Clio-mcp-server (romanoandsumner/Clio-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 157 tools. No publisher has claimed this listing.
Claude clio integration
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
romanoandsumner
Source: github_repo_search
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_ar_agingget_wip_reportWork-in-progress report: all unbilled time and expenses, how long they have been sitting. Identifies revenue at risk of aging off.
get_trust_balancesTrust/IOLTA account balances and recent activity per matter. Flags low balances (<$500) and dormant accounts (90+ days no activity).
get_ar_scorecardaudit_draft_billsPull all time entries from DRAFT bills for a responsible attorney and review for billing compliance. Automatically determines whether to apply Harris County Probate Court fee standards (based on Court custom field) or general billing hygiene. Returns flagged entries with severity codes and a structu…
download_bill_auditGenerate a CSV audit report of draft bill time entries for a responsible attorney. Includes all entries with flag annotations, severity ratings, and a summary. Same data as audit_draft_bills but in CSV format.
audit_time_entriesAudit time entries for a specific user within a date range. Runs the same billing compliance checks as audit_draft_bills (HC standards, block billing, vague entries, clerical, etc.) but on any time entries — not just those on draft bills. Returns CSV with flags and suggested revisions. Also used by …
mark_bill_sentget_bill_submissionsget_credit_memosList credit memos (GET /credit_memos) — credits held against a contact that can be applied to their bills. Filter by contact. Each shows the amount, date, whether it's a discount, and any void date.
get_interest_chargesList interest charges (GET /interest_charges) — interest accrued on overdue bills. Filter by bill. Each shows the charge date, description, total, and the bill/matters it applies to.
delete_interest_chargeDelete an interest charge (DELETE /interest_charges/{id}) — e.g. to waive interest accrued on a bill. Permanent.
get_billsGet bills with filters. Flags aging: outstanding > 30, 60, 90 days. Returns payment detail (`paid`, `pending`, `paid_at`, `due`, `credits_issued`), routing info (`client`, `shared`), bill metadata (`subject`, `memo`, `kind`, `type`, `start_at`, `end_at`, `created_at`, `updated_at`), state machine (`…
debug_bill_fieldsDebug helper: fetch one bill with the full get_bills field set and report which fields Clio returned. Use this after editing BILL_FIELDS to confirm Clio accepts each field name and to see the actual shape of nested objects (client, matters).
get_bill_line_itemsGet all line items on a specific Clio bill, ordered as they appear on the bill. Use this — NOT get_time_entries — when you want exactly the lines on bill X for an invoice review. get_time_entries filters by matter or user, which sweeps in prior-bill entries and unbilled activities; this tool filters…
render_bill_pdfRender a single bill/invoice to a PDF and return a short-lived download URL (the same download-store mechanism as get_bill_preview). Clio's OAuth API does NOT serve bill PDFs, so this builds one from the rendered preview HTML (GET /bills/{id}/preview) with a headless browser: the firm logo is fetche…
set_bill_stateChange a bill's state. Useful for voiding a bill that won't be issued, or moving an issued bill back to draft for editing. Wraps PATCH /bills/{id} with the target state. Reads before/after for audit. Some transitions may be restricted by Clio (e.g. paid → anything-else); Clio errors are surfaced ver…
delete_draft_billDelete a draft bill via DELETE /bills/{id}. Refuses if the bill is not in 'draft' state. The underlying activities are NOT deleted — they revert to unbilled and will appear on the next bill cycle for the matter, OR you can immediately recreate a draft via Clio UI ('Generate Bill' on the matter). Use…
download_bills_pdfRender multiple bills to PDFs and return a short-lived download URL for a zip of them. Filters bills by state, matter, client, or date range. Each invoice is rendered from its preview HTML (same engine as render_bill_pdf: logo embedded, Clio Payments stub — page-break divider, repeated header, and '…
probe_billing_write_apisDiagnostic (non-destructive). Probes whether Clio's v4 API exposes any bill-generation/creation endpoint, and discovers what POST /matters requires. Reads HTTP status codes from deliberately-invalid payloads (empty body / nonexistent matter id) so NO bill or matter is ever created: 404 = route absen…
probe_bill_pdf_apisDiagnostic for bill PDF download. Probes every candidate route for fetching a bill's rendered PDF via the API — GET /bills/{id}.pdf, content negotiation (Accept: application/pdf), /bills/{id}/download(.pdf), and the bill_printings generate-then-fetch pair — reporting status, content-type, and the FU…
get_bill_previewGet the fully rendered HTML of a bill/invoice (GET /bills/{id}/preview) — self-contained HTML with inline CSS, exactly what Clio shows in its bill preview. This is the way to obtain a rendered invoice via the API (Clio's OAuth API does NOT serve bill PDFs, which is why download_bill_pdf fails); the …
get_billable_mattersList billable matters (GET /billable_matters) — Clio's first-party WIP view: matters with unbilled work, each with unbilled hours/amount and amount in trust. An authoritative alternative to computing WIP from raw activities. Filter by client, attorney, matter, status, and date range.
