FSHC-Cube MCP

One MCP server that bundles ten FSHC back-end systems behind a single set of 40 tools (release 26.9.29, 2026-09-29):

| System | What it exposes | Access | | ----------------- | --------------------------------------------------------------------------------------- | ------------------ | | PCC Relay | PointClickCare ODS (SQL Server) — census, billing, clinical, etc. | Read-only SELECT | | UKG WFM | Workforce Management — timecards, punches, accruals, leave, attendance, people | Read-only | | UKG HCM | Human Capital Management — personnel, payroll, employee data | Read-only | | TELOS | Telos LTC — resident Medicaid eligibility (status, renewals, coverage, MESAV) | Read-only SELECT | | NetHealth DW | NetHealth data warehouse (SQL Server) — therapy/rehab | Read-only SELECT | | Acumatica ERP | Acumatica financials (PostgreSQL) — AP/AR/GL activity from the daily SFTP export | Read-only SELECT | | Waystar SFTP | Claims clearinghouse batch files (PostgreSQL) — claim status (X12 277), HQ remittance | Read-only SELECT | | Waystar API | Live Waystar calls — claim history, proof-of-timely-filing PDF, EOB documents, eligibility | Read-only calls | | ATTOM | County deed & mortgage recorder filings (PostgreSQL) — sales, owners, lenders, amounts | Read-only SELECT | | Align30 | Employee and resident-family engagement surveys (PostgreSQL) — invitations, responses | Read-only SELECT |

Every call is relayed through an N8N webhook that injects the real credentials. This server stores no API keys, passwords, or connection strings — only a shared relay token that you provide at install time. All operations are read-only.

The one exception is the handoff pair (cube_send_handoff, cube_handoffs): on your explicit request they post a short question to a named colleague in the FSHC Teams channel and read the reply back. Who it comes from is taken from your token, never from the message.

Once installed, you just ask in natural language — e.g. "what was employee 008579's timecard last month?", "census count for June 29", "Jeff Patel's contact info" — and the assistant discovers the right endpoint and runs the query for you.

Before you start

You need one thing from your administrator: the FSHC-Cube relay token. It is required for every install method. Without it the server will not start.

The token authenticates you to the FSHC-Cube relay. Treat it like a password — do not share it or commit it to code.

Pick the install path that matches your tool:

• Option A — Desktop Extension — for Claude Desktop, Cowork, and similar GUI agents that support MCP Bundles (.mcpb). No technical setup. Recommended for most users.
• Option B — npx / config — for Claude Code and any client configured with an MCP JSON file (Cursor, Windsurf, etc.). Requires Node.js.

Option A — Desktop Extension (one-click)

For: Claude Desktop, Cowork, or any desktop agent that supports MCP Bundles (.mcpb / .dxt). Prerequisites: none — the bundle ships its own runtime.

1. Download

Download fshc-cube-mcp.mcpb from the GitLab repo:

Download: https://gitlab.com/<your-group>/<your-repo>/-/releases (replace with your actual GitLab release/download URL)

Save it anywhere (e.g. your Downloads folder).

2. Install

1. Open your agent → Settings → Extensions.
2. Drag fshc-cube-mcp.mcpb onto the window, or click “Install extension” and select the file. (On most systems you can also just double-click the .mcpb file to open the install dialog.)
3. Review the extension card and click Install.

3. Enter your token

When prompted for “Relay Token”, paste the token from your administrator. The field is masked because it’s stored securely by the app.

4. Turn it on

Toggle the FSHC-Cube MCP extension on. That’s it — the 40 tools are now available. Start a new chat and try: "list the census views in PCC".

Updating

When a new fshc-cube-mcp.mcpb is published to GitLab, download it and install again — it replaces the previous version. Your token is preserved (or re-enter it if asked).

Uninstalling

Settings → Extensions → FSHC-Cube MCP → Remove.

Option B — npx / config clients

For: Claude Code, Cursor, Windsurf, or any client that uses an MCP configuration file. Prerequisites: Node.js 18 or newer installed and on your PATH (node --version).

The server is published to npm as @acordova_ai/fshc-cube-mcp. You never clone or npm install it — npx downloads and caches it automatically on first run.

Claude Code (one-liner)

Windows (PowerShell or CMD):

claude mcp add fshc-cube -s user --env FSHC_CUBE_TOKEN=YOUR_TOKEN_HERE -- cmd /c npx -y @acordova_ai/fshc-cube-mcp

macOS / Linux:

claude mcp add fshc-cube -s user --env FSHC_CUBE_TOKEN=YOUR_TOKEN_HERE -- npx -y @acordova_ai/fshc-cube-mcp

Verify it registered:

claude mcp list

Generic MCP config (Cursor, Windsurf, Claude Desktop config file, etc.)

