Connect Kallidus to Claude: Sync Training Progress and User Groups

If your team needs to connect Kallidus to Claude to automate compliance reporting, sync training progress, or orchestrate user group management, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's natural language tool calls and the Kallidus REST API. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses ChatGPT, check out our guide on connecting Kallidus to ChatGPT or explore our broader architectural overview on connecting Kallidus to AI Agents.

Giving a Large Language Model (LLM) read and write access to a specialized Learning Management System (LMS) like Kallidus is an engineering challenge. You have to handle API token lifecycles, map complex reporting schemas to MCP tool definitions, and deal with Kallidus's domain-specific data constraints. Every time the API updates an endpoint or deprecates a field, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Kallidus, connect it natively to Claude Desktop, and execute complex learning management workflows using natural language.

The Engineering Reality of the Kallidus API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools over JSON-RPC 2.0, the reality of implementing it against specialized B2B APIs is painful. Kallidus is built to manage complex compliance matrices, large organizational hierarchies, and detailed course reporting. Its API architecture reflects that complexity.

If you decide to build a custom Kallidus MCP server, here are the specific integration challenges you will face:

The DEx API Reporting Lag Most integrations assume they are talking to a real-time transactional database. Kallidus operations heavily utilize their Data Extraction (DEx) API. This is a reporting database optimized for heavy read workloads, and crucially, it is refreshed multiple times a day—not in real-time. If Claude creates a user assignment in one step and tries to query the DEx API for that assignment in the next step, the data will not be there yet. An effective MCP server needs precise documentation injected into the tool descriptions so the LLM understands this temporal delay and does not hallucinate data or throw false "record not found" errors.

Relational Bridge Tables Instead of Nested Objects Modern REST APIs often return nested arrays (e.g., a user object containing a groups array). Kallidus uses a highly relational model with bridge tables. To find out which user is in which group, or which user has which job profile, you must query isolated resources like user_group_bridges and user_job_profile_bridges. An LLM naturally looks for nested data. You must explicitly expose these bridge tables as separate tools and instruct the LLM on how to perform relational joins in its context window.

Strict Server-Driven Pagination Kallidus endpoints often return up to 5,000 records per page, using server-driven pagination via $skip or nextpagelink parameters. If an LLM tries to process a full 5,000-record JSON payload, it will blow out its context window and crash. Your MCP server must inject cursor-handling logic into the tool definitions, instructing the LLM to only fetch small chunks (limit: 50) and explicitly pass the next_cursor value back unchanged during subsequent tool invocations.

Step 1: Generating the Kallidus MCP Server

Truto solves the integration maintenance problem by dynamically generating MCP tools directly from the underlying API's OpenAPI schemas and documentation records. When you connect a Kallidus instance to Truto, the platform creates an "integrated account." From there, you can generate an MCP server URL that contains a cryptographically hashed token.

There are two ways to generate this server.

Method A: Via the Truto UI

For teams who want a zero-code setup:

1. Navigate to the Integrated Accounts page in your Truto dashboard and select your Kallidus connection.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Configure the server (add a name, select allowed methods like read or write, and set an optional expiration date).
5. Click Save and copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5...).

Method B: Via the API

For teams embedding this into an automated provisioning pipeline, you can generate the MCP server programmatically. Truto will validate the requested filters, generate a secure hex token, hash it for edge storage, and return the endpoint.

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Kallidus Compliance Auditor",
    "config": {
      "methods": ["read"],
      "tags": ["compliance", "users"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The response contains the secure URL you will provide to Claude:

{
  "id": "mcp-789-xyz",
  "name": "Kallidus Compliance Auditor",
  "config": { "methods": ["read"], "tags": ["compliance", "users"] },
  "expires_at": "2026-12-31T23:59:59Z",
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

Note on Rate Limiting: Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Kallidus API returns an HTTP 429, Truto passes that error to the caller. Truto normalizes upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The calling AI agent or script is responsible for implementing retry/backoff logic.

Step 2: Connecting the MCP Server to Claude

Once you have the URL, you need to register it with your Claude environment. Because Truto's MCP servers are fully self-contained (the URL encodes the tenant, the token, and the API boundaries), configuration is trivial.

Method A: Via the Claude UI (Desktop/Web)

1. Open Claude and navigate to Settings.
2. Click on Integrations (or Connectors depending on your tier).
3. Click Add MCP Server or Add custom connector.
4. Paste the Truto MCP URL (https://api.truto.one/mcp/...) and save.

Claude will immediately perform a protocol handshake (initialize) and request the available tools (tools/list).

Method B: Via Manual Config File

If you are running custom agentic frameworks or prefer configuring Claude Desktop manually, you can edit the claude_desktop_config.json file. Truto supports Server-Sent Events (SSE) bridging for clients that expect standard input/output (stdio) communication.

{
  "mcpServers": {
    "kallidus_prod": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Save the file and restart Claude Desktop. The agent is now connected to Kallidus.

High-Leverage Hero Tools for Kallidus

Truto automatically derives tool schemas from the Kallidus API documentation. Instead of generic CRUD methods, Claude sees descriptive, snake_case tool names with fully documented input properties.

Here are the most critical tools for LMS automation.

list_all_kallidus_users

This tool retrieves user identity records from the Kallidus Reporting API. It is the starting point for almost all compliance and group management workflows.

Contextual Note: Because the DEx API returns up to 5,000 records per page, Claude will be instructed via the schema to use the limit parameter and strictly pass back the next_cursor when iterating through large corporate directories.

"Fetch the first 50 active users from Kallidus. I need their user IDs and email addresses to check against our internal HR directory."

list_all_kallidus_courses

Retrieves the primary catalog of training courses. Course IDs are required to look up lesson statuses and compliance details.

