Clio-mcp-server (romanoandsumner/Clio-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 157 tools. No publisher has claimed this listing.

D
Caution
52/100

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

romanoandsumner

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
3 flows detected: ANTHROPIC_API_KEY, RAILWAY_API_TOKEN, CLIO_CLIENT_SECRET. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 9 credentials: ANTHROPIC_API_KEY, GROW_CLIENT_SECRET, MCP_STATIC_CLIENT_SECRET, MS_CLIENT_SECRET, REVIEW_PASSWORD, UPLOAD_SECRET, CLIO_ACCESS_TOKEN, CLIO_CLIENT_SECRET, CLIO_REFRESH_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes157 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_ar_aging
get_wip_report

Work-in-progress report: all unbilled time and expenses, how long they have been sitting. Identifies revenue at risk of aging off.

get_trust_balances

Trust/IOLTA account balances and recent activity per matter. Flags low balances (<$500) and dormant accounts (90+ days no activity).

get_ar_scorecard
audit_draft_bills

Pull all time entries from DRAFT bills for a responsible attorney and review for billing compliance. Automatically determines whether to apply Harris County Probate Court fee standards (based on Court custom field) or general billing hygiene. Returns flagged entries with severity codes and a structu

download_bill_audit

Generate a CSV audit report of draft bill time entries for a responsible attorney. Includes all entries with flag annotations, severity ratings, and a summary. Same data as audit_draft_bills but in CSV format.

audit_time_entries

Audit time entries for a specific user within a date range. Runs the same billing compliance checks as audit_draft_bills (HC standards, block billing, vague entries, clerical, etc.) but on any time entries — not just those on draft bills. Returns CSV with flags and suggested revisions. Also used by

mark_bill_sent
get_bill_submissions
get_credit_memos

List credit memos (GET /credit_memos) — credits held against a contact that can be applied to their bills. Filter by contact. Each shows the amount, date, whether it's a discount, and any void date.

get_interest_charges

List interest charges (GET /interest_charges) — interest accrued on overdue bills. Filter by bill. Each shows the charge date, description, total, and the bill/matters it applies to.

delete_interest_charge

Delete an interest charge (DELETE /interest_charges/{id}) — e.g. to waive interest accrued on a bill. Permanent.

get_bills

Get bills with filters. Flags aging: outstanding > 30, 60, 90 days. Returns payment detail (`paid`, `pending`, `paid_at`, `due`, `credits_issued`), routing info (`client`, `shared`), bill metadata (`subject`, `memo`, `kind`, `type`, `start_at`, `end_at`, `created_at`, `updated_at`), state machine (`

debug_bill_fields

Debug helper: fetch one bill with the full get_bills field set and report which fields Clio returned. Use this after editing BILL_FIELDS to confirm Clio accepts each field name and to see the actual shape of nested objects (client, matters).

get_bill_line_items

Get all line items on a specific Clio bill, ordered as they appear on the bill. Use this — NOT get_time_entries — when you want exactly the lines on bill X for an invoice review. get_time_entries filters by matter or user, which sweeps in prior-bill entries and unbilled activities; this tool filters

render_bill_pdf

Render a single bill/invoice to a PDF and return a short-lived download URL (the same download-store mechanism as get_bill_preview). Clio's OAuth API does NOT serve bill PDFs, so this builds one from the rendered preview HTML (GET /bills/{id}/preview) with a headless browser: the firm logo is fetche

set_bill_state

Change a bill's state. Useful for voiding a bill that won't be issued, or moving an issued bill back to draft for editing. Wraps PATCH /bills/{id} with the target state. Reads before/after for audit. Some transitions may be restricted by Clio (e.g. paid → anything-else); Clio errors are surfaced ver

delete_draft_bill

Delete a draft bill via DELETE /bills/{id}. Refuses if the bill is not in 'draft' state. The underlying activities are NOT deleted — they revert to unbilled and will appear on the next bill cycle for the matter, OR you can immediately recreate a draft via Clio UI ('Generate Bill' on the matter). Use

download_bills_pdf

Render multiple bills to PDFs and return a short-lived download URL for a zip of them. Filters bills by state, matter, client, or date range. Each invoice is rendered from its preview HTML (same engine as render_bill_pdf: logo embedded, Clio Payments stub — page-break divider, repeated header, and '