Add this to your client’s MCP config file (e.g. claude_desktop_config.json, .cursor/mcp.json, .mcp.json).

Windows — a cmd /c wrapper is required (bare npx will not spawn on Windows):

{
  "mcpServers": {
    "fshc-cube": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "@acordova_ai/fshc-cube-mcp"],
      "env": { "FSHC_CUBE_TOKEN": "YOUR_TOKEN_HERE" }
    }
  }
}

macOS / Linux:

{
  "mcpServers": {
    "fshc-cube": {
      "command": "npx",
      "args": ["-y", "@acordova_ai/fshc-cube-mcp"],
      "env": { "FSHC_CUBE_TOKEN": "YOUR_TOKEN_HERE" }
    }
  }
}

Restart the client after editing the config.

Updating

npx caches the package it downloaded first. To move to a new release, pin the version in your config (@acordova_ai/[email protected]) or run it once with @latest:

npx -y @acordova_ai/fshc-cube-mcp@latest

Using it — tools and example prompts

You normally don’t call tools directly; you ask in plain language and the assistant picks the right one. The tools follow a discover → describe → call pattern.

| System | Tools | | ---------------- | ----------------------------------------------------------------------------- | | WFM | wfm_list_endpoints → wfm_get_endpoint → wfm_request | | HCM | hcm_list_endpoints → hcm_get_endpoint → hcm_request | | PCC | pcc_list_schemas → pcc_get_schema → pcc_run_query | | TELOS | telos_list_schemas → telos_get_schema → telos_run_query · plus telos_get_mesav (live REST) | | NetHealth | nethealth_list_schemas → nethealth_get_schema → nethealth_run_query | | Acumatica | acumatica_list_schemas → acumatica_get_schema → acumatica_run_query | | Waystar SFTP | waystar_list_schemas → waystar_get_schema → waystar_run_query | | Waystar API | waystar_api_get_claim_history → waystar_api_get_timely_filing_proof · waystar_api_get_eob · waystar_api_check_eligibility · waystar_api_check_claim_status · … | | ATTOM | attom_list_schemas → attom_get_schema → attom_run_query | | Align30 | align30_list_schemas → align30_get_schema → align30_run_query | | Handoff | cube_send_handoff · cube_handoffs — ask a named colleague in Teams, read the reply |

• *_list_endpoints / pcc_list_schemas — search the catalog to find the right operation/view.
• *_get_endpoint / pcc_get_schema / telos_get_schema — get the exact parameters / columns before building a call.
• *_request / pcc_run_query / telos_run_query — execute the read.
• telos_get_mesav — the one exception to the pattern: a live REST call to the TELOS API for one resident's Medicaid eligibility record, rather than a read of the mirror. Use it when currency matters; telos.telos_mesav_* holds what the nightly sync last saw.
• Waystar API has its own order: waystar_api_get_claim_history first (XML) — it returns Waystar's own ClaimID and InstanceID for each instance of the claim — then waystar_api_get_timely_filing_proof for the proof-of-timely-filing PDF and waystar_api_get_eob for the remittance document. custId is always the facility's Waystar account, not the parent. Claim status and real-payer eligibility work as far as Waystar has enabled them — see Troubleshooting.
• Handoff is not a data tool: cube_send_handoff posts your question to one named person in Teams (only when you ask), cube_handoffs shows what was sent and any replies.

WFM is preferred for workforce questions (time, attendance, leave, employees); HCM is used for HR/payroll data WFM doesn’t hold; PCC for clinical/census/billing data; TELOS for resident Medicaid eligibility (status, renewal/recert dates, coverage, applied income, managed care — the telos schema, 55 relations, queried with SQL); Align30 for engagement surveys (daily snapshots — use the v_*_current views for "today").