get_billable_clientsList billable clients (GET /billable_clients) — Clio's first-party roll-up of unbilled work per client (unbilled hours/amount, amount in trust, and how many billable matters each has). Filter by attorney, status, and date range.
get_billing_settingsGet the firm's billing settings (GET /settings/billing) — rounding rules, default tax rates/names, UTBMS usage, multi-currency config, and notification settings. Useful context for interpreting bills and time entries.
get_bill_themesList the firm's bill themes (GET /bill_themes) — the invoice templates/branding presets, including which is the default. Returns id, name, and default flag; theme config blobs are large, so pass include_config=true with theme_id to fetch a single theme's full config (for update_bill_theme).
update_bill_themeUpdate a bill theme (PATCH /bill_themes/{id}) — change its name and/or config (invoice template/branding settings).
update_trust_line_itemUpdate a trust line item (PATCH /trust_line_items/{id}) — adjust its date, amount (total), or note. Trust-account write; use deliberately.
create_trust_requestCreate a trust request (POST /trust_requests) — ask a client to fund their trust/retainer. A client-level request sets trust_type='client' with a total trust_amount; a matter-level request sets trust_type='matter' and itemizes per-matter amounts in `matters`. By default the request is created but NO…
get_attributable_collectionsV&D Of Counsel compensation calculator per the Services Agreement. Gus and Courteney are treated as a JOINT UNIT for tier thresholds ($250K/$500K). Applies tiered attorney splits (82.5%/80%/77.5%), staff splits (35% V&D after 10hr/month allowance per of counsel). Uses Clio Fee Allocation Report. Alw…
list_calendarsList all Clio Calendar resources visible to the firm OAuth user. Each Calendar has a numeric `id` (used as calendar_owner on CalendarEntry) and a `creator` (the User who owns the calendar). Use this to find the right calendar_id to assign events to — passing a User ID where Clio expects a Calendar I…
get_calendar_entriesGet calendar entries from Clio. Filter by date range, user, or matter. Returns event type and color info.
create_calendar_entryupdate_calendar_entryUpdate an existing calendar entry in Clio. Can modify time, summary, description, location, matter, or recurrence. For recurring events, updates the entire series. Reassigning to another calendar (calendar_owner_id / assign_to_user_id) works for ALL users — Clio enforces write permission on the targ…
delete_calendar_entryDelete a calendar entry from Clio. This permanently removes the event. For recurring events, deletes the entire series.
list_documentsList or search documents in Clio's document repository. Filter by matter, contact, containing folder, and/or a wildcard name search. By default returns direct children when a folder_id is given; set scope='descendants' to search the whole subtree. Returns metadata only — use download_document for th…
get_documentGet full metadata for a single Clio document by ID, optionally including its version history. Returns metadata only — use download_document for the file bytes.
download_documentDownload a Clio document's file content (latest version unless a document_version_id is given). Returns a short-lived direct download URL (1 hour); small files (≤2 MB) can also be returned inline as base64 with include_base64=true.
upload_documentUpload a file into Clio Documents — either as a NEW document (destination: exactly one of matter_id, folder_id, or contact_id) or as a NEW VERSION of an existing document (pass version_of_document_id instead). File content comes from exactly one of content_base64 (small files) or box_file_id (pull t…
update_documentRename a Clio document, move it to a different folder/matter/contact, and/or change its document category. Does not touch the file content — use upload_document with version_of_document_id for that.
list_foldersList folders in Clio's document repository. Filter by matter, contact, parent folder, and/or a wildcard name search. Use this to find a folder_id for list_documents, upload_document, or create_folder.