probe_billing_write_apis

Diagnostic (non-destructive). Probes whether Clio's v4 API exposes any bill-generation/creation endpoint, and discovers what POST /matters requires. Reads HTTP status codes from deliberately-invalid payloads (empty body / nonexistent matter id) so NO bill or matter is ever created: 404 = route absen

probe_bill_pdf_apis

Diagnostic for bill PDF download. Probes every candidate route for fetching a bill's rendered PDF via the API — GET /bills/{id}.pdf, content negotiation (Accept: application/pdf), /bills/{id}/download(.pdf), and the bill_printings generate-then-fetch pair — reporting status, content-type, and the FU

get_bill_preview

Get the fully rendered HTML of a bill/invoice (GET /bills/{id}/preview) — self-contained HTML with inline CSS, exactly what Clio shows in its bill preview. This is the way to obtain a rendered invoice via the API (Clio's OAuth API does NOT serve bill PDFs, which is why download_bill_pdf fails); the

get_billable_matters

List billable matters (GET /billable_matters) — Clio's first-party WIP view: matters with unbilled work, each with unbilled hours/amount and amount in trust. An authoritative alternative to computing WIP from raw activities. Filter by client, attorney, matter, status, and date range.

get_billable_clients

List billable clients (GET /billable_clients) — Clio's first-party roll-up of unbilled work per client (unbilled hours/amount, amount in trust, and how many billable matters each has). Filter by attorney, status, and date range.

get_billing_settings

Get the firm's billing settings (GET /settings/billing) — rounding rules, default tax rates/names, UTBMS usage, multi-currency config, and notification settings. Useful context for interpreting bills and time entries.

get_bill_themes

List the firm's bill themes (GET /bill_themes) — the invoice templates/branding presets, including which is the default. Returns id, name, and default flag; theme config blobs are large, so pass include_config=true with theme_id to fetch a single theme's full config (for update_bill_theme).

update_bill_theme

Update a bill theme (PATCH /bill_themes/{id}) — change its name and/or config (invoice template/branding settings).

update_trust_line_item

Update a trust line item (PATCH /trust_line_items/{id}) — adjust its date, amount (total), or note. Trust-account write; use deliberately.

create_trust_request

Create a trust request (POST /trust_requests) — ask a client to fund their trust/retainer. A client-level request sets trust_type='client' with a total trust_amount; a matter-level request sets trust_type='matter' and itemizes per-matter amounts in `matters`. By default the request is created but NO

get_attributable_collections

V&D Of Counsel compensation calculator per the Services Agreement. Gus and Courteney are treated as a JOINT UNIT for tier thresholds ($250K/$500K). Applies tiered attorney splits (82.5%/80%/77.5%), staff splits (35% V&D after 10hr/month allowance per of counsel). Uses Clio Fee Allocation Report. Alw

list_calendars

List all Clio Calendar resources visible to the firm OAuth user. Each Calendar has a numeric `id` (used as calendar_owner on CalendarEntry) and a `creator` (the User who owns the calendar). Use this to find the right calendar_id to assign events to — passing a User ID where Clio expects a Calendar I

get_calendar_entries

Get calendar entries from Clio. Filter by date range, user, or matter. Returns event type and color info.

create_calendar_entry
update_calendar_entry

Update an existing calendar entry in Clio. Can modify time, summary, description, location, matter, or recurrence. For recurring events, updates the entire series. Reassigning to another calendar (calendar_owner_id / assign_to_user_id) works for ALL users — Clio enforces write permission on the targ

delete_calendar_entry

Delete a calendar entry from Clio. This permanently removes the event. For recurring events, deletes the entire series.

list_documents

List or search documents in Clio's document repository. Filter by matter, contact, containing folder, and/or a wildcard name search. By default returns direct children when a folder_id is given; set scope='descendants' to search the whole subtree. Returns metadata only — use download_document for th

get_document

Get full metadata for a single Clio document by ID, optionally including its version history. Returns metadata only — use download_document for the file bytes.

download_document

Download a Clio document's file content (latest version unless a document_version_id is given). Returns a short-lived direct download URL (1 hour); small files (≤2 MB) can also be returned inline as base64 with include_base64=true.

