no way for an app to point itself at another firm's data.

• Every query is scoped to your firm at the database level, with row-level security and ethical-wall filtering applied to every read.

• Firm data is treated as data, never as instructions. Rule statements and compliance findings are often text lifted verbatim from documents your firm didn't write. The server tells every assistant, at connection time, to report that text rather than act on it (so a sentence inside a client's PDF can't redirect the assistant).

• Access is short-lived and revocable. Credentials expire on their own and are refreshed quietly in the background. Revoking a connection stops it within about a minute.

Current limits

• Read-only — no writes of any kind.

• Your own time only. No colleague reads, no firm-wide aggregates.

• Compliance checks run in the background, so an entry created moments ago may not have been evaluated yet. An unevaluated entry is reported as unevaluated, never as clean.

Technical reference

Endpoint and transport

• Resource: https://mcp.pointone.com/mcp

• Transport: Streamable HTTP, stateless, JSON responses. Protocol versions are negotiated, so current and legacy revisions both work.

• GET /mcp — the optional server-to-client SSE stream — answers 405 with Allow: POST, because a stateless transport has no session to stream on. Tool calls over POST are unaffected; some clients log a harmless warning.

• CORS is enabled, including preflight on the discovery documents, so browser-based clients work.

• All six tools are annotated readOnlyHint, non-destructive, and closed-world.

Authentication

OAuth 2.1 with PKCE. Access tokens are opaque, short-lived, and validated by introspection on every cache miss.

• Discovery: RFC 9728 Protected Resource Metadata at /.well-known/oauth-protected-resource/mcp, and also at /.well-known/oauth-protected-resource for clients that probe the root. It names the resource identifier, the authorization server, and the scopes available for consent.

• Resource binding: tokens must be minted for this resource (RFC 8707 resource indicators); a token for anything else is refused.

• Presentation: Authorization: Bearer <token>, header only. Tokens in query strings are not accepted, and JWT-shaped credentials (web session tokens) are rejected before validation.

• Firm binding: the firm is resolved from the token's subject through the PointOne directory, not from a token claim. Nothing in the request can influence it.

• Validation caching: successful validations are cached for up to 60s and refusals for 10s, which is the window in which a revoked token or a firm reassignment takes effect.

Scopes

get_user_info requires no scope, so a client can always discover what it holds — the response's granted_scopes lists it. A call missing a scope returns an insufficient_scope error naming what's absent, never a partial or empty result.

Errors

• Tool errors come back as a tool result with isError set — a business or validation failure the model reads and acts on. The message names the offending argument and, where relevant, the tool that produces a valid value for it. A transient fault says so explicitly, so a correct call isn't needlessly rewritten. Messages carry no internal detail: no query text, no stack, no infrastructure names.

• Transport errors are JSON-RPC errors carrying an HTTP status: