MCP became part of software conversations almost overnight. It now seems to appear in every product roadmap, integration plan and release announcement, including our SunFish Q2 2026 update. But the term has spread faster than most explanations of it. Many people now know that an MCP Gateway has been added without necessarily knowing what it is or what it does.
As more companies bring AI tools, analytics and assistants into their everyday workflows and business platforms, including HR, it is worth pausing to understand what an MCP Gateway actually is, why it was built, where it sits and what it connects.
MCP gateways are designed for organizations that want AI assistants to work with information and processes held inside their business platforms. That raises a basic integration question: how does the assistant know what the system can provide and how to request it?
Introduced in late 2024, the Model Context Protocol provides an open standard that defines how AI assistants connect to data and business systems, including how they request information or an action. Without a common standard, connecting different AI assistants to different software systems can require separate integrations, each of which must be built, secured and maintained. With MCP, one gateway can describe the selected capabilities a system makes available, and compatible assistants can connect using the same standard. Once configured, an assistant can access only the capabilities exposed through the gateway and only the information or actions permitted for the signed-in user.
MCP does not contain the business data, replace the underlying application or its APIs, or determine what a user may access. It sits between the AI assistant and the business system as a standardized communication layer. The connected business system continues to hold the records, execute the processes and apply its existing access rules.
The SunFish MCP Gateway applies this standard within SunFish HR. It offers approved, compatible external AI providers (like Claude, Microsoft Copilot, or ChatGPT Enterprise) one governed route to selected SunFish capabilities, while identity, permissions and business processing remain in the SunFish HR platform.
One Gateway Across Selected SunFish Services
The SunFish MCP Gateway provides access to a defined set of capabilities across several areas of SunFish HR. It does not expose every function inside each module. Instead, the gateway describes the specific information and actions that compatible external AI assistants may request. These parts of SunFish HR are currently available through the MCP Gateway:
| Employee | Time & Attendance | Performance | Training |
| Employee Personal Information Employee Address Information Employee Education Information Employee Family Info | Attendance Information Leave Balance Information Project Management Information Timesheet History Activities Information Cost Center Information | Performance Evaluation Summary Development Plan Summary | Training Roadmap Information Training Event Information |
| Loan | Organization | Utilities | |
| Loan Submission / Cancellation Request Loan Simulation | Company Document Retrieval | E-Help Information: how to use SunFish HR itself |
Defining the capabilities available through the gateway serves two purposes:
- It prevents an assistant from using a function that SunFish has not intentionally exposed through the gateway.
- It gives compatible assistants a consistent way to discover and request available functions, without requiring a separate communication method for each SunFish service.
Retrieving Information vs. Requesting an Action
The capabilities available through the SunFish MCP Gateway fall into two categories: retrieving information and requesting an action. The difference determines what the assistant asks SunFish to do and which controls must be applied.
- Retrieving information: Most capabilities in the current release allow an assistant to request information already held in SunFish. An employee might ask how much annual leave remains or what the outstanding balance is on a current company loan. The gateway retrieves the permitted information from SunFish and returns it to the assistant without changing the underlying record.
- Requesting an action: A smaller number of capabilities allow an authorized user to ask SunFish to change a record or begin a process. Current examples include submitting or cancelling a loan request. These requests require the relevant write permission; permission to view the information is not sufficient. In the loan-cancellation example discussed later, the assistant also identifies the request and asks the employee to confirm the cancellation before SunFish processes it. An example of an action type being changed from “loan” to something related to time and attendance—such as a request to modify attendance data or a leave request.
This distinction establishes an important boundary. An assistant that can answer a question does not automatically have permission to change the information behind that answer. Each action must be deliberately made available through the gateway and permitted for the signed-in user.
How the SunFish MCP Gateway Controls Each Request
HR systems hold personal, performance and financial information, so an external assistant cannot decide for itself what a user should be allowed to access. Every request must remain connected to the identity and permissions maintained in SunFish. The SunFish MCP Gateway applies a five-step control path to every interaction before information or an action is returned:
When an assistant needs something from SunFish, it sends a structured request to the gateway. The gateway identifies the relevant capability, confirms the user’s identity and authorization, and routes the request to the appropriate SunFish service. The permitted result is then returned to the assistant. Four functions make that possible:
- Routing Directs the request to the appropriate SunFish capability. A leave-balance question must reach a different service from a request for a performance summary, company document or loan submission.
- Authentication Confirms who is making the request. SunFish OAuth provides the sign-in and consent process, so the employee authenticates through SunFish rather than giving a SunFish username and password to the external assistant.
- Authorization Determines what the authenticated user may retrieve or request. Connecting an assistant does not create a new set of HR permissions. The gateway applies the access already associated with the signed-in SunFish user.
- Standardization Gives compatible assistants a consistent way to discover and request the capabilities made available through the gateway. The organization does not need to design a separate communication method for every combination of assistant and SunFish service.
This separation is important. MCP defines how the assistant and SunFish HR communicate. SunFish continues to control the employee records, HR processes and access rules behind that communication. The conversational interface can therefore change without moving responsibility for HR data or business rules away from SunFish.
