Automation team · executive preview

ADP, in plain English

Ask a question in Claude, get a live answer from Workforce Now. No logins, no reports, no waiting. It is read-only by design: it can show you anything you are entitled to see, and it cannot change a thing.

You ask Claude

"How many people did we hire this quarter?"

›

Secure connector

TWC-hosted, encrypted, your access only

›

ADP answers

Live from Workforce Now, read-only

What you can ask

Plain language. Ask the way you would ask a person, then ask follow-ups.

People & headcount

"How many people are employed right now?"

"Headcount by department."

"Headcount by role."

"Who did we hire recently, and into which teams?"

Spend & compensation

"Spend by department."

"Spend by role."

"Salary vs variable comp, and total comp."

"What is the pay-grade band for this role?"

Department, role, and variable-comp roll-ups populate as those ADP scopes are enabled.

Hours & time off

"What were this employee's hours last pay period?"

"Show daily totals by pay code for a worker."

"PTO balances and time off taken."

"Who logged overtime recently?"

Payroll

"What were the last three payroll runs?"

"Summarize the most recent payroll cycle."

Recent cycles are the reliable window; older detail is retention-limited by ADP.

Unit economics & trends

"Show department and role spend over time so I can see the trend."

"Feed headcount and workforce cost into cost per patient," paired with your unique patient count as the denominator.

"Exclude restructuring costs (severance, overlapping hires) so the trend is not skewed." Available once those are tagged in ADP.

Anything else in your HR data

Beyond the shortcuts above, it can read any HR record you are entitled to and explain it in plain language. Ask for a summary, ask it to compare, ask a follow-up. If ADP holds the answer and you are allowed to see it, you can just ask.

What it looks like

How many active employees do we have, and how are they split by state?

You have an active workforce across your operating states. Here is the split by state, largest first, with the active total at the top. Want me to compare this to the same point last quarter? Illustrative. Live answers are pulled from ADP at the moment you ask.

What were the last two payroll runs?

Here are your two most recent payroll cycles with run dates and totals. I can break either one down further by earnings, deductions, or department. Read-only. It reports what ran; it never runs or changes payroll.

How to use it

Two ways in. Most people want Track A: add it to the Claude app and start asking. Track B is for anyone who works in Claude Code or a desktop config.

Track A

Use it in the Claude app

Web or desktop · nothing to install

Open Claude and go to Settings > Connectors.
Click Add custom connector. (If you do not see it, your workspace admin enables custom connectors once, org-wide.)
Name: type ADP.
URL: paste the secure link we send you (ends in /mcp).
Authentication: choose Bearer token and paste your access key.
Click Save, open a new chat, and toggle the ADP connector on.
Ask your first question. Done.

We deliver the link and key privately through 1Password. The key is yours alone, and can be rotated or switched off in one step.

Track B

Install in the terminal (Claude Code)

One command · for terminal users

Paste this single command, swapping in the link and key we send you:

claude mcp add --transport http adp \
  "https://<your-endpoint>/mcp" \
  --header "Authorization: Bearer <your-key>" \
  --scope user

Confirm it connected:

claude mcp list   # shows:  adp  ✓ Connected

Restart Claude Code (it loads connectors at startup), then ask: "How many people are employed?" To remove it later: claude mcp remove adp -s user

Where it lives and how it connects

💬

Claude (app or Claude Code)

Where you ask. Sends your question to the connector over HTTPS with your private access key attached.

encrypted HTTPS + bearer key

🔒

ADP connector, hosted on TWC AWS

A small always-on service in our own AWS account (us-east-2). It checks your key, then translates your question into the right ADP read call. This is where the read-only rules and access scoping are enforced.

certificate (mutual TLS) + short-lived token

🔑

ADP credentials in AWS Secrets Manager

The ADP certificate and keys never live in the app or in code. They sit in an encrypted vault the connector reads at run time, tied to your own ADP identity for a clean audit trail.

ADP API Central

🏢

ADP Workforce Now

The system of record. Answers the read request live and returns the data, which Claude turns back into plain language for you.

Nothing is copied or cached to a separate database. Every answer is a live read at the moment you ask, then it is gone.

The full logic

Authenticate you first. Every request must carry your private bearer key. No key, no answer, so the request is rejected before it reaches ADP.
Authenticate to ADP. The connector presents a client certificate (mutual TLS) and exchanges it for a short-lived access token, refreshed automatically. Credentials come from the encrypted vault, never hard-coded.
Route to the right access. ADP splits permissions across several access profiles (demographics, pay, time). The connector knows which profile carries which data and sends each read down the one that has the scope, automatically trying the next if a profile lacks it.
Enforce read-only. The connector can only ever issue a read, and only against an approved list of ADP data paths. There is no code path that can write, update, or delete. This is a structural guarantee, not a setting.
Fetch just enough. For list questions it pages through results in bounded batches and stops as soon as it has what your question needs, so a "show me a few" never turns into a full-table pull.
Answer in plain language. ADP returns structured data; Claude summarizes it, and you can immediately ask a follow-up, a breakdown, or a comparison.

The tools it exposes

search_workers	List and filter the employee roster (status, location, hire date, department).
get_worker	Full record for one employee by ID.
get_compensation	Pay-grade bands and, where scope is enabled, individual pay detail.
get_time_cards	Daily hour totals by pay code for a worker over a period.
list_payroll_runs	Recent payroll output runs with dates and totals.
adp_get / adp_get_all	A guarded, read-only catch-all for any other HR data you are entitled to.

Safe by design

Read-only, always

It can look at anything you are entitled to and change nothing. There is no path to edit, run, or delete. Making changes would be a separate, deliberately gated capability.

Your access, attributed to you

It runs under your own ADP identity, so every read is logged as yours, scoped to what you are permitted to see, and revocable in one step.

Locked down to your key

This is the most sensitive data we hold, salaries and pay, so access is restricted to your own key and ADP identity, read-only, revocable instantly, and it goes live once Security signs off on the data handling.

Encrypted end to end

Certificate-based authentication to ADP over an encrypted connection, hosted on TWC infrastructure, gated by a private access key.

← back to all tools · Want this live? Ask ADP + Domo