CommCare MCP server
32 operations0 webhooks
Global health data collection platform with CommCare HQ - list and read submitted forms and cases, manage mobile workers and groups, pull report data and lookup tables, submit XForms and run bulk form actions.
Try CommCare with your agent
Connect CommCare, then paste this into Claude, ChatGPT or Cursor. For ideas from other apps, see the use cases.
Using Corsair, show me what you can do in CommCare on my account, then run one read-only example and show me the result.
CommCare tools and triggers
Tools are what your agent can do in CommCare through Corsair's MCP server. Triggers are the CommCare events a routine can start from.
Users
- CreateWrite
Create a mobile worker account with an initial password
users.create
- DeleteDestructive
Permanently delete a mobile worker account
users.delete
- GetRead-only
Read one mobile worker: username, names, email, phones and user data
users.get
- ListRead-only
List the mobile workers in the project with paging
users.list
- Send Password ResetWrite
Email a password reset link to the mobile worker
users.sendPasswordReset
- UpdateWrite
Change a mobile worker: names, email, phone number or custom user data
users.update
Cases
- Bulk FetchRead-only
Fetch many cases by ID in one call, optionally limited to specific fields and properties
cases.bulkFetch
- GetRead-only
Read one case with its properties and indices
cases.get
- Get By External IdRead-only
Look up a case by the external id the application assigned it
cases.getByExternalId
- ListRead-only
List cases (Case Data API v2) with cursor paging and filters for case type, owner, name, closed state and indices
cases.list
Forms
- Bulk ActionDestructive
Archive, unarchive, or permanently delete up to 5000 forms in one background job (delete needs the forms archived first); follow with forms.bulkActionStatus until status is complete or failed
forms.bulkAction
- Bulk Action StatusRead-only
Where a bulk form action stands: pending, complete, or failed, with processed and succeeded counts
forms.bulkActionStatus
- GetRead-only
Read one submitted form, including its XForm content and metadata
forms.get
- ListRead-only
List submitted forms with paging and time-window or xmlns filters
forms.list
Groups
- CreateWrite
Create a group, optionally with an initial member list
groups.create
- GetRead-only
Read one group: name, reporting flag and member user ids
groups.get
- ListRead-only
List the reporting and case-sharing groups in the project with their members
groups.list
- UpdateWrite
Rename a group, toggle reporting, or replace its member list
groups.update
Fixtures
- Get ItemRead-only
Read one fixture item by id
fixtures.getItem
- ListRead-only
List lookup-table fixture items, optionally filtered by fixture type
fixtures.list
Location Types
- GetRead-only
Read one location type by id
locationTypes.get
- ListRead-only
List the location types defined in the project
locationTypes.list
Locations
- GetRead-only
Read one location with its type and parent
locations.get
- ListRead-only
List project locations with site code, name and location type filters
locations.list
Lookup Tables
- GetRead-only
Read one lookup table with its field definitions
lookupTables.get
- ListRead-only
List the lookup tables defined in the project
lookupTables.list
Reports
- Get DataRead-only
Run a configurable report and read its rows, with offset, limit (max 50) and the report filter parameters
reports.getData
- ListRead-only
List the configurable reports defined in the project, with their ids
reports.list
Det Exports
- ListRead-only
List the Data Export Tool export instances in the project
detExports.list
Ota
- RestoreRead-only
Pull the OTA restore XML (user registration plus case blocks) for the API key owner in the domain; large payloads. HQ accepts the ApiKey header here and restores the account that owns the key. The password hash in the registration block is replaced with [removed]
ota.restore
Submissions
- SubmitWrite
Submit a complete XForm XML document to the OpenRosa receiver. Fails when HQ received the form but did not process it (nature submit_error or processing_failure); otherwise answers the message and its nature
submissions.submit
Web Users
- ListRead-only
List the web users (dashboard accounts) in the project with their roles
webUsers.list
Connect CommCare to Claude, ChatGPT or Cursor
- 1
Connect CommCare in Corsair
Add your CommCare API key once in Corsair. Corsair stores the credential encrypted and makes the CommCare API calls for your agent, so it never goes into a prompt or a config file. Connect CommCare
If your link lets the agent add apps, you can skip this: it gives you a sign-in link the first time it needs CommCare. On a ChatGPT personal plan, connect CommCare here first.
- 2
Add Corsair's MCP server to your agent
Every client uses the same address:
https://mcp.corsair.dev/mcpOpen Customize → Connectors → Add custom connector, paste the address, then select Connect.Add a custom MCP server with the address and choose OAuth. Personal plans get read tools only.Add to CursorOr add this to~/.cursor/mcp.json. Cursor opens Corsair to sign in the first time it connects.{ "mcpServers": { "corsair": { "url": "https://mcp.corsair.dev/mcp" } } }Run this, then run/mcpin Claude Code to sign in.claude mcp add --transport http corsair https://mcp.corsair.dev/mcpCodex, Gemini CLI, VS Code, Zed and other clients with OAuth sign-in work the same way. Clients without it, such as GitHub Copilot's coding agent, use a link's own address and an API key. Setup for every client
- 3
Sign in and choose what needs your approval
Your client opens Corsair to sign in. Pick a link: the apps your agent can use and a mode that decides what it may do without asking. In the default Cautious mode, CommCare's read and write operations run right away and its 2 destructive operations wait for your approval. Strict mode asks before every write and refuses destructive operations, and Read mode allows reads only.
FAQ
Install corsair and @corsair-dev/commcare, add the CommCare plugin, and connect with an API key. Then call methods like corsair.commcare.api.cases.bulkFetch() from your app. Corsair keeps each tenant isolated.
Yes. CommCare requires an API key from your CommCare account or developer dashboard. Create credentials with access that matches what you automate, then paste them into Corsair or connect through managed auth in Hub.
Yes. One Corsair client can hit CommCare, GitHub, Notion, Stripe, and the rest. Trigger CommCare from a webhook, push updates to Slack, or chain actions across plugins. Same tenant context across integrations, plain TypeScript.
Teams use Corsair for global health data collection platform with CommCare HQ - list and read submitted forms and cases, manage mobile workers and groups, pull report data and lookup tables, submit XForms and run bulk form actions. Common builds include sync jobs, admin tooling, and agents that call CommCare APIs from your backend.
The SDK is open source. Self-host and you pay Corsair nothing for the integration layer. Hub bills for hosted auth and execution, not per CommCare API call. Hub has a generous free tier. For hobby projects you can probably run the whole thing on free. Paid plans start to matter with more tenants or heavier traffic.
We maintain @corsair-dev/commcare in the open repo. When CommCare ships API changes, upgrade the package. Your call sites stay typed. You should not need to rewrite the integration layer each time.
No. Corsair does not read your CommCare data or hold individual access credentials. Credentials stay in your database. API calls run on your instance. We do not store CommCare data on your behalf.
Yes. Add https://mcp.corsair.dev/mcp as a custom connector or MCP server in Claude, ChatGPT, Cursor, VS Code, Claude Code, Codex or any client that supports remote MCP servers with OAuth sign-in, then sign in to Corsair. On ChatGPT personal plans, custom servers currently get read tools only.
Yes. Put CommCare on a link in Strict mode and every write waits for your approval, while destructive actions are refused. The default Cautious mode asks only before the 2 destructive CommCare operations. You can change a link's mode at hub.corsair.dev/me.