Case Study · UnlockLive IT (internal project)
How we built a remote MCP server so our team can ask Claude about projects and tasks, and create or update them, as themselves: personal OAuth sign-in, read and write scopes, 11 tools and a full change history.
Our team manages thousands of tasks across many client projects in our own task manager. Standups, weekly reports and turning meeting notes into tasks meant a lot of copying between the task manager and AI chats, and every copy-paste risked mistakes or leaking client data into the wrong place. We wanted people to simply ask Claude "What is overdue on my projects?" or "Turn these notes into tasks", with the AI working inside each person's own permissions.
We built a remote MCP server in Python and connected it to our Django task manager. The task manager acts as the OAuth authorization server, so each person signs in with their existing account and approves access; the MCP server checks every token before a tool runs. It never forwards the user's token to the app: it calls an internal API with its own service credentials, on behalf of the signed-in person, and the app enforces that person's permissions and records every change in the task history.
We listed the jobs people do every day (find tasks, summarise a project, see what changed, create and update tasks, comment) and turned them into 11 specific tools with clear descriptions, compact results and batch limits.
django-oauth-toolkit issues tokens and answers token introspection. The MCP server publishes protected-resource metadata, so Claude finds the login by itself when a person clicks Connect.
Reading uses one scope and changing data another, so a person can connect with read-only access. Write tools refuse to run without the write scope.
A dedicated internal API for the MCP server applies the acting person's permissions and logs each change to the task history, and only accepts calls from the MCP server itself.
Automated tests cover the MCP server against a fake app and the app side's OAuth, permissions and API. We then deployed the server in Docker behind HTTPS and tested it end to end with a real token before opening it to the team.
Only if you allow it. In our setup, changing tasks needs a separate write scope, and every change is made as the signed-in person and recorded in the history.
Yes. Each person signs in with their existing account, so the AI only sees what that person can see. There is no shared key.
Yes. The same pattern (OAuth sign-in, scoped tools, an internal API that enforces permissions, logging and tests) works for CRMs, ERPs, databases and other internal systems.
AI / SaaS70% Of tickets resolved without a humanAn AI customer-service platform that handles 70% of inbound tickets without a human, then routes the rest to the right agent with full context attached.
Enterprise / Healthcare100% On-device inference — zero customer data leaves the laptopHow we replaced a $4.2K/month OpenAI bill with a fully on-device LLM workflow using Ollama, llama.cpp, and a FastAPI orchestration layer — keeping 100% of customer data on the user's laptop while delivering sub-second responses.
Talk to the same team that built Connecting Claude to Our Task Manager with a Remote MCP Server (OAuth, Python, Django). We’ll scope your project, give you a fixed-price proposal, and show you the closest analog from our portfolio.
Book a strategy callUnlockLive IT Limited — Toronto client-facing HQ and project management; dedicated engineering center in Dhaka, Bangladesh. UK registered company #15563368 (UnlockLive IT Limited, London).
Copyright© UnlockLive .All right reserved 2008 - 2026