upload_document

Upload a file into Clio Documents — either as a NEW document (destination: exactly one of matter_id, folder_id, or contact_id) or as a NEW VERSION of an existing document (pass version_of_document_id instead). File content comes from exactly one of content_base64 (small files) or box_file_id (pull t

update_document

Rename a Clio document, move it to a different folder/matter/contact, and/or change its document category. Does not touch the file content — use upload_document with version_of_document_id for that.

list_folders

List folders in Clio's document repository. Filter by matter, contact, parent folder, and/or a wildcard name search. Use this to find a folder_id for list_documents, upload_document, or create_folder.

create_folder

Create a new folder in Clio Documents. Destination is exactly one of folder_id (subfolder), matter_id (matter's documents), or contact_id (contact's documents).

get_payment_links

List Clio Payments links (GET /clio_payments/links) — the hosted pay-now URLs generated for clients. Each shows its amount, whether it's still active, the bill/contact it's for, and any payment collected through it. Requires Clio Payments enabled on the account.

get_payment_link

Get a single Clio Payments link by ID (GET /clio_payments/links/{id}), including its pay-now URL and any payment collected.

create_payment_link

Generate a Clio Payments pay-now link (POST /clio_payments/links) to send to a client. Provide exactly one target: for_bill_id (pay a specific invoice/trust request), for_contact_id (pay the contact's outstanding invoices), or for_bank_account_id (a direct payment into that account). The returned `u

expire_payment_link

Expire (deactivate) a Clio Payments link so it can no longer be paid (PATCH /clio_payments/links/{id}). This is the only change allowed on an existing link — to alter amount/target, expire this one and create a new link.

get_clio_payments

List online payments collected through Clio Payments (GET /clio_payments/payments). Filter by bill, contact, or state. Use this to reconcile which payment links have actually been paid, alongside get_payments and the AR aging.

get_communications

List logged communications (phone calls and emails) from Clio (GET /communications). Filter by matter, contact, user, type (phone/email), and date range, or wildcard-search the subject/body. Returns metadata and participants; does not fetch attached .eml files.

get_communication

Get a single logged communication by ID (GET /communications/{id}), including its participants and linked matter.

log_communication

Log a phone call or email in Clio (POST /communications) — record it against a matter with a subject, body, timestamp, and participants. Senders and receivers are lists of {id, type} where type is 'User' (a firm member) or 'Contact' (e.g. the client). Use this to record an Outlook email thread or a

update_communication

Update a logged communication (PATCH /communications/{id}) — edit its subject, body, timestamp, or move it to a different matter. To change participants, pass full senders/receivers lists (each entry {id, type}; add _deleted:true on an entry to remove it).

delete_communication

Delete a logged communication (DELETE /communications/{id}). This permanently removes the log entry.

get_users

List all users (timekeepers/staff) in the firm with their IDs, names, and roles. Use this to look up user_id values for other tools.

get_contacts

Search contacts by name or email, optionally filter by type (Person/Company). Use matter_id to get contacts associated with a specific matter.

create_contact

Create a new contact (client) in Clio via POST /contacts. A Clio 'client' is just a contact, and create_matter's client_id is a contact ID — so use this to create the client, then pass the returned id to create_matter. For type='Person' provide first_name and/or last_name; for type='Company' provide

create_custom_field

Create a new CustomField DEFINITION in Clio (POST /custom_fields) — the field itself, firm-wide, not a value on a record. Requires name, parent_type (e.g. 'Matter', 'Contact'), and field_type (e.g. 'checkbox', 'text_line', 'text_area', 'picklist', 'currency', 'date', 'numeric', 'email', 'url'). For

list_custom_fields

List Clio CustomField definitions firm-wide. Returns each field's id, name, parent_type (Matter / Contact / Activity / Bill / etc.), field_type (text_line / picklist / date / currency / checkbox / numeric / email / url / etc.), displayed, required, and display_order. Use this to discover what custom

find_matters_by_custom_field

Find matters whose CustomField value matches a given criterion — without brute-forcing per-matter lookups. Clio's /matters endpoint has NO server-side filter for custom_field_values, but it DOES support expanding `custom_field_values{id,field_name,value}` inline on the matter list response. So this

get_matter_custom_field_values

Get the custom field values set on a specific matter, with picklist option labels and contact names auto-resolved. Returns each value's id, field_name, field_type, raw value, and a human-readable value_label (when applicable — picklist option text, contact name, or 'Yes'/'No' for checkboxes). Use li

set_matter_custom_field_value

Write a single Matter CustomField value — create, update, or clear it. Looks up the CustomField by `field_name` (parent_type=Matter) to get its id and field_type, resolves the input value into the wire shape Clio expects, then PATCHes /matters/{id} with the right add/update/_destroy semantics. Reads

download_weekly_goals
download_all_weekly_goals
download_monthly_goals_summary
probe_clio_report_apis