create_folderCreate a new folder in Clio Documents. Destination is exactly one of folder_id (subfolder), matter_id (matter's documents), or contact_id (contact's documents).
get_payment_linksList Clio Payments links (GET /clio_payments/links) — the hosted pay-now URLs generated for clients. Each shows its amount, whether it's still active, the bill/contact it's for, and any payment collected through it. Requires Clio Payments enabled on the account.
get_payment_linkGet a single Clio Payments link by ID (GET /clio_payments/links/{id}), including its pay-now URL and any payment collected.
create_payment_linkGenerate a Clio Payments pay-now link (POST /clio_payments/links) to send to a client. Provide exactly one target: for_bill_id (pay a specific invoice/trust request), for_contact_id (pay the contact's outstanding invoices), or for_bank_account_id (a direct payment into that account). The returned `u…
expire_payment_linkExpire (deactivate) a Clio Payments link so it can no longer be paid (PATCH /clio_payments/links/{id}). This is the only change allowed on an existing link — to alter amount/target, expire this one and create a new link.
get_clio_paymentsList online payments collected through Clio Payments (GET /clio_payments/payments). Filter by bill, contact, or state. Use this to reconcile which payment links have actually been paid, alongside get_payments and the AR aging.
get_communicationsList logged communications (phone calls and emails) from Clio (GET /communications). Filter by matter, contact, user, type (phone/email), and date range, or wildcard-search the subject/body. Returns metadata and participants; does not fetch attached .eml files.
get_communicationGet a single logged communication by ID (GET /communications/{id}), including its participants and linked matter.
log_communicationLog a phone call or email in Clio (POST /communications) — record it against a matter with a subject, body, timestamp, and participants. Senders and receivers are lists of {id, type} where type is 'User' (a firm member) or 'Contact' (e.g. the client). Use this to record an Outlook email thread or a …
update_communicationUpdate a logged communication (PATCH /communications/{id}) — edit its subject, body, timestamp, or move it to a different matter. To change participants, pass full senders/receivers lists (each entry {id, type}; add _deleted:true on an entry to remove it).
delete_communicationDelete a logged communication (DELETE /communications/{id}). This permanently removes the log entry.
get_usersList all users (timekeepers/staff) in the firm with their IDs, names, and roles. Use this to look up user_id values for other tools.
get_contactsSearch contacts by name or email, optionally filter by type (Person/Company). Use matter_id to get contacts associated with a specific matter.
create_contactCreate a new contact (client) in Clio via POST /contacts. A Clio 'client' is just a contact, and create_matter's client_id is a contact ID — so use this to create the client, then pass the returned id to create_matter. For type='Person' provide first_name and/or last_name; for type='Company' provide…
create_custom_fieldCreate a new CustomField DEFINITION in Clio (POST /custom_fields) — the field itself, firm-wide, not a value on a record. Requires name, parent_type (e.g. 'Matter', 'Contact'), and field_type (e.g. 'checkbox', 'text_line', 'text_area', 'picklist', 'currency', 'date', 'numeric', 'email', 'url'). For …
list_custom_fieldsList Clio CustomField definitions firm-wide. Returns each field's id, name, parent_type (Matter / Contact / Activity / Bill / etc.), field_type (text_line / picklist / date / currency / checkbox / numeric / email / url / etc.), displayed, required, and display_order. Use this to discover what custom…
find_matters_by_custom_fieldFind matters whose CustomField value matches a given criterion — without brute-forcing per-matter lookups. Clio's /matters endpoint has NO server-side filter for custom_field_values, but it DOES support expanding `custom_field_values{id,field_name,value}` inline on the matter list response. So this …
get_matter_custom_field_valuesGet the custom field values set on a specific matter, with picklist option labels and contact names auto-resolved. Returns each value's id, field_name, field_type, raw value, and a human-readable value_label (when applicable — picklist option text, contact name, or 'Yes'/'No' for checkboxes). Use li…
set_matter_custom_field_valueWrite a single Matter CustomField value — create, update, or clear it. Looks up the CustomField by `field_name` (parent_type=Matter) to get its id and field_type, resolves the input value into the wire shape Clio expects, then PATCHes /matters/{id} with the right add/update/_destroy semantics. Reads…
download_weekly_goalsdownload_all_weekly_goalsdownload_monthly_goals_summaryprobe_clio_report_apisDiagnostic (read-only). Probes candidate Clio report API endpoints with the firm's token and returns HTTP status + response shape for each, to discover whether the new 'Custom Reports' (beta) reporting engine is API-accessible and under what path (vs the classic /reports endpoint the dashboard uses)…
compare_collection_methodsDiagnostic (read-only; writes nothing to the dashboard). For a given month, generates BOTH the Realization report (kind=realization) and the issue-date Fee Allocation report, runs the exact aggregators the Collection tab uses (aggregateRealizationCollections vs aggregateFeeAllocationCollectionHrs), …
list_report_presetsList classic Clio Report Presets with their options (group_by, date_range, etc.). Beta custom reports are backed by presets too, so this reveals the exact options schema and the preset_id behind a scheduled/beta report. Read-only.