Example prompts

• "Show me employee 008579’s timecard for last month." → WFM
• "How many patients were in census on June 29?" → PCC
• "What’s Jeff Patel’s contact info?" → HCM
• "List the WFM leave endpoints." → WFM discovery
• "What columns does the daily census view have?" → PCC schema
• "Which residents have a Medicaid renewal due this quarter?" → TELOS
• "Is this resident's Medicaid coverage active right now?" → TELOS telos_get_mesav (live); the report tables answer "as of the last sync", which is a different question
• "What did 1234 Main St last sell for, and who financed it?" → ATTOM
• "How many property transfers were recorded in Duval County in Q2?" → ATTOM
• "Has the payer acknowledged claim ABC-123, and when?" → Waystar API claim history
• "Get me the proof of timely filing for that claim." → Waystar API (PDF, via the claim's ClaimID and InstanceID from the history)
• "Show the remittance / EOB for claim ABC-123." → Waystar API EOB
• "What did new hires say in last month's pulse survey?" → Align30
• "Ask Jeff whether the September census file is final." → Handoff (Teams)

How it works

your prompt
  → assistant picks a tool and builds the call
  → MCP sends POST { token, ... } to the FSHC-Cube N8N webhook (one per system)
  → N8N validates the token, injects the real credentials, calls the system
  → data comes back → assistant answers

• WFM / HCM send a descriptor { token, method, path, query, body }. N8N prepends the base URL and injects the real auth (WFM OAuth2; HCM Basic + customer key).
• PCC sends { token, action, sql | table | domain+search } where action is query, schema, or list.
• TELOS sends { token, action, ... } — query (a read-only SQL SELECT against psql_source.telos), schema, list, or mesav (a live call to the TELOS API for one resident's Medicaid eligibility record).
• NetHealth / Acumatica / Waystar SFTP / ATTOM / Align30 each use their own webhook per action and send { token, action, sql | table | domain+search }, same as PCC. Their table catalogs and column docs are served from the relay host (/opt/<service>-schema-docs, /opt/attom for ATTOM and /opt/align30 for Align30) rather than bundled, so a schema change needs no MCP release.
• Waystar API sends { token, action, ... } to one consolidated webhook that routes each Waystar product internally; the relay holds the Waystar credentials and signs each request. Documents (proof of timely filing, EOB) come back as base64 PDFs with their byte count — the assistant reports the size, it never prints the base64.
• Handoff sends { token, action: send | pending | status, ... }; who is asking comes from the token, never from the message body.

Security

• No credentials in the client. The MCP holds only the relay token; all API secrets live in N8N.
• Read-only. *_request allows only GET and documented POST …/multi_read reads; every *_run_query allows only a single SELECT / WITH statement. Writes and DDL are blocked.
• Least exposure. Only the operational + reference data endpoints are bundled; system-administration endpoints are excluded.
• Handoff is the only write-adjacent tool, and what it writes is a chat message to a colleague — only on your explicit request, never on its own.

Troubleshooting

| Symptom | Cause / fix | | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | “FSHC_CUBE_TOKEN is not set” and the server won’t start | The token wasn’t provided. Re-enter it (Option A: Extensions settings; Option B: the env block / --env). | | Nothing happens / “command not found” on Windows (Option B) | Use the cmd /c npx … form shown above, not bare npx. | | node not found (Option B) | Install Node.js 18+ and reopen the client. (Option A doesn’t need Node.) | | A WFM query returns empty for another employee | Client-credentials access is governed by the relay’s Function Access Profile (FAP). Ask your admin to confirm the FAP covers that employee. | | A PCC census/date query is slow or times out | The daily census mart is heavy. Prefer exact-date filters and small TOP N; large date-range aggregates can take 10–35s. | | An ATTOM/SQL query returns “empty response from webhook” | Usually a token problem, not an empty result: the relay's token gate returns an empty response rather than an auth error. Re-check the token before assuming the query matched no rows. | | Tools don’t appear after install | Restart the client. For Option B, confirm the config file is valid JSON. | | A Waystar call answers “Missing required parameter(s): claimId, dos”, or rejects responseType: XML | Your extension is older than 26.9.29. Download the current .mcpb and reinstall (Option A), or pin @26.9.29 (Option B). | | Proof of timely filing answers HTTP 401 “Invalid domain relationship” | The ClaimID/InstanceID do not belong to that custId. Use the facility’s own Waystar account and the ids from that account’s claim history. | | Waystar claim status times out (~55 s) | Known and on Waystar’s side as of 2026-09-29; each attempt spends one of the included status inquiries. Use claim history until it is resolved. | | An Align30 count looks far too high | Every Align30 table is a daily snapshot — one row per record per ingestion_date. Filter one day, or use the v_*_current views. |

Full technical reference

README.md is the install-and-use guide. The complete engineering reference — every service, webhook URL, schema, secret location, ETL runbook, gotcha and architecture decision — lives in docs/cube-mcp/ (six documents plus the handoff contract). Start with 00-overview.md. Not shipped in the .mcpb.

Support

Contact your FSHC-Cube administrator for the relay token, access (FAP) questions, or to report an issue.

Data scope: read-only. No credentials are stored in this client.