Workday VNDLY MCP Server
for AI Agents
Connect your AI agent to StackOne's Workday VNDLY MCP server and give it 59 MCP tools out of the box. Auth, tool execution, and security all managed.
StackOne 
Coverage
59 Agent Actions
Create, read, update, and delete across Workday VNDLY — and extend your agent's capabilities with custom actions.
Authentication
Agent Tool Authentication
Per-user OAuth in one call. Your Workday VNDLY MCP server gets session-scoped tokens with zero credentials stored on your infra.
Agent Auth →
Security
Agent Protection
Every Workday VNDLY tool response scanned for prompt injection in milliseconds — 88.7% accuracy, all running on CPU.
Prompt Injection Defense →
Performance
Max Agent Context. Min Cost.
Free up to 96% of your agent's context window to enhance reasoning and reduce cost, on every Workday VNDLY call.
Tools Discovery →What is the Workday VNDLY MCP Server?
A Workday VNDLY MCP server lets AI agents read and write Workday VNDLY data through the Model Context Protocol — Anthropic's open standard for connecting LLMs to external tools. StackOne's Workday VNDLY MCP server ships with 59 pre-built actions, fully extensible via the Connector Builder — plus managed authentication, prompt injection defense, observability, and agent execution runtime. Connect it from MCP clients like Claude Desktop, Claude Code, Cursor, Goose, and VS Code, or from agent frameworks like OpenAI Agents SDK, LangChain, and Vercel AI SDK.
All Workday VNDLY MCP Tools
Every action from Workday VNDLY's API, ready for your agent. Create, read, update, and delete — scoped to exactly what you need.
Applicants
- List Applicants
View Applicant list
- Get Applicant
View Applicant details
Checklist Actions
- List Checklist Actions
View list of Checklist Actions
- Get Checklist Action
Get a single checklist action
Contractors
- List Contractors
View contractor list
- Get Contractor
View contractor details
Custom Fields
- List Custom Fields
View metadata definition for all custom fields, and use this data to interpret custom fields on specific API responses.
- Get Custom Field
View metadata definition for a specific custom field, and use this data to interpret custom fields on specific API responses.
Custom Reports
- List Custom Reports
List custom reports accessible to the user
- Get Custom Report
View custom report results
Jobs
- List Jobs
View list of jobs
- Get Job
View job details
Organizations
- Create Organization
Create organization unit
- List Organization
View list of organization units
- Get Organization
View organization unit details
- Update Organization
Update organization unit details
- Delete Organization
Deactivate organization unit
Purchase Order Changes
- List Purchase Order Changes
Retrieve list of purchase order change
- Get Purchase Order Change
Retrieve details of a specific purchase order change
Purchase Requests
- List Purchase Requests
Retrieve list of purchase requests
- Get Purchase Request
Retrieve details of a specific purchase request
Scim Users
- Create Scim User
Create a new employee.
- List Scim Users
Get a list of all SCIM Users
- Get Scim User
View individual user
- Update Scim User
Update user details
- Delete Scim User
Call this method with the id of the employee that you would like to deactivate. This user will not be deleted, and a user cannot deactivate themselves. Contractors and workers cannot be deactivated with this endpoint.
Statement Of Works
- List Statement Of Works
View list of Statement of Works
- Get Statement Of Work
View SOW details
Change Orders
- List Change Orders
View list of Change Orders
- Get Change Order
View Change Order details
Users
- Create User
Create user
- List Users
View list of users
- Get User
View user details
- Update User
Update user details
- Delete User
Deactivate user
Vendors
- List Vendors
View list of vendors
- Get Vendor
View vendor details
Work Orders
- List Work Orders
View list of Work Orders
- Get Work Order
View Work Order details
Other (20)
- List Approvals
View list of Approvals in 'Ready' state. Must have WORKFLOW_READ permission.
- List My Approvals
View user's owned list of Approvals in 'Ready' state.
- Get Connection
Verifies that the VNDLY API token and tenant are valid by fetching the change-feed (a light, always-authorized endpoint).
- List Change Feed
View Change Feed Events corresponding to the state changes of certain API resources within a specified timing window. The difference between the start date and end date of the window cannot exceed the default value of 30 days.
- Get Work Site
View work site details
- My Approval Summary
View count of owned Approvals by component type in 'Ready' state.