create_report_presetCreate a classic Clio Report Preset (POST /report_presets). Provide kind (e.g. 'revenue'), format (default csv), and the kind-specific options object (group_by, date_range, start_date, end_date, kind). Returns the created preset or the API error detail. Model options on an existing preset from list_…
generate_report_from_presetGenerate a report on demand from a Report Preset (POST /report_presets/{id}/generate_report), poll until complete (bounded), and return the new report's id, state, and CSV header columns + first row so the grouping/columns can be verified. The returned report_id is a classic /reports id usable as do…
generate_classic_reportGenerate a classic Clio report on demand (POST /reports) with explicit parameters — kind, format, an explicit date range, and optional user / responsible_attorney scope — then poll to completion and return report_id, state, CSV columns, row count, and the first rows. Use to produce a per-timekeeper …
get_reportFetch a Clio report by ID: returns its state/kind/format/source, and if completed and CSV, the columns, row count, and first rows. Decouples retrieval from generation — use it to pull a report that finished server-side after a generate call timed out, instead of regenerating (each regenerate spawns …
download_dashboard_updateUpdate Rachel's firm dashboard (the 'Claude Version 2' workbook in Box) for the specified month. Sources actual billed figures (billed $, write-offs, line discounts, billable hours — by timekeeper AND responsible attorney), not a hours×rate reconstruction. Revenue source, in priority order: (1) reve…
get_dashboard_statusCheck a background job by job_id: returns running | done | error, timestamps, and (when finished) the full result or error. Poll this after calling download_dashboard_update or download_all_weekly_goals, which return immediately with a job_id.
dump_compare_layoutRead-only diagnostic: dumps the '26 Compare' sheet row layout from the Box dashboard — for each used row: row number, col B (month/section label), col C (initials), and key data cells (BizDev D, Billable Hrs I, Billed $ K, Collected N). Use to see exactly which rows are blocks vs SUM vs '2026 Totals…
add_collections_by_matter_tabAdd or replace a 'YTD Collections by Matter' worksheet in the Claude Version 2 dashboard (Box file 2199324794140). Reads the Fee Allocation Report (same pipeline the Collection tab uses), aggregates 'Total Funds Collected' by Responsible Attorney → Matter (summing all timekeeper rows that share a ma…
download_vd_statementGenerate a V&D Of Counsel compensation statement as a downloadable Word document. Includes cover letter from Rachel Trevino, compensation summary with tier breakdown, timekeeper detail, and payment history. Returns a short-lived direct_download_url (1-hour TTL) for the generated .docx.
download_firm_scorecardGenerate the firm-wide development meeting scorecard as a downloadable Excel file. Includes weekly and monthly data for all timekeepers. Returns a short-lived direct_download_url (1-hour TTL); if box_folder_id is provided the file is also versioned to Box when possible.
get_expensesGet expense entries with optional filters
get_unbilled_expensesGet all unbilled expenses grouped by matter with totals
list_expense_categoriesList the firm's Clio expense categories (id, name, rate). Use this to find the expense_category_id/name that create_expense and convert_time_entry_to_expense need.
