An OSHA recordkeeping MCP should give an agent a narrow, inspectable way to retrieve Part 1904 rules and make structured determinations. It should not turn a chat prompt into an invisible compliance decision. The useful question is not “can an agent answer a safety question?” It is whether the agent can show the facts, citations, boundaries and unresolved uncertainty that a safety professional needs to review.
What MCP changes in the workflow
Model Context Protocol (MCP) is a way for an AI application to discover and call tools with structured inputs and outputs. In a recordkeeping setting, that can mean asking a tool for the text of 1904.7, checking whether a fact pattern meets a criterion or calculating a rate from supplied figures. It does not change the legal test. The tool’s job is to carry that test without quietly replacing it.
| Capability | Useful behaviour | Red flag |
|---|---|---|
| Rule lookup | Returns source text and a stable citation | Gives an uncited paraphrase only |
| Determination | Names decisive inputs and outcome | Produces a bare “yes” or “no” |
| Missing facts | Requests the fact that changes the outcome | Guesses from an incomplete story |
| Write action | Requires explicit confirmation and clear scope | Silently edits a 300 Log |
| Access control | Limits keys and logs sensitive use safely | Shares employee details in broad prompts |
The legal source remains 29 CFR Part 1904; the protocol is only the delivery mechanism.
The best first use is research, not autopilot
Picture a safety coordinator asking an internal assistant: “Does a technician on a lifting restriction need to go on the log?” A well-designed MCP workflow should call a rule lookup or structured determination tool, ask whether lifting is a routine job function, identify the restriction criterion and cite 1904.7. The coordinator can then compare that reasoning with the clinician note and the actual job description.
An unsafe workflow compresses all of that into “yes, log it” and writes a row automatically. It may get easy cases right, but it hides the difference between an employer-imposed restriction, an employee preference and a restriction unrelated to the injury. Those are not decorative details. They can decide the case.
Tools an OSHA recordkeeping MCP ought to expose
Look for focused tools rather than one giant “ask OSHA” endpoint. Useful capabilities include regulation lookup by section, a structured recordability assessment, a first-aid reference, a rates calculation and read-only access to relevant letters of interpretation. Inputs should be typed enough to make ambiguity visible: occurredInWorkEnvironment, isNewCase, treatments, days away and restrictions are more reliable than a single free-text box.
Job13’s MCP endpoint documentation and public API surface are designed around that shape. The service covers federal Part 1904 only, exposes citations and does not manufacture a binary result where the factual record is incomplete. That limitation is intentional: a state-plan rule, medical diagnosis or disputed causal fact needs another source.
Privacy and permissions need their own design
Incident records can include names, diagnoses, work restrictions and details that might identify a privacy case. Begin with read-only tools and the smallest data set that can answer the question. Keep production credentials out of a general-purpose chat thread, scope access by organisation and make write operations explicit.
The 300 Log itself has privacy-case requirements under 1904.29. An agent that sees a complete incident narrative should not casually repeat it in a broad channel or return it in a tool description. Ask vendors where prompts, tool calls and audit logs are retained; ask whether they can redact names or restrict access by establishment.
Test the agent with difficult questions
Use the same edge cases you would use for a human intake process. A diagnosed concussion with no missed day; a medication available over the counter but used at prescription strength; a worker with a pre-existing condition significantly aggravated by work; an employee on travel status; a temporary job transfer. The goal is not to trick the system. It is to see whether it asks the next right question instead of decorating a guess with legal language.
Compare every result with the regulation and with the recordable decision tree. If the tool cannot explain its answer in those terms, do not connect it to your system of record.
A sensible adoption path
Start with cited rule retrieval and training use. Next, try determinations in a sandbox against historical cases with the original human decision held back. Review disagreements and missing-fact prompts. Only after the output is trusted should you consider drafting, rather than automatically writing, a 300 Log entry. Keep the trained recordkeeper in the final approval loop.
This staged approach is less flashy than a fully autonomous compliance bot. It is also more likely to leave you with records a real person can defend six months later.
Keep the conversation out of the record of truth
An agent conversation can be useful working material, but it should not become the only evidence behind a recordability decision. Save the cited output, original incident facts and the human approver’s final action in the system of record. Treat chat summaries as pointers, not as clinical notes or final legal findings. That boundary makes it easier to adopt helpful tooling without making a transient prompt the permanent explanation for a 300 Log entry.
Frequently asked questions
What is an OSHA recordkeeping MCP?
It is an MCP server or tool set that lets an AI application retrieve OSHA recordkeeping information or run structured Part 1904 checks. It should expose sources, inputs and limits so a human can review the result.
Can an MCP server automatically maintain an OSHA 300 Log?
It can technically integrate with a record system, but automatic writes are risky. Start with read-only research and draft outputs, then require explicit human confirmation for any record change or submission.
What should an agent do if incident facts are incomplete?
It should say which fact is missing and why it matters—for example, whether a restriction kept the employee from a routine job function. It should not interpret missing information as proof that a case is not recordable.
Does MCP make a tool legally authoritative?
No. The authority comes from the applicable regulation and official guidance, not from the protocol. MCP can make sources and structured tools easier to reach; it does not replace competent review or state-specific verification.
