Connect Sesame to Claude: Automate Contracts and Payroll Data

If your team needs to connect Sesame to Claude to automate HR onboarding, extract multi-currency payroll data, or manage employee contract lifecycles, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's natural language tool calls and Sesame's complex REST APIs. You can either build, host, and maintain this stateful infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL in seconds.

If your team uses ChatGPT, check out our guide on /connect-sesame-to-chatgpt-manage-personnel-and-attendance/ or explore our broader architectural overview on /connect-sesame-to-ai-agents-sync-project-time-and-task-tracking/.

Giving a Large Language Model (LLM) read and write access to a specialized Human Resources Information System (HRIS) like Sesame is a serious engineering challenge. You have to handle token lifecycles, map massive nested JSON schemas to MCP tool definitions, and deal with domain-specific constraints like silent record truncation and strictly enforced relational dependencies. Every time Sesame updates an endpoint or deprecates a core resource, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Sesame, connect it natively to Claude Desktop, and execute complex HR workflows using natural language.

The Engineering Reality of the Sesame API

A custom MCP server is essentially a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against a specialized B2B HR platform is painful. Sesame is built to manage complex European labor laws, intricate time-tracking rules, and strict contract hierarchies. Its API reflects that exact domain complexity.

If you decide to build a custom Sesame MCP server, here are the specific integration challenges you will face:

The Global Company ID Dependency Many of Sesame's most critical creation endpoints - such as create_a_sesame_employee and create_a_sesame_project - require a companyId in the request body. However, an LLM has no inherent context for what this ID is. To get it, the agent must first call list_all_sesame_info to retrieve the Sesame company that owns the current API token. If you are building this yourself, you must inject prompt instructions forcing the LLM to execute this prerequisite step before attempting any creation operations, or build a middleware layer that caches and injects the ID automatically.

Silent Overwrites in Time Tracking Sesame's time-tracking logic is designed to prevent invalid states, but it does so via silent mutation. When calling create_a_sesame_work_entry (or when clocking an employee in/out), overlapping entries for the same employee are overwritten, trimmed, or split. The API does not reject the request, nor does it report the trims in the HTTP response. If an AI agent submits a conflicting timesheet, it will assume success. You must program the LLM to explicitly call list_all_sesame_work_entries immediately after a mutation to verify the actual state of the day's ledger.

Complex Salary and Contract Lifecycles Sesame enforces strict chronological integrity for employee salaries. When you call create_a_sesame_contract_salary, the previous active salary is closed automatically - meaning its end date is mutated to the day before the new start date. If the new salary does not start exactly the day after the previous one ends, Sesame returns a warnings array containing a salary_coverage_gap flag. An LLM needs explicit schema definitions to know to look for this warnings array alongside the standard data payload.

Rate Limits and Upstream Errors Factual note on rate limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Sesame API returns HTTP 429, Truto passes that error directly to the caller. Truto normalizes upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The caller (your LLM framework or application) is strictly responsible for implementing retry logic and backoff. Do not assume the integration layer will absorb rate limit errors.

How to Create a Managed MCP Server for Sesame

Truto eliminates the need to build a custom integration server. Instead, Truto dynamically generates tool definitions from Sesame's documentation records and serves them over a JSON-RPC 2.0 endpoint.

You can create an MCP server for Sesame using either the Truto UI or the Truto API.

Method 1: Via the Truto UI

1. Log into your Truto dashboard and navigate to the Integrated Accounts page.
2. Select your connected Sesame account.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration (e.g., restrict to read-only methods or specific tags).
6. Copy the generated MCP server URL. (e.g., https://api.truto.one/mcp/a1b2c3d4...)

Method 2: Via the Truto API

For platform builders, you can provision MCP servers programmatically. This validates that the integration has tools available, generates a secure token, stores it in distributed KV storage, and returns a ready-to-use URL.

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Sesame HR Assistant",
    "config": {
      "methods": ["read", "write"],
      "tags": ["hr", "payroll"]
    }
  }'

The response will contain your dynamically generated url:

{
  "id": "mcp_8a9b0c1d",
  "name": "Sesame HR Assistant",
  "config": { "methods": ["read", "write"] },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}

Connecting the MCP Server to Claude

Because Truto issues a standard MCP URL, connecting it to Claude requires zero additional code. The URL inherently contains the cryptographic token needed to route the request to the correct Sesame tenant.