Diagnostic (read-only). Probes candidate Clio report API endpoints with the firm's token and returns HTTP status + response shape for each, to discover whether the new 'Custom Reports' (beta) reporting engine is API-accessible and under what path (vs the classic /reports endpoint the dashboard uses)

compare_collection_methods

Diagnostic (read-only; writes nothing to the dashboard). For a given month, generates BOTH the Realization report (kind=realization) and the issue-date Fee Allocation report, runs the exact aggregators the Collection tab uses (aggregateRealizationCollections vs aggregateFeeAllocationCollectionHrs),

list_report_presets

List classic Clio Report Presets with their options (group_by, date_range, etc.). Beta custom reports are backed by presets too, so this reveals the exact options schema and the preset_id behind a scheduled/beta report. Read-only.

create_report_preset

Create a classic Clio Report Preset (POST /report_presets). Provide kind (e.g. 'revenue'), format (default csv), and the kind-specific options object (group_by, date_range, start_date, end_date, kind). Returns the created preset or the API error detail. Model options on an existing preset from list_

generate_report_from_preset

Generate a report on demand from a Report Preset (POST /report_presets/{id}/generate_report), poll until complete (bounded), and return the new report's id, state, and CSV header columns + first row so the grouping/columns can be verified. The returned report_id is a classic /reports id usable as do

generate_classic_report

Generate a classic Clio report on demand (POST /reports) with explicit parameters — kind, format, an explicit date range, and optional user / responsible_attorney scope — then poll to completion and return report_id, state, CSV columns, row count, and the first rows. Use to produce a per-timekeeper

get_report

Fetch a Clio report by ID: returns its state/kind/format/source, and if completed and CSV, the columns, row count, and first rows. Decouples retrieval from generation — use it to pull a report that finished server-side after a generate call timed out, instead of regenerating (each regenerate spawns

download_dashboard_update

Update Rachel's firm dashboard (the 'Claude Version 2' workbook in Box) for the specified month. Sources actual billed figures (billed $, write-offs, line discounts, billable hours — by timekeeper AND responsible attorney), not a hours×rate reconstruction. Revenue source, in priority order: (1) reve

get_dashboard_status

Check a background job by job_id: returns running | done | error, timestamps, and (when finished) the full result or error. Poll this after calling download_dashboard_update or download_all_weekly_goals, which return immediately with a job_id.

dump_compare_layout

Read-only diagnostic: dumps the '26 Compare' sheet row layout from the Box dashboard — for each used row: row number, col B (month/section label), col C (initials), and key data cells (BizDev D, Billable Hrs I, Billed $ K, Collected N). Use to see exactly which rows are blocks vs SUM vs '2026 Totals

add_collections_by_matter_tab

Add or replace a 'YTD Collections by Matter' worksheet in the Claude Version 2 dashboard (Box file 2199324794140). Reads the Fee Allocation Report (same pipeline the Collection tab uses), aggregates 'Total Funds Collected' by Responsible Attorney → Matter (summing all timekeeper rows that share a ma

download_vd_statement

Generate a V&D Of Counsel compensation statement as a downloadable Word document. Includes cover letter from Rachel Trevino, compensation summary with tier breakdown, timekeeper detail, and payment history. Returns a short-lived direct_download_url (1-hour TTL) for the generated .docx.

download_firm_scorecard

Generate the firm-wide development meeting scorecard as a downloadable Excel file. Includes weekly and monthly data for all timekeepers. Returns a short-lived direct_download_url (1-hour TTL); if box_folder_id is provided the file is also versioned to Box when possible.

get_expenses

Get expense entries with optional filters

get_unbilled_expenses

Get all unbilled expenses grouped by matter with totals

list_expense_categories

List the firm's Clio expense categories (id, name, rate). Use this to find the expense_category_id/name that create_expense and convert_time_entry_to_expense need.