create_expenseCreate a new expense entry in Clio (POST /activities, type=ExpenseEntry). Requires a date, matter, and amount. The expense is attributed to YOU (the acting attorney) by default — to record it under a DIFFERENT user, pass their user_id AND set on_behalf_of=true (same guard as create_time_entry). Cate…
convert_time_entry_to_expenseConvert a time entry into an expense (e.g. a filing fee that was logged as time). Clio's API cannot change an activity's type, so this creates a new ExpenseEntry (same matter/date/user as the time entry, note preserved unless overridden) and then deletes the original time entry. Amount defaults to t…
grow_who_am_iVerify Clio Grow API access and return the current Grow user + firm (GET /users/who_am_i on the Grow API). Reports token_source: 'grow_oauth' (you connected the Grow Platform app at /grow/oauth/start) or 'manage_fallback' (no Grow tokens stored; trying the Manage token), plus a scopes block (request…
get_grow_contactsList/search Clio Grow (intake CRM) contacts, or fetch one by contact_id. Returns name, emails, phone_numbers, type (Person/Company), intake status (e.g. Unassigned/Intake/Hired/Did Not Hire), associated Grow matter ids, addresses, and clio_id (the synced Clio Manage contact ID — use it to join to Ma…
get_grow_mattersList Clio Grow (intake CRM) matters, or fetch one by matter_id. Grow matters are pipeline records: status_category (intake/hired/declined), status, matter type, hired_date, location, client summary, assignee user ids, inbox_lead_id, is_locked, and clio_id (the synced Clio Manage matter ID — join key…
get_grow_matter_typesList the Clio Grow account's matter types (the intake pipeline taxonomy), or fetch one by matter_type_id. Returns id, name, default (the account's fallback type for matters created without one), and timestamps. The `type` string on get_grow_matters records is one of these names. Requires the grow_ma…
get_grow_locationsList the Clio Grow account's office locations, or fetch one by location_id. Returns id, name, and timestamps. The `location` string on get_grow_matters records is one of these names. Requires the grow_location_read scope.
get_grow_notesList notes on a Clio Grow contact or matter (the Grow-side notes, separate from Clio Manage notes). Returns id, subject, body, timestamps.
create_grow_noteCreate a note on a Clio Grow contact or matter (e.g. an intake follow-up note). subject max 255 chars, body max 65535.
get_grow_inbox_leadsList Clio Grow inbox leads (new/unprocessed intake leads), or fetch one by lead_id. state is required by the API: 'untriaged' (default — awaiting triage) or 'ignored'. Returns name, email, phone_number, state, timestamps. Note: leads already converted to matters no longer appear here — use get_grow_…
create_grow_inbox_leadSubmit a new lead into the Clio Grow lead inbox (the API successor to the legacy grow.clio.com/inbox_leads form endpoint). Required: first_name, last_name, from_message, referring_url, from_source. Optionally attach email, phone_number, and a marketing_source_id (a Grow Source id from get_grow_sourc…
get_grow_sourcesList the firm's Clio Grow lead sources (marketing sources) — id, name, category (standard | clio_email_marketing), is_editable.
create_grow_sourceCreate a new Clio Grow lead source (marketing source). Name must be unique per account (case-insensitive).
get_grow_usersList users in the firm's Clio Grow account — id, name, email, and the account (firm) they belong to. Grow user IDs are what get_grow_matters returns in matter_assignee_ids.
get_grow_custom_actionsList this app's Clio Grow custom actions (links injected into Grow UI dropdowns; currently only on the matter page).
create_grow_custom_actionCreate a Clio Grow custom action: a labeled link (6-32 chars) shown in the Grow matter page dropdown that opens target_url (must be https). Clio appends a single-use custom_action_nonce (60s expiry) to the URL for validating the click server-side.
delete_grow_custom_actionDelete a Clio Grow custom action by ID (removes the link from the Grow UI).
get_grow_pipeline_reportIntake pipeline snapshot from Clio Grow: matter counts by status_category (intake/hired/declined), by status, by matter type, count with a hired_date, plus untriaged/ignored inbox lead counts. Scope with created_since/updated_since (e.g. this quarter's intake). Join hired matters back to Manage reve…
get_matter_contactsList the contacts associated with a matter (GET /matters/{id}/contacts), including each one's relationship to the matter (e.g. Client, Opposing Counsel), whether they're the client, and their primary email/phone.
get_matter_related_contactsList a matter's related contacts (GET /matters/{id}/related_contacts) — the contact records linked to the matter, with the underlying contact_id, whether each is the matter client, and primary email/phone.
get_matter_clientGet the client contact for a matter (GET /matters/{id}/client).
57 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios: Header Injection via Prototype Pollution
Allocation of Resources Without Limits or Throttling in