Method A: Via the Claude UI (Claude Desktop or ChatGPT)

If you are using the Claude Desktop application or ChatGPT's custom connector UI:

1. Open Settings -> Integrations (or Connectors in ChatGPT).
2. Click Add MCP Server (or Add Custom Connector).
3. Name the connector (e.g., "Sesame HR").
4. Paste the Truto MCP URL into the Server URL field.
5. Click Add or Save. Claude will instantly handshake with Truto, fetching the capabilities and the full list of available Sesame tools.

Method B: Via Manual Config File

If you are configuring Claude Desktop manually or running a headless agent, edit your claude_desktop_config.json file. You will use the official Server-Sent Events (SSE) transport adapter provided by the MCP project.

{
  "mcpServers": {
    "sesame_hr": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f67890"
      ]
    }
  }
}

Restart Claude Desktop. The agent is now securely connected to the Sesame integrated account.

Hero Tools for Sesame

Truto generates highly descriptive, flat-input tools derived directly from Sesame's API documentation. Here are 6 of the highest-leverage tools available for Sesame.

list_all_sesame_info

Retrieves the Sesame company that owns the current API token. This is a critical prerequisite for many write operations, as endpoints like employee creation and office creation require the companyId returned by this tool.

"Before we create the new employee profile for Sarah Jenkins, fetch the current Sesame company info so we have the correct company ID to attach to her record."

list_all_sesame_employees

Lists Sesame employees. Truto handles the pagination natively (100 records per page). You can filter by code, DNI, email, or status (e.g., passing status [in]=active,inactive).

"Pull a list of all active employees in the Engineering department. Return their IDs, emails, and their current work status."

create_a_sesame_work_entry

Creates a time-tracking record (clock-in/clock-out) for an employee. Be aware that overlapping entries for the same employee are silently overwritten, trimmed, or split by Sesame without throwing an error.

"Clock in employee ID 445-A with a standard work entry starting at 09:00 AM today. After executing, fetch their work entries for today to confirm the ledger wasn't silently trimmed due to overlap."

list_all_sesame_contracts_for_payrolls

Retrieves comprehensive payroll data per employee for a specific pay period, date range, and currency. This returns massive payloads containing labor data, active contracts, and salary details.

"Generate a payroll data report for all active employees in the Madrid office for the period between October 1 and October 31, using EUR as the currency."

create_a_sesame_contract_salary

Creates a new salary record for an employee. This operation automatically closes the previously active salary. The tool's schema expects parameters like payPeriod, grossSalary, and contributionGroupId.

"Update the salary for employee ID 992. Set their new gross annual salary to 85000 EUR starting next Monday. Check the response warnings array for a 'salary_coverage_gap' to ensure we didn't leave a billing gap."

create_a_sesame_vacation_day_off_request_accept

Executes a managerial approval for a pending vacation request. It targets a specific vacation_day_off_request_id.

"Approve the pending vacation request ID 8832 for next week. Add a resolution comment saying 'Approved - ensure your Jira tickets are handed off.'"

To view the complete inventory of available Sesame tools, detailed JSON schemas, and query parameters, visit the Truto Sesame Integration Page.

Workflows in Action

With the MCP server connected, Claude can string together multiple Sesame tools to execute complex, multi-step HR operations. Here is how real-world workflows operate under the hood.

1. New Employee Onboarding & Compensation Setup

When HR asks the agent to onboard a new hire, the model must execute a strict sequence of dependencies to build the employee profile, attach their contract, and set their initial salary.

"We just hired Alex Chen as a Senior Developer. Create his employee profile in Sesame. Then, set up his initial indefinite contract and attach a starting salary of 90,000 EUR annually, prorated, starting next Monday."

sequenceDiagram
    participant User
    participant Claude
    participant Truto as Truto MCP Server
    participant Sesame as Sesame API

    User->>Claude: "Onboard Alex Chen..."
    