create_expense

Create a new expense entry in Clio (POST /activities, type=ExpenseEntry). Requires a date, matter, and amount. The expense is attributed to YOU (the acting attorney) by default — to record it under a DIFFERENT user, pass their user_id AND set on_behalf_of=true (same guard as create_time_entry). Cate

convert_time_entry_to_expense

Convert a time entry into an expense (e.g. a filing fee that was logged as time). Clio's API cannot change an activity's type, so this creates a new ExpenseEntry (same matter/date/user as the time entry, note preserved unless overridden) and then deletes the original time entry. Amount defaults to t

grow_who_am_i

Verify Clio Grow API access and return the current Grow user + firm (GET /users/who_am_i on the Grow API). Reports token_source: 'grow_oauth' (you connected the Grow Platform app at /grow/oauth/start) or 'manage_fallback' (no Grow tokens stored; trying the Manage token), plus a scopes block (request

get_grow_contacts

List/search Clio Grow (intake CRM) contacts, or fetch one by contact_id. Returns name, emails, phone_numbers, type (Person/Company), intake status (e.g. Unassigned/Intake/Hired/Did Not Hire), associated Grow matter ids, addresses, and clio_id (the synced Clio Manage contact ID — use it to join to Ma

get_grow_matters

List Clio Grow (intake CRM) matters, or fetch one by matter_id. Grow matters are pipeline records: status_category (intake/hired/declined), status, matter type, hired_date, location, client summary, assignee user ids, inbox_lead_id, is_locked, and clio_id (the synced Clio Manage matter ID — join key

get_grow_matter_types

List the Clio Grow account's matter types (the intake pipeline taxonomy), or fetch one by matter_type_id. Returns id, name, default (the account's fallback type for matters created without one), and timestamps. The `type` string on get_grow_matters records is one of these names. Requires the grow_ma

get_grow_locations

List the Clio Grow account's office locations, or fetch one by location_id. Returns id, name, and timestamps. The `location` string on get_grow_matters records is one of these names. Requires the grow_location_read scope.

get_grow_notes

List notes on a Clio Grow contact or matter (the Grow-side notes, separate from Clio Manage notes). Returns id, subject, body, timestamps.

create_grow_note

Create a note on a Clio Grow contact or matter (e.g. an intake follow-up note). subject max 255 chars, body max 65535.

get_grow_inbox_leads

List Clio Grow inbox leads (new/unprocessed intake leads), or fetch one by lead_id. state is required by the API: 'untriaged' (default — awaiting triage) or 'ignored'. Returns name, email, phone_number, state, timestamps. Note: leads already converted to matters no longer appear here — use get_grow_

create_grow_inbox_lead

Submit a new lead into the Clio Grow lead inbox (the API successor to the legacy grow.clio.com/inbox_leads form endpoint). Required: first_name, last_name, from_message, referring_url, from_source. Optionally attach email, phone_number, and a marketing_source_id (a Grow Source id from get_grow_sourc

get_grow_sources

List the firm's Clio Grow lead sources (marketing sources) — id, name, category (standard | clio_email_marketing), is_editable.

create_grow_source

Create a new Clio Grow lead source (marketing source). Name must be unique per account (case-insensitive).

get_grow_users

List users in the firm's Clio Grow account — id, name, email, and the account (firm) they belong to. Grow user IDs are what get_grow_matters returns in matter_assignee_ids.

get_grow_custom_actions

List this app's Clio Grow custom actions (links injected into Grow UI dropdowns; currently only on the matter page).

create_grow_custom_action

Create a Clio Grow custom action: a labeled link (6-32 chars) shown in the Grow matter page dropdown that opens target_url (must be https). Clio appends a single-use custom_action_nonce (60s expiry) to the URL for validating the click server-side.

delete_grow_custom_action

Delete a Clio Grow custom action by ID (removes the link from the Grow UI).

get_grow_pipeline_report

Intake pipeline snapshot from Clio Grow: matter counts by status_category (intake/hired/declined), by status, by matter type, count with a hired_date, plus untriaged/ignored inbox lead counts. Scope with created_since/updated_since (e.g. this quarter's intake). Join hired matters back to Manage reve

get_matter_contacts

List the contacts associated with a matter (GET /matters/{id}/contacts), including each one's relationship to the matter (e.g. Client, Opposing Counsel), whether they're the client, and their primary email/phone.

get_matter_related_contacts

List a matter's related contacts (GET /matters/{id}/related_contacts) — the contact records linked to the matter, with the underlying contact_id, whether each is the matter client, and primary email/phone.

get_matter_client

Get the client contact for a matter (GET /matters/{id}/client).

