Microsoft Project Online retires September 30, 2026, migrate to a modern platform before it's too late.Start migration

Project plans that agents can run, via MCP or in-app.

The plan is the source of truth: tasks, sprints, milestones, dependencies, baselines, and an audit log. Agents read from it and write structured changes back. Two surfaces reach the same plan, an MCP server for external agents from any ecosystem (ChatGPT, Claude, Cursor, Codex) and Run-with-Agent for the in-app experience.

MCP endpoint https://mcp.onplana.com/mcp

280+ MCP tools · OAuth 2.1 + DCR · idempotent · audited · free tier, no credit card

Every agent action is recorded on every plan, including Free. Reading and exporting that trail is an Enterprise feature.

Watch an agent do a real piece of work

A payments cutover, mid-flight, and a rollback runbook nobody has written yet. The lead writes two sentences and hands it over. It comes back having read the rest of the project, and waits for a person to approve it.

Recorded in Onplana. The only cut removes the agent's thinking time.

Then watch a whole plan run itself

One brief becomes a full project plan, then ChatGPT, Claude, and Onplana's own AI each execute their tasks through that shared plan, with a human approving the final send. Different ecosystems, one control plane.

Onplana's AI plans and staffs the work, ChatGPT writes the copy, Claude builds and publishes the site, you click Send.

The assistant-in-a-tab problem

Most project tools bolt an assistant onto the side of the app. You ask it a question, it answers in a chat panel, and the result lives in scrollback. The next person who opens the project cannot see what the assistant concluded, and neither can the next agent. The work product is a conversation, and a conversation is not something a team or a second agent can build on.

The fix is to stop treating the plan as context for a chat and start treating it as the substrate the chat writes to. When an agent moves a task, flags a risk, or drafts a status report, the change lands on the plan itself, with the same permission checks, idempotency, and audit trail a human edit gets. The conversation is disposable. The plan is what persists, and it is what the next worker, human or agent, picks up.

The model: plan as substrate

Two surfaces write into one plan. Both go through the same gate.

MCP serverExternal agentsClaude · Cursor · CodexRun-with-AgentIn-app agentPropose, then ratifyThe plansource of truthTasksSprintsMilestonesDependenciesBaselinesAudit logread / writeread / writeEvery write passes through the same gateRBAC · plan-gating · idempotency · audit trail

What it looks like

Three real interactions. The bracketed lines are tool calls against the plan.

A task thread where a person writes an @mention handing a task to an agent; an agents panel showing the agent reading the task on its next sync and drafting, while a second agent asking for work is given a different task because the first is held; the person replying in the thread from a phone; the agent reading the reply on its next sync and updating the draft; and a review inbox where the draft waits until the person approves it.An animated diagram. Agents on the task, a person on the approve button.SPRING CONFERENCE / TASKSSpeaker briefingTwo pages the speakers get the week before. Due Friday.Sarah Chen · Monday 17:40@Claude Code draft the speaker briefing. Two pages, one per track.Delegated · it reacts on its next syncClaude Code · Monday 17:52 · next syncDraft's in the doc: two pages, one per track. Two dates I could not confirm are marked.Speaker briefing (draft)Document · in the review inboxSarah Chen · Tuesday 08:05 · from her phoneCut track two to one page.Claude Code · Tuesday 08:20 · next syncTrimmed track two to a page. The draft is updated; nothing else changed.Reply on the task. An @mention reaches a person or an agent the same way.AGENTS · NEXT SYNCClaude CodeQuiet until its next sync.Reading the task, its brief, the open questions.Drafting the speaker briefing.Posted a draft to the task.1 new comment from Sarah. Trimming track two.Draft updated. Waiting on review.CodexQuiet until its next sync.Asked for a task. Speaker briefing is held.Took Update the run of show instead.A task an agent is working is leased to it, ten minutes at a time,renewed while it works. No second agent can take it.AGENT REVIEW INBOXPending 0Pending 1 · Approved 0Pending 0 · Approved 1Nothing waiting for you.Speaker briefingDocument · from the task · Claude CodeupdatedApproveRejectnothing ships until you doApprovedby Sarah, Tuesday 08:31TASKS · WHO HAS WHATSpeaker briefingUpdate the run of showBook the venueTom · workingSarah · handed overClaude Code · heldClaude Code · in reviewapprovednext upCodex · held
Claude desktop, via MCP
You: Connect to Onplana, what's overdue
  on Mobile App v2?

Claude: [list_overdue, project filter]
  4 overdue. Top 2: "API rate limit
  handling" (Sarah, 6d), "Push
  notification config" (Mike, 3d).
  Both in Sprint 14.

You: Move them to Sprint 15. Reassign
  Sarah's to Mike, she's at capacity.

Claude: [move_task_to_sprint x2,
         assign_task]
  Done. Both in Sprint 15. Sarah's
  task reassigned to Mike.
  Audit log: /audit/...
Cursor, via MCP, mid-coding
[Cursor finishes refresh token
 rotation, commits a3f7c2]

Cursor (via MCP):
  update_task taskId=tsk_abc
    status=DONE
    note="Commit a3f7c2: refresh
          token rotation"

Onplana:
  Task moved to DONE.
  2h logged to draft timesheet.
Run-with-Agent, in-app
PM clicks "Run with Agent" on the
Q4 Launch project.
Goal: "Identify blockers before
       standup."