    Claude->>Truto: Call list_all_sesame_info
    Truto->>Sesame: GET /core/v3/info
    Sesame-->>Truto: Returns companyId
    Truto-->>Claude: companyId: "comp_772"

    Claude->>Truto: Call create_a_sesame_employee<br>{"companyId": "comp_772", "firstName": "Alex"...}
    Truto->>Sesame: POST /core/v3/employees
    Sesame-->>Truto: Returns employee ID "emp_991"
    Truto-->>Claude: employee ID "emp_991"

    Claude->>Truto: Call create_a_sesame_contract<br>{"employeeId": "emp_991", "startAt": "..."}
    Truto->>Sesame: POST /contract/v1/contracts
    Sesame-->>Truto: Returns contract ID
    Truto-->>Claude: Success

    Claude->>Truto: Call create_a_sesame_contract_salary<br>{"employeeId": "emp_991", "grossSalary": 90000...}
    Truto->>Sesame: POST /contract/v1/salaries
    Sesame-->>Truto: Returns salary payload
    Truto-->>Claude: Setup complete
    Claude-->>User: "Alex has been successfully onboarded with his contract and salary attached."

2. Payroll Audit & Anomaly Detection

Finance teams can use Claude to audit payroll ledgers, cross-referencing expected contract data against actual tracked time and recorded clock-in anomalies.

"Audit the payroll data for last month. Pull the payroll contracts list, then cross-reference it against the work entries and check incidences. Flag any employee who had unpaid absences or unresolved check-in anomalies."

1. Claude calls list_all_sesame_contracts_for_payrolls to get the baseline expected compensation and status for all active employees for the previous month.
2. Claude loops through the returned IDs, calling list_all_sesame_work_entries to gather the actual logged time.
3. Claude calls list_all_sesame_check_incidences to look for clocking anomalies (e.g., missing clock-outs, geolocation violations).
4. Claude synthesizes the data, returning a clean markdown table of employees whose logged hours or anomalies deviate from their contract expectations.

3. Automated Time-Off Resolution

Managers can delegate the drudgery of reviewing routine time-off requests by having the agent check overlapping schedules before approving.

"Check all pending vacation requests. If the requesting employee is the only person in their department asking for that specific date range, approve it automatically. Otherwise, list them for my review."

1. Claude calls list_all_sesame_vacation_day_off_requests filtering for status=pending.
2. For each request, it calls list_all_sesame_vacation_day_offs for the specified date range to see who else is already approved for time off.
3. Claude compares department IDs.
4. For non-conflicting requests, Claude calls create_a_sesame_vacation_day_off_request_accept.
5. Claude replies to the user with a summary of the approvals and highlights the conflicting requests requiring human intervention.

Security and Access Control

Exposing core HR and payroll data to an LLM requires strict governance. Truto's MCP architecture provides multiple layers of security to ensure agents only access what they should.

• Method Filtering: When creating an MCP server via /integrated-account/:id/mcp, you can pass config.methods: ["read"]. This hard-gates the server, allowing the LLM to query payroll data but entirely preventing it from executing destructive mutations or generating new contracts.
• Tag Filtering: You can restrict the agent's scope to specific domains using config.tags. By passing tags: ["time_tracking"], the MCP server will omit all payroll, salary, and recruitment tools, surfacing only the tools necessary for clocking and attendance.
• Require API Token Auth: By setting require_api_token_auth: true, possession of the MCP URL is no longer sufficient. The connecting client must also pass a valid Truto API token in the Authorization header, preventing unauthorized internal access if the URL leaks in chat logs.
• Ephemeral Servers: You can pass an expires_at ISO datetime when provisioning the server. Truto uses distributed KV storage and background alarms to automatically tear down the server and revoke the token at the exact minute specified - ideal for temporary audit workflows.
• Zero Storage Execution: Truto delegates tool execution directly to its proxy API layer. Payloads pass through memory in real-time; Truto does not cache Sesame payroll data or contract contents in a database.

Moving Beyond Workflow Automation

Connecting an LLM to an HRIS like Sesame transforms how administrative work gets done. Instead of dragging a user interface through fifty clicks just to adjust a salary or resolve a time-tracking anomaly, you can command the system using intent.

By utilizing Truto's managed MCP architecture, you bypass the massive technical debt of building and maintaining custom OAuth handlers, nested schema mappings, and rate limit normalization. You get a secure, dynamic, documentation-driven toolset that stays perfectly in sync with the Sesame API.

Ready to give your AI agents production-grade access to Sesame? Explore the Truto platform and start building declarative, LLM-native integrations today.