Once configured, you can use natural language to explore your GUIDEcx data and take actions, including these examples:
List and review projects and tasks
Find projects that appear late or need attention
Review open customer tasks
Update project or task fields
Draft and post internal project messages
Create projects from templates
Build phases, milestones, and tasks
Create predecessor dependencies between tasks
Turn a project plan or spreadsheet into a structured GUIDEcx project
The MCP server runs locally and communicates with GUIDEcx over the v3 API. Read more in our API documentation here: https://api.guidecx.com/docs/#overview
Before you start
You will need:
GUIDEcx API access. API access must be enabled for your workspace.
A GUIDEcx v3 API token. GUIDEcx v3 uses Bearer Token authentication. Legacy workspace tokens only work with the v2 API; v3 uses the newer user-based tokens available through workspace administration.
Node.js installed locally.
Codex, Claude, Gemini, etc. running locally in the CLI, desktop app, or supported IDE environment.
GUIDEcx's API is REST-based, accepts JSON request bodies, returns JSON responses, and uses standard HTTP methods and status codes.
Note on Security: Treat your GUIDEcx API token like a password. Never paste it into source code, commit it to Git, include it in an MCP tool response, or send it to the model in a prompt.
How the connection works
The architecture is simple:
Model → Local MCP server → GUIDEcx v3 API
Your MCP server holds the GUIDEcx credential locally and adds it to API requests as a Bearer token.
The token should live only in a local .env file:
GUIDECX_API_TOKEN=
GUIDECX_API_BASE_URL=https://api.guidecx.com
Your .env file should always be excluded from source control.
Keeping the MCP server local means you do not need to expose your own MCP endpoint publicly. The server can communicate with the model over a local stdio connection while making authenticated HTTPS requests to GUIDEcx.
One important distinction: your API token can remain local, but GUIDEcx data returned by an MCP tool may be provided to the model as context when you ask it to work with that data. Follow your organization's policies for using customer or project data with AI tools.
Quick note on Privacy: Most free tiers, or even minor paid plans for popular models like Claude, Codex, and Gemini, have varying degrees of security outlined in their Privacy Policies. We would highly recommend reading through the privacy of the model of your choice before beginning setup.
Build the MCP server
Create a new local directory for the integration and open it as your model workspace.
Then give the model the following prompt exactly as written:
I am a GUIDEcx user and I want you to build a local MCP server that lets [YOUR AI MODEL HERE (Claude, Codex, etc)] securely interact with my GUIDEcx workspace.
Use the GUIDEcx v3 API docs here:
[https://api.guidecx.com/docs/#overview](https://api.guidecx.com/docs/#overview)
Goal:
Create a working MCP server that allows me to ask you questions about my GUIDEcx projects and take approved actions, including listing projects, reviewing tasks, updating statuses, posting project messages, creating projects, creating milestones/tasks, and using predecessor dependencies.
Requirements:
1\. Build the MCP server in this workspace using Node.js.
2\. Use GUIDEcx API v3 with bearer token authentication.
3\. Read credentials from a local `.env` file:
- GUIDECX\_API\_TOKEN=
- GUIDECX\_API\_BASE\_URL=[https://api.guidecx.com](https://api.guidecx.com)
4\. Create `.env.example`, but never put the real token in source code.
5\. Add `.env` to `.gitignore`.
6\. Expose MCP tools for:
- list GUIDEcx projects
- get one project
- list project tasks
- get one task
- update project fields
- update task fields
- post project messages, defaulting to internal-only
- list members
- list roles
- list project templates
- create projects
- create phases
- create milestones
- create tasks
- create task dependencies/predecessors
7\. Make write actions explicit and safe. Project messages should default to internal-only unless I say otherwise.
8\. Include a README with setup instructions for creating the `.env`, adding the token, running tests, and configuring [YOUR MODEL] to launch the MCP server.
9\. Add tests using mocked GUIDEcx API responses so we can verify the MCP server without calling the live API.
10\. After the server is built, show me exactly how to configure [YOUR MODEL] to use it.
Important security rules:
\- Do not perform destructive actions unless I explicitly ask.
Once setup is complete, I want to be able to ask things like:
\- “List my GUIDEcx projects.”
\- “What projects are late or at risk?”
\- “Show me open customer tasks.”
\- “Mark this task In Progress.”
\- “Draft and post an internal project update.”
\- “Create a new project from this template.”
\- “Create a project plan from this spreadsheet, including milestones, task durations, estimated hours, roles, internal/customer responsibility, and predecessor dependencies.”
Please build the server, test it, and give me clear next steps.