- Approval Summary
View count of Approvals by component type in 'Ready' state. Must have WORKFLOW_READ permission.
- Mark Checklist Action
Mark the action as True or False to indicate completion. Actions marked as True will attempt to advance the actions' recipient in any workflow processes. The last_completed field is required when marking the action as True.
- Unwaive Checklist Action
Unwaive a checklist action that is currently in a Waived status.
- Waive Checklist Action
Waive a checklist action that is not in one of the completed statuses. This should be done to indicate the action is no longer required to be completed. Waiving actions will attempt to advance the actions' recipient in any workflow processes.
- Patch Contractor
Patch contractor details
- Patch Organization
Patch organization unit details
- Acknowledge Purchase Order Change
Acknowledge purchase order change
- Approve Purchase Order Change
Approve purchase order change. Billable proposed charge codes must be included in purchase_order_lines with a non-empty purchase_order_line_number.
- Reject Purchase Order Change
Reject purchase order change
- Acknowledge Purchase Request
Acknowledge purchase request
- Approve Purchase Request
Approve purchase request. Billable charge codes must be included in purchase_order_lines with a non-empty purchase_order_line_number.
- Reject Purchase Request
Reject purchase request
- Patch Scim User
Workday VNDLY follows the official SCIM patch [RFC](https://www.rfc-editor.org/rfc/rfc7644#section-3.5.2). We currently only support 'eq' filters.
- Patch User
Patch user details
Workday VNDLY AI Agent Use Cases
Connect your AI agent to Workday VNDLY and help your team scale the recruiting operations they run by hand today.
Use StackOne to connect your AI agent to your ATS and job boards to automate job posting distribution.
ViewUse StackOne to connect your AI agent to your ATS, survey tools, and messaging systems to automate reference checks.
ViewUse StackOne to connect your AI agent to your HRIS, identity management, and LMS to automate employee onboarding.
ViewSet Up Your Workday VNDLY MCP Server in Minutes
One endpoint. Any framework. Your agent is talking to Workday VNDLY in under 10 lines of code.
Agent Frameworks
JSON{
"mcpServers": {
"stackone": {
"command": "npx",
"args": [
"-y",
"mcp-remote@latest",
"https://api.stackone.com/mcp?x-account-id=<account_id>",
"--header",
"Authorization: Basic <YOUR_BASE64_TOKEN>"
]
}
}
}Platform Resources
MCP Code Mode: Keeping Tool Responses Out of Agent Context
Anthropic's code_execution processes data already in context. Custom MCP code mode keeps raw tool responses in a sandbox. 14K tokens vs 500.
11 min
Comparing BM25, TF-IDF, and Hybrid Search for MCP Tool Discovery
Benchmarking BM25, TF-IDF, and hybrid search for MCP tool discovery across 916 tools. The 80/20 TF-IDF/BM25 hybrid hits 21% Top-1 accuracy in under 1ms.
10 min
Indirect Prompt Injection Defense for MCP Tools: A Technical Guide
MCP tools that read emails, CRM records, and tickets are indirect prompt injection vectors. Here's how we built a two-tier defense that scans tool results in ~11ms.
12 min
MCP vs A2A: Architecture, Security, and When to Use Each
MCP vs A2A: what each protocol standardizes, how they differ, their shared security risks including indirect prompt injection, and when to use one, both, or a hybrid architecture.
12 min
MCP vs API: What 200+ Connector Builds Taught Us
MCP wraps APIs, it doesn't replace them. After building 200+ connectors that serve both, here's when each approach wins.
14 min read
Workday VNDLY MCP Server FAQ
Does StackOne have a Workday VNDLY MCP server?
Workday VNDLY MCP server vs direct API integration — what's the difference?
How does Workday VNDLY authentication work for AI agents?
origin_owner_id.Are Workday VNDLY MCP tools vulnerable to prompt injection?
What is the context bloat of a Workday VNDLY agent and how do I avoid it?
Can I limit which actions my Workday VNDLY agent can access?
Can I create custom agent actions for my Workday VNDLY MCP server?
When should I NOT use a Workday VNDLY MCP server?
What AI frameworks and AI clients does the StackOne Workday VNDLY MCP server support?
Put your AI agents to work
All the tools you need to build and scale AI agent integrations, with best-in-class connectivity, execution, and security.