Workday's MCP Server Goes GA: Agents in Claude Code and Cursor Can Now Query Live HR and Finance Data

Workday turned its Trusted Agent Platform headless on Oct. 13, 2026, at Workday Rising in Las Vegas, shipping a Model Context Protocol server, SQL access to live production data, and a shared agent runtime all at once (Workday newsroom). That makes Workday one of the largest systems of record to open a standards-based door for outside coding agents to read and, in some cases, write HR and finance data directly — not through a side channel, but under the same permissions the signed-in human already has.

What actually shipped

Five pieces went generally available together (Workday newsroom):

• Agent-Ready Tools — Workday’s MCP server, shipped inside Workday Extend AI. According to CTO Gabe Monroy, it currently exposes 275 read tools and 54 tools that write or delete data (The New Stack).
• Live Data Query, part of Workday Data Cloud — SQL access to live Workday data, with no custom reports, fragile integrations, or stale data copies (PR Newswire). Monroy described it as JDBC-style access to Workday’s object graph, where each query returns only what the requesting user is cleared to see (The New Stack).
• Agent Harness — the shared runtime for agents built by Workday, customers, or partners, including those produced by Developer Agent and Custom Agents. It passes each agent the user’s identity, org position, and access rights, and records what the agent did.
• Developer Agent — turns a plain-language request into a working agent or app, built from inside Claude Code, Codex, Cursor, or the Workday Developer Site.
• Custom Agents — lets teams bring their own framework, including LangChain and Google’s Agent Development Kit (ADK support is currently limited to design partners), and run it on Agent Harness with a choice of model from Anthropic, Google, Meta, Mistral, Nvidia, or OpenAI.

The core claim, repeated by Monroy as “headless can’t mean lawless,” is that none of this requires rebuilding Workday’s permission model elsewhere. Agent-Ready Tools and Live Data Query are two separate access paths into the same tenant, and every request on either path already carries Workday’s existing permissions, approvals, and audit trail: an agent calling either one inherits whatever the signed-in user is already allowed to see and do.

What this changes for someone building an agent today

The practical shift is that a developer can now point Claude Code, Cursor, or Codex at a real Workday tenant and get back live, governed answers instead of a static export or a brittle custom report. Monroy demonstrated the failure mode this replaces: an agent wired to a generic MCP server, or to a Snowflake copy of Workday data, returned job requisitions and even a CTO’s salary that the requesting user had no right to see, with no approval trail for the actions it then took (The New Stack). Routed through Agent-Ready Tools and Data Cloud instead, the same agent only saw what its signed-in user was cleared to see.

That’s a different design than the Integration System User pattern some existing Workday MCP integrations use today, where, as The New Stack reported, a single system account with broad security-group access answers for whoever is prompting it, regardless of who’s actually asking (The New Stack). Workday’s own Agent-Ready Tools instead tie the agent’s visibility to the signed-in human, call by call. That puts Workday’s design in tension with this site’s case for agent identity as a service principal — giving agents their own credentials instead of borrowing a human’s — though the underlying stakes are the ones this site’s piece on treating every agent as a privileged user describes either way: whoever, or whatever, holds the credential needs scoped, auditable access, not a blank check.

Workday says customers have already built more than 500 agents and 6,000 apps with Developer Agent and Agent-Ready Tools over the past four months, which suggests real usage ahead of today’s GA announcement rather than a cold launch (The New Stack).

The parts that are still rough edges

Workday gives agents up to two of their own system accounts — Agent System Users (ASUs), one for acting on a user’s behalf and one for “ambient” work, each with a separate OAuth client — according to Workday’s documentation as reported by The New Stack (The New Stack). That’s a different approach from Salesforce, which is moving toward agents registering with their own OAuth credentials rather than acting under a human’s identity at all, per Salesforce Ben as cited in the same reporting (The New Stack).

Workday executives also caveat the scope of direct MCP access. Workday’s president of product and technology, Gerrit Kazmaier, said building directly against the MCP server only covers “a small set of use cases” that don’t need deep HR or finance domain logic; for everything else, the company points customers toward an AI-to-AI path where Claude hands requests to Sana, Workday’s own orchestrator, which then calls Workday’s domain agents (The New Stack).

Two further guardrails are still ahead, not shipped today. Agent Context Service, which would preload only the data a task needs, is slated for early access in late 2026; Grounded Reasoning, which checks a planned action against company policy, process rules, and tenant data before the agent acts, follows in early access in early calendar 2027 (Workday newsroom). That’s additive, not foundational: today’s GA release already runs every Agent-Ready Tools and Live Data Query request through Workday’s existing permissions, approvals, and audit trail, scoped to the signed-in user. Grounded Reasoning adds a policy check before an action executes, on top of the access control Workday says is already enforced now.

Why it matters beyond Workday

Salesforce, ServiceNow, and Microsoft have each already opened MCP-style access to their systems of record this year — Salesforce’s Headless 360, ServiceNow’s Action Fabric MCP server, and Microsoft’s MCP server for Dynamics 365 — and all four vendors now say outside agents stay inside existing permission models (The New Stack). Workday’s release is notable mainly for scale and specificity: a named tool count (275 read, 54 write), a SQL interface to live data instead of a copy, and a runtime that’s shared by Workday’s own agents, not a side door bolted on for third parties. For teams already standardizing on MCP as the connection layer for coding agents (see this site’s primer on the protocol), Workday’s Agent-Ready Tools are a concrete, queryable target worth testing against a sandbox tenant before wiring any write-capable tool into a production workflow.