Your model should inspect the current v3 API documentation as it builds the server rather than relying on assumptions about endpoint paths or request schemas.
Add your GUIDEcx API token
After the model creates the project, create the local .env file described in the generated README.
It should look like:
GUIDECX_API_TOKEN=your_token_here
GUIDECX_API_BASE_URL=https://api.guidecx.com
Do not add the token to .env.example.
Your .gitignore should contain:
.env
For additional protection on macOS or Linux, you can restrict access to the credential file:
chmod 600 .env
Before making any GUIDEcx request, the server should verify that the token exists without ever printing its value.
If you find the value for your API token is visible, we’d recommend deleting it, creating a new one, and verifying in your setup that it is not printed.
Test the connection
A simple project request is a good first API test:
curl -X GET "https://api.guidecx.com/api/v3/projects" \
-H "Authorization: Bearer YOUR_SECRET_TOKEN" \
-H "Content-Type: application/json"
A successful request returns a 2xx response. A 401 usually indicates an authentication problem, while 403 means the authenticated token does not have access to the requested resource. GUIDEcx also uses 400, 404, 422, 429, and standard 5xx responses for other error conditions.
The MCP project's automated test suite should use mocked API responses, not your production GUIDEcx workspace.
Run the test command your model adds to the project's README before connecting the server to live data.
Configure your model to launch the server
After the server builds successfully, register it with your model as a local MCP server.
The exact Node entry point depends on the project your model generated. A typical compiled Node.js server would be registered like this:
[YOUR MODEL] mcp add guidecx -- node /absolute/path/to/guidecx-mcp-server/dist/index.js
For example: Codex supports registering local stdio MCP servers using the codex mcp add <name> -- <command> pattern.
Then verify that the model sees it:
[Model] mcp list
Use the absolute path to your server rather than relying on the directory from which the model happens to launch.
Your implementation should also load .env relative to the MCP server's own directory rather than assuming the current shell directory contains the file.
Restart your model after changing the MCP configuration if necessary.
Verify the MCP server
Start with read-only requests:
List my GUIDEcx projects.
Show me the open tasks for [project].
Which projects appear to be behind schedule?
Once those work, test a controlled write:
Show me the change you would make to this task, but don't update it yet.
Then explicitly authorize it:
Mark that task In Progress.
For project messages, the MCP implementation should default to internal-only unless you specifically request a customer-visible message.
GUIDEcx API behavior your server should handle
A reliable MCP implementation should account for a few behaviors documented in the GUIDEcx v3 API.
Pagination. GUIDEcx uses limit and offset parameters when returning collections. Responses include metadata containing the total number of records, limit, and offset.
Your MCP server should paginate when necessary rather than assuming the first response contains every project, task, member, or other record.
Rate limits. GUIDEcx uses rate limiting and returns X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers. If the API returns 429 Too Many Requests, the server should honor the Retry-After header and retry conservatively. GUIDEcx also recommends exponential backoff, caching frequently accessed data, and avoiding unnecessary individual requests.
Errors. GUIDEcx API errors use a consistent response containing a code, message, and HTTP status. Your MCP server should return useful errors to your model without dumping complete HTTP headers, environment variables, or authentication credentials into its output.
Security recommendations
Keep the MCP server intentionally narrow.
Never hard-code the API token. Store it only in
.env.Never commit
.env. Keep.env.exampleempty of secrets.Do not log authorization headers or tokens.
Prefer a user-based v3 token with only the access the user requires.
Keep read and write tools distinct. A tool named
update_taskshould clearly represent a write operation.Require explicit intent for writes. Reading a task should never result in modifying it.
Default messages to internal-only.
Do not expose, delete, or use other destructive tools unless there is a specific need for them.
Validate IDs and write payloads before sending them to GUIDEcx.
Test against mocks first. Production data should not be required to validate your MCP implementation.
Respect API pagination and rate limits.
Keep the MCP server local unless you have a specific reason and security architecture for hosting it remotely.
The GUIDEcx API token identifies your workspace or user access and grants API access accordingly, so anyone who obtains it should be treated as having the same API privileges as that credential.
What you can do next
Once connected, your model can combine GUIDEcx API operations with its ability to reason over structured data.
That means a request can go beyond a single API call. For example:
Review my active projects and identify the ones that appear most likely to miss their target date. Explain why, but don't make any changes.
Or:
Read this implementation plan, create the appropriate milestones and tasks, assign the correct roles, preserve durations and estimated hours, and create the predecessor relationships. Show me the proposed project structure before creating anything.
For any workflow that writes to GUIDEcx, review the proposed action before approving it.
For the complete API reference and current request schemas, use the GUIDEcx v3 API documentation provided above.
