Basecamp now connects AI agents. What that changes for small teams

What Basecamp actually launched

Three pieces, all listed on basecamp.com in October 2026:

1. A hosted MCP server at https://mcp.basecamp.com/mcp. You add it to Claude as a custom connector, install it from ChatGPT's plugin directory (Basecamp says it works in Codex too), add it to Cursor, Grok, VS Code or Claude Code, or point any MCP client at the address.
2. A command-line interface and agent skill for coding agents that run shell commands, such as Claude Code, Codex, OpenCode and Cursor.
3. SDKs and an API for developers, with official clients in Go, Ruby, TypeScript, Swift and Kotlin.

Basecamp says the connector costs nothing extra on any plan, though your AI assistant may need a paid plan to add connectors. It also says it does not train AI models on your Basecamp content.

What an assistant can do in Basecamp

According to Basecamp's own page, "just about anything you can do in Basecamp yourself". The list covers:

• Projects: find, start and organise them, and see who is on them.
• To-dos: add, assign, set due dates and check off.
• Message Boards: read threads, post updates, reply.
• Card Tables: add cards, move them between columns, manage steps.
• Calendar, Docs and Files, Campfire chat and Pings, Automatic Check-ins.
• Search and reports, such as what is overdue.

The examples Basecamp gives are practical ones: "What's overdue on my plate?", "Turn these meeting notes into to-dos and assign them", "Move any card that's been sitting in Review for over two weeks back to In Progress", "Draft a Friday update for the Marketing Message Board".

How much control you get: read-only or full

When you approve the connection, you pick Read-only access or Full access. Read-only can look but not change anything. The assistant acts as you, so it only sees projects you can see. If you belong to more than one Basecamp account, you pick one per connection. You can disconnect at any time, and anything the assistant did stays in Basecamp's activity history.

That is a sensible, simple model, and it matches Basecamp's product. What it does not give you, at least on the pages we read:

• Finer scopes. There is no option to allow to-dos but not messages, or cards but not docs. It is all reads, or all reads and writes.
• A separate identity. The assistant works as you. The page does not say whether its actions are labelled as coming from an assistant.
• Published rate limits for agent traffic, or a per-call audit log separate from normal activity.

For a five-person team that trusts its own tools, two levels may be all you want. For a team where an agent might post to a client-facing message board, the gap between "can read" and "can do everything I can do" is wide.

How Basecamp's connector compares

Here is how the hosted MCP servers of a few project tools describe their controls on their own pages, as of October 2026:

Two things stand out. Every tool in the table now has a hosted MCP server, so connecting Claude or ChatGPT to your tracker is ordinary. And the differences are now in the controls: how narrow a permission can be, whether a token can be read-only, and what is recorded.

Why scoped writes matter more than the connector

An assistant that can only read is useful and low-risk. An assistant that can write is where the time savings are, and where the mistakes are. In our experience running a small company with agents connected to our workspace, the risks are rarely dramatic. They are things like:

• An agent closes the wrong to-do because two had similar names.
• A summary meant for the team gets posted where a client can read it.
• A bulk "tidy-up" moves thirty cards nobody asked it to move.
• A loop retries a write and creates duplicates.

Each of these is cheaper to prevent than to clean up, and the tools to prevent them are permission design, not prompt wording: grant the narrowest scope that does the job, keep notification-sending actions separate, cap the write rate, and keep a log you can read the next morning.

Atrix as a reference point for scoped writes

We build Atrix AI, so take this as one example, not a neutral survey. Its MCP server exposes 85 tools over OAuth 2.1, and the design choices are the ones the previous section argues for:

• 49 grantable scopes. Read and write are separate per area: work, pages, CRM, calendar, messages and more. A write scope implies its own read; nothing else is implied.
• Named scopes for the risky ones. Posting to the team feed notifies people's phones, so feed.post is a separate scope that feed.write never implies.
• Permission checks per call. Nine scopes also need the matching permission on the account behind the token, such as deal values or hiring. A token can never do more than the person who created it, and revoking someone's access cuts their tokens' reach at once.
• Limits and audit. 120 calls and 30 writes per minute per token. Every call is logged with the tool, outcome and the kind and id of what it touched, never the contents.
• Some things are not reachable at all. No scope reaches salary or compensation records.

Atrix also has clear limits next to Basecamp. There is no free plan; the 7-day trial needs a card, and plans are $39 a month for 5 seats or $149 for 15. It is a younger product with a much smaller community, and it bundles more (docs, CRM, hiring, people) than a team that only wants Basecamp's calm project space may need. The server is listed in the Official MCP Registry and on Glama. Our Basecamp comparison covers the rest.

What to check before you connect an agent to any project tool

1. List the jobs. Write down the three things you want the agent to do. If all three are reads, connect read-only and stop there.
2. Pick the narrowest access the tool offers. On Basecamp that means read-only unless a job needs writes. On tools with scopes, grant only those the jobs need.
3. Decide who the agent acts as. If it acts as you, everything it does looks like you did it. Tell your team.
4. Keep client-facing spaces out of reach if the tool lets you, or keep the agent read-only in those projects.
5. Read the activity the next day for the first week. You will learn more from that than from any setting.
6. Know how to disconnect. Removing the connector from your assistant cuts access; on tools with tokens, know where to revoke them.

If you are new to the term, our glossary entry on what an MCP server is explains the moving parts in plain words.

FAQ

Does Basecamp work with Claude and ChatGPT?

Yes. As of October 2026, Basecamp offers official connectors for Claude, ChatGPT, Cursor and Grok through its hosted MCP server at mcp.basecamp.com. In Claude you add it as a custom connector; in ChatGPT you install it from the plugin directory.

Is Basecamp's AI connector free?

Basecamp says it is included with every account at no extra cost, including the Free plan. Your AI assistant may need its own paid plan to add connectors.

Can I give an AI assistant read-only access to Basecamp?

Yes. When you approve the connection you choose Read-only access or Full access. Read-only can look around but cannot change anything.

Does Basecamp have an MCP server?

Yes, a hosted one at https://mcp.basecamp.com/mcp. Any client that supports remote MCP connectors can use it, including Claude Code, VS Code and Cursor.

Can an AI assistant see Basecamp projects I'm not on?

No. Basecamp says the assistant acts as you and sees only what you can see.

Which project tools offer finer control over AI agent permissions?

Of the tools we checked, Linear offers a read-only endpoint and a read scope, and Atrix offers 49 separate read and write scopes with per-call audit. Basecamp offers two levels: read-only or full.

Next step

Compare the two products side by side in our Basecamp comparison, or see how scoped access works in practice on the Atrix MCP page.

Sources

Checked on the vendors' own pages on 27 October 2026: Basecamp pricing, Basecamp with AI assistants, Basecamp CLI and agent skill, Linear MCP docs, Notion MCP docs, Jira pricing.