Time tracking MCP server for Claude, Cursor and other AI agents

What you can ask

Plain sentences work. Under each request are the tools the agent called to answer it.

Connect Claude Code in three steps

Claude Code takes one command. Everyone in the studio connects with their own token, so the agent works with their role.

1. In Oretta, open Account and scroll to API tokens. Name the token after the device, like "Claude Code, MacBook", click Create token and copy it. Oretta shows it only once.

   API tokens

   1. Create a token
   2. Copy the command
   3. Paste it in the terminal

   Token nameClaude Code, MacBookCreate token

   Copy it now, it won't be shown again.

   ••••••••••••••••••••••••••••••••(the token, hidden here)

   Using Claude Code? Connect it with:

   claude mcp add --transport http oretta https://oretta.app/mcp --header "Authorization: Bearer ••••••••(your token)"

2. Run the command Oretta shows under the token, or this one with your token in place of YOUR_TOKEN. Add --scope user to use Oretta in every project, not only the folder you're in.

   claude mcp add --transport http oretta https://oretta.app/mcp --header "Authorization: Bearer YOUR_TOKEN"

3. Start Claude Code and type /mcp to check that oretta is connected. Then ask something, like "What did I log this week?"

   Mon 9 NovTotal 5:15

   • Logo files for printBrand book · Fennel & Co10:00-11:301:30
   • Label dielines, second roundSpring labels · Sowa Brewery11:45-13:001:15
   • Sign-in screen mockupsWebsite refresh · Atlas Architects14:00-16:302:30

Connect other AI clients

They all connect to the same server with the same kind of token, and each setup below keeps the token out of the project folder.

{
  "mcpServers": {
    "oretta": {
      "url": "https://oretta.app/mcp",
      "headers": {
        "Authorization": "Bearer ${env:ORETTA_TOKEN}"
      }
    }
  }
}

{
  "inputs": [
    {
      "type": "promptString",
      "id": "oretta-token",
      "description": "Oretta API token",
      "password": true
    }
  ],
  "servers": {
    "oretta": {
      "type": "http",
      "url": "https://oretta.app/mcp",
      "headers": {
        "Authorization": "Bearer ${input:oretta-token}"
      }
    }
  }
}

codex mcp add oretta --url https://oretta.app/mcp --bearer-token-env-var ORETTA_TOKEN

gemini mcp add --scope user --transport http --header "Authorization: Bearer $ORETTA_TOKEN" oretta https://oretta.app/mcp

What the agent can and can't do

Ten tools: eight read and two write. The eight carry the MCP read-only annotation, so a client can tell them apart from the two that write.

• There's no delete tool, and no tool changes clients, projects, people or rates.
• Before it adds or changes an entry, the agent is told to show you a summary and wait for your yes.
• It edits only your own entries started in the last 7 days. Older ones, and other people's, you change in the app.
• When a new entry overlaps one you already logged, add_time_entry says so.
• Permissions are enforced in the database: you see your own entries, a team lead sees the team, only admins see rates and costs. A token never sees more than the person who made it.

One token per person and device

Each person creates their own token under Account > API tokens. The agent then acts as that person, with their role, so there's no shared studio key.

Make one per device or client and name it so you'll recognize it later ("Cursor, studio iMac"). Oretta shows a token once and stores only a hash of it. If you lose one, or a laptop goes missing, delete that token under API tokens and create a new one. Whatever used the old token loses access on its next request.

Keep tokens out of shared repositories. Every setup on this page stores the token outside the project folder, in an environment variable or in the client's own settings. The same kind of token also connects the Chrome extension.

What reaches your AI provider

When you ask something, the agent calls a tool and gets back what your role can see: client and project names, entries, and amounts if your role sees rates. That reply goes to the AI provider behind your client (Anthropic, if you use Claude), under your own agreement with that provider.

Oretta sends nothing to AI providers on its own. The server gets only the tool calls and what the agent fills in, like an entry's description. It never sees the rest of your conversation and keeps no session between requests.

The privacy policy has the details, and the subprocessor list names Anthropic as your provider, not Oretta's.