Contextual Note: Course data is refreshed multiple times daily. If a new course was created five minutes ago in the Kallidus UI, it may not appear in this list until the next DEx sync.

"List all active Kallidus courses related to 'Cybersecurity' or 'Data Privacy'. Note their unique course IDs for our compliance audit."

list_all_kallidus_lesson_statuses

Retrieves the learning progress data for specific users and courses. This is the core transactional tool for determining who has finished their required training.

Contextual Note: This tool accesses the Learning Progress dataset. The AI uses this to check statuses like Completed, In Progress, or Not Started against specific lesson IDs.

"Using the course ID for 'Annual Security Awareness', check the lesson statuses for the marketing team to see who has not completed the module."

list_all_kallidus_compliance_details

Provides a deeper breakdown of compliance requirements versus actuals. While lesson statuses tell you if a user took a course, compliance details track expiration dates, renewal windows, and overall compliance posture.

Contextual Note: This data comes from the Compliance Details dataset. It is essential for auditing regulatory training that expires annually.

"Pull the compliance details for the engineering department. Identify any individuals whose 'ISO 27001' compliance status will expire within the next 30 days."

list_all_kallidus_user_group_bridges

Because Kallidus uses a relational data model, this tool is required to map users to their respective groups.

Contextual Note: Claude must first fetch user IDs and group IDs separately, then use this bridge tool to understand the intersections. This prevents the API from returning bloated, deeply nested objects.

"List the user group bridges for the group ID corresponding to 'EMEA Sales'. Cross-reference these bridge IDs with the user directory to give me a list of names."

For the complete inventory of available tools, query schemas, and return types, view the Kallidus integration page.

Workflows in Action

Once connected, Claude can orchestrate multi-step data retrieval and analysis tasks that would otherwise require manual spreadsheet exports and VLOOKUPs.

Workflow 1: Auditing Compliance Gaps for a Specific Job Profile

Compliance officers frequently need to ensure that specific roles (e.g., Warehouse Staff) have completed mandatory safety training.

"Find all users assigned to the 'Warehouse Staff' job profile who have a non-compliant or expired status for the 'Forklift Safety' course."

Execution Steps:

1. list_all_kallidus_job_profiles: Claude queries the profiles to find the exact system ID for "Warehouse Staff".
2. list_all_kallidus_user_job_profile_bridges: Claude fetches the bridge records linking the "Warehouse Staff" profile ID to specific user IDs.
3. list_all_kallidus_courses: Claude finds the system ID for the "Forklift Safety" course.
4. list_all_kallidus_compliance_details: Claude queries the compliance records using the course ID, then cross-references the non-compliant records against the user IDs found in step 2.

Result: Claude outputs a clean, markdown-formatted list of specific warehouse employees who are out of compliance, completely abstracting the complex relational joins.

sequenceDiagram
    participant Claude as Claude Desktop
    participant MCP as Truto MCP Server
    participant Kallidus as Kallidus DEx API
    Claude->>MCP: Call list_all_kallidus_job_profiles
    MCP->>Kallidus: Proxy request (with normalized pagination)
    Kallidus-->>MCP: Profile records
    MCP-->>Claude: Flat JSON array
    Claude->>MCP: Call list_all_kallidus_user_job_profile_bridges
    MCP->>Kallidus: Fetch relational bridge data
    Kallidus-->>MCP: Bridge IDs
    MCP-->>Claude: Bridge records

Workflow 2: Mapping New Hires to User Groups

HR administrators need to ensure that newly provisioned users are mapped to the correct organizational groupings for reporting purposes.

"List all active users created this week and cross-reference them with the user group bridges to see who is missing an onboarding group assignment."

Execution Steps:

1. list_all_kallidus_users: Claude fetches recent users (applying query parameters to filter by creation date if supported, or iterating through the latest records).
2. list_all_kallidus_user_groups: Claude retrieves the ID for the "Onboarding" group.
3. list_all_kallidus_user_group_bridges: Claude pulls the bridge records and identifies which recent user IDs are missing a link to the Onboarding group ID.

Result: Claude identifies the discrepancy and highlights exactly which new hires fell through the cracks during the automated provisioning process.

Security and Access Control

Exposing an enterprise LMS to an AI model requires strict governance. Truto provides several mechanisms to lock down the MCP server before it ever reaches Claude:

• Method Filtering (config.methods): Restrict the server to read-only access. By setting methods: ["read"], you guarantee the LLM can only execute get and list operations, preventing it from accidentally deleting users or altering compliance records.
• Tag Filtering (config.tags): Scope access by domain. If the Kallidus integration has tagged resources (e.g., ["compliance"]), you can restrict the MCP server to only expose tools related to those tags, hiding sensitive HR directory information.
• Secondary Authentication (require_api_token_auth): By default, the MCP URL is the only secret needed. Enabling this flag forces the client to also pass a valid Truto API token in the Authorization header, meaning possession of the URL alone is useless.
• Ephemeral Access (expires_at): You can generate a server with a strict time-to-live. Once the timestamp is reached, the underlying Key-Value storage drops the hashed token, and a durable alarm cleans up the database record, instantly severing the LLM's access to Kallidus.

Final Thoughts on LLM to LMS Integrations

Connecting Claude to Kallidus fundamentally changes how organizations interact with their compliance and training data. Instead of forcing administrators to navigate complex BI dashboards or execute raw SQL queries against data lakes, you can just ask questions.

By utilizing Truto's managed MCP architecture, you sidestep the engineering debt of maintaining OAuth refresh loops, building complex pagination handlers, and writing custom schema mapping logic for Kallidus's highly relational API. You get an enterprise-grade translation layer that keeps your data secure and your AI agents grounded in reality.