Agent runs (read state):
  list_tasks, list_risks, list_overdue
  analyze_project_health (AI pass over
    comments + state)

Returns a proposal:
  3 risks flagged, 2 mitigation tasks
  drafted, 4 reassignment suggestions.

PM accepts 2 risks, edits the 3rd,
accepts both mitigations, accepts 1
reassignment, rejects 3. Status report
draft attached.

Two surfaces, two sizes

280+tools over MCP10capabilities in-app, additive only

The MCP server registers 280+ tools, spanning projects, tasks, sprints, milestones, earned value, risks, issues, governance, change control, timesheets, wikis, whiteboards, workflows, and the Microsoft Graph integrations. Every one is RBAC-checked against the caller's role, plan-gated against the org's tier, idempotent on a client-supplied key, and written to an audit trail. An external agent with the right token can reach all of it.

That audit row is written whatever plan you are on, so the record exists from the first agent call on a free account. The screen that reads it back, filters it by agent and tool, and exports it for someone else to check is part of Enterprise.

280+ tools is too large a surface for an autonomous in-app agent to navigate well, so Run-with-Agent works through a curated set of ten capabilities, biased toward analysis, drafting, and proposing rather than executing irreversible decisions. It can summarize a project, analyze project health, generate a risk register, calculate earned value, run a schedule health check, break a task into subtasks, and draft documents and workspace tables. Every Run-with-Agent capability is additive by construction: it writes new artifacts and never edits an existing row, and a test fails the build if a capability declares otherwise. It cannot move tasks between sprints, reassign people, approve timesheets, or advance governance gates. Those stay with humans, who accept, edit, or reject each proposal. The docs walk through both halves of the loop: assigning work to an agent and reviewing what it produces.

Removal is opt-in rather than absent, and recoverable where it matters. Four destructive tools are exposed over MCP, deleting a task, a project, a list, or a document, and each one is denied by default until an admin enables that specific operation for the workspace, on top of the permission the caller needs anyway. All four are recoverable: a deleted task or project goes to the recycle bin with its whole subtree captured, and restoring rebuilds it under the original ids, so dependencies, hierarchy, and links survive the round trip. Sprints, milestones, epics, and goals have no delete tool on the MCP surface at all. The in-app Run-with-Agent surface is denied every delete outright. The constraint that makes this safe for autonomous agents is the same one humans rely on: nothing structural is gone for good.

Where it runs, and what stops a collision

An agent connects from wherever you already work: a terminal running Claude Code or Codex, Cursor, or ChatGPT and Claude themselves, both of which list Onplana in their connector directories. That path costs nothing and works on the free plan. Add the published relay package and a local runner wakes the moment somebody comments, mentions the persona, or presses Run with Agent, instead of waiting for its next poll, with no public listener and no inbound firewall rule.

Hosted execution is the third option, for when nobody wants to leave a laptop open. Onplana holds the connection and dispatches the agent, with the work itself delegated to Claude's managed agent sandbox against a credential you supply and can revoke. You never handle an Onplana token: hosting mints, owns, and vaults its own, and it mints exactly the scopes the Connect Agent dialog does, so hosting is never a quieter route to broader access. Credentials are bound to their connection when read and re-checked when used, so one tenant's key cannot reach another tenant's dispatch. It is metered in agent-days, one day of one hosted connection however many times it is dispatched, with an allowance included from Pro upward and days purchasable on any plan.

Once more than one agent is pointed at the same backlog, the interesting failure is two of them starting the same task. Onplana hands out an exclusive lease: one call both picks the next available task and claims it, because listing and then claiming leaves a gap they can both land in. The lease belongs to the run rather than the user, which matters more than it sounds, since two Claude Code sessions in one workspace authenticate as the same agent persona, and a user-keyed lock would let one session release the other's work. Leases expire on their own, so a crashed agent frees its task instead of wedging it, and finishing or blocking a task hands the lease straight back.

The segment page for engineering teams walks the whole loop end to end: Onplana for software teams.

Stack and compliance

Frontend
React, TypeScript, Vite
Backend
Node, Express, Prisma. Postgres with an EAV model for custom fields, scoped-subgraph CPM recalculation, Redis.
Infrastructure
Azure Container Apps, Azure DNS
MCP
Spec-compliant server. OAuth 2.1 + Dynamic Client Registration, PKCE S256, a 401 + WWW-Authenticate envelope, and agent_bootstrap on the initialize handshake.
Identity
SAML 2.0, OIDC, SCIM 2.0, validated end-to-end against Microsoft Entra.
Imports
MPXJ for .mpp files from Microsoft Project.

What we don't have yet

A direct connector to the Project Online Project Web App is constrained by Microsoft's API restrictions on that surface, so the current migration path is MPXJ file import with a transformer, not a live PWA sync. And the AI included on the free plan is a one-time token bonus, not unlimited, heavy automated use runs on a paid plan or prepaid credit. These are real gaps and trade-offs, stated plainly rather than buried.

Build with us at onplana.com

Not building an integration? See how project managers and executives work with agents inside Onplana on the propose-ratify page.