57 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies14 high6 medium15 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.13.6GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.13.6GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.13.6GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

highaxios@1.13.6GHSA-777c-7fjr-54vf

Allocation of Resources Without Limits or Throttling in Axios

highaxios@1.13.6GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configALLOWED_EMAILSand/or ALLOWED_EMAIL_DOMAINS, CLIO_CLIENT_ID / CLIO_CLIENT_SECRET,
configALLOWED_EMAIL_DOMAINSALLOWED_EMAILS and/or , CLIO_CLIENT_ID / CLIO_CLIENT_SECRET,
🔐 secretANTHROPIC_API_KEY
configBOX_USER_TOKENS
configDATABASE_SSL
configENABLE_DIAGNOSTIC_TOOLSclient cannot fetch; everything mutating; and the
configGIT_BRANCH
configGIT_COMMIT_SHA
configGROW_CLIENT_IDauthorized by a separate Clio Platform app (/GROW_CLIENT_SECRET,
🔐 secretGROW_CLIENT_SECRETauthorized by a separate Clio Platform app (GROW_CLIENT_ID/,
configGROW_OAUTH_PKCE
configGROW_OAUTH_SCOPEdefault , requested alongside the unchanged
configMCP_API_KEYSStatic bearer key (MCP_API_KEYS)
configMCP_STATIC_CLIENT_IDMCP_STATIC_CLIENT_ID / _SECRET, verified locally then swapped for the Microsoft credentials
configMCP_STATIC_CLIENT_NAME
🔐 secretMCP_STATIC_CLIENT_SECRET
configMCP_STATIC_CLIENT_SECRET_SHA256Set the printed MCP_STATIC_CLIENT_ID and
🔐 secretMS_CLIENT_SECRETMS_TENANT_ID, MS_CLIENT_ID (+ if confidential), MCP_AUDIENCE, MCP_SCOPE_NAME,
configOAUTH_ALLOWED_REDIRECT_URIS
configOAUTH_DCR_ENABLED
configOWNER_EMAILSThe custom RomSum/NRN event types (event_type / event_type_id) are owner-only. Set OWNER_EMAILS (comma-separated, defaults to the original author) to control who gets them. For every other user, create_calendar_entry / update_calendar_entry ignore those inputs; the response lists what was ignored. Calendar placement/reassignment is NOT gated — see the next row.
configPUPPETEER_EXECUTABLE_PATH
🔐 secretREVIEW_PASSWORD
configSOURCE_VERSION
🔐 secretUPLOAD_SECRETSet too if you use the [binary upload endpoint](#binary-upload-endpoint-post-upload).
🔐 secretCLIO_ACCESS_TOKEN
configCLIO_CLIENT_IDALLOWED_EMAILS and/or ALLOWED_EMAIL_DOMAINS, / CLIO_CLIENT_SECRET,
🔐 secretCLIO_CLIENT_SECRETALLOWED_EMAILS and/or ALLOWED_EMAIL_DOMAINS, CLIO_CLIENT_ID / ,
🔐 secretCLIO_REFRESH_TOKEN
configCLIO_BASE_URL
configCLIO_API_BASE_URL
// quality suggestions

Dependencies

14 runtime dependencies (7 dev), 1 flagged: puppeteer-core

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

157/157 tools missing one or more hints — get_ar_aging (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_wip_report (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_trust_balances (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +154 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

146/157 tool handlers declare input schemas (93%)

Declare an inputSchema with zod/joi/yup on every tool definition.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 28/157 tools referenced in tests (18%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 14 high severity in production deps — axios@1.13.6 (high), axios@1.13.6 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/romanoandsumner/clio-mcp-server?variant=verified)](https://m8ven.ai/mcp/romanoandsumner/clio-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 5e7ec10fbcc1544535aee5784eb7ec0bf83b7f2f
code hash: 5b1e253ffd8742a87fe695f16abb49291b86a3572f9a5fbe87011938d89376ba
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client