What This Looks Like for an Employee
For the employee, most of this happens behind a simple conversation. The experience becomes easier to understand through three practical examples: retrieving personal HR information, asking for guidance on how to use SunFish and requesting a permitted action.
Practical Example 1: Checking an Employee’s Leave Balance
Consider an employee using an approved AI assistant connected to the SunFish MCP Gateway. The employee asks:
“How much annual leave do I have left?”
The assistant recognizes that the answer must come from the SunFish HR platform. It calls the relevant SunFish MCP capability and sends the request through the gateway.
Where required, the employee signs in through SunFish HR and approves the connection. SunFish then identifies the employee and determines which leave information the account is permitted to retrieve.
The Time and Attendance service returns the employee’s current balances. If the organization maintains several leave types, the response can distinguish between them rather than returning one generalized number. The external assistant then presents the result in the employee’s language.
The employee does not need to locate the leave module, identify the correct balance page or ask HR to look up the record. The organization also does not need to export a spreadsheet or maintain a separate bulk copy of leave information for the assistant. The permitted result is requested from SunFish when needed, and the answer is shown in the connected assistant the employee works with.
The same interaction pattern can support other available information, such as timesheet history, training events or a development-plan summary. What changes is the capability selected by the assistant and the permission SunFish applies to the request.
Practical Example 2: Answering “How Do I?” Questions
Not every employee question asks for a personal record. Many questions are procedural:
“How do I submit an attendance data change in SunFish?”
The employee needs instructions, not a database value. Through the Utilities capability, the SunFish MCP Gateway can make E-Help information available to the external assistant.
The assistant calls the E-Help service and retrieves the relevant SunFish guidance. It can then explain the supported process step by step, including the correct navigation path and available submission method. The answer comes from SunFish’s own help content rather than from the assistant guessing how the application works.
This use case may be especially practical for questions that repeatedly reach HR or the application helpdesk. Employees often know what they want to do but not which menu, form or process contains it. E-Help gives the assistant another way to find the answer while keeping the guidance connected to the actual SunFish process.
It does not eliminate every support request. Questions involving exceptions, policy interpretation or an unexpected system result may still require HR or administrator involvement. It is most useful where the answer already exists in E-Help and the primary difficulty is finding it.
Practical Example 3: Requesting an Action
Retrieving information ends with the assistant returning an answer. Requesting an action creates a different experience. When an employee asks the assistant to “Cancel my pending car-loan request,” it cannot simply return a text response. Because the request would change a SunFish record, the gateway must verify that the employee has permission to make that change. Read access is not enough. The account must have the relevant write permission for the loan action.
If the employee does not have the required permission, the assistant explains that the cancellation is unavailable. If the gateway confirms the required permission, the assistant presents the loan request that will be affected and asks the employee to confirm the cancellation.
Only after the employee confirms does the gateway submit the request to SunFish. SunFish processes the cancellation and returns the outcome, allowing the assistant to tell the employee whether the request was cancelled or why it could not be completed.
For the employee, the additional control is visible: the assistant shows which request will be affected and provides a final opportunity to confirm the change before it is submitted.
Connecting an Approved AI Assistant to SunFish
Making these interactions available requires deliberate configuration between an organization’s approved AI environment and SunFish HR. The organization must decide which assistant it will connect, which SunFish capabilities it will expose and which users may access them. Once an AI assistant has been approved, it must be configured with the SunFish MCP connector or plugin and the relevant SunFish MCP server.
Once that connection has been set up, SunFish OAuth provides the sign-in and consent process for individual users. The user signs in through SunFish rather than entering SunFish credentials directly into the external assistant. The access request identifies the system seeking the connection, and the user can approve or deny it.
After authentication, the gateway associates requests with the signed-in user and applies that user’s authorization. The connection can be routed, monitored or revoked centrally rather than relying on credentials copied into every external tool.
Technical compatibility does not provide automatic access. Organizations must approve the external AI environment, enable the appropriate SunFish capabilities and determine which users may access them. The gateway provides the controlled connection; organizational policy determines where that connection may be used.
The Future of Your HR Ecosystem
Choosing an HR platform means supporting today’s workforce processes while preparing the HR environment for the AI tools an organization may adopt next.
Those tools will continue to change. New assistants will emerge, and employees may use different AI environments for different parts of their work. Without a common standard, every new connection to HR information and processes risks becoming another integration that must be designed, secured and maintained separately.
The SunFish MCP Gateway provides a standard connection point for that expanding ecosystem. As organizations approve new MCP-compatible assistants, they can make selected SunFish capabilities available through the same gateway rather than rebuilding the connection method each time.
This gives organizations a practical way to expand AI access gradually. They can begin with selected information and product guidance, then introduce carefully controlled actions as their requirements, policies and confidence develop. SunFish continues to provide the records, permissions and business processes underneath, while the organization gains more choice over the AI tools through which employees interact with them.
Customers who would like to explore which assistants, SunFish capabilities and access models are available can contact their DataOn account manager or the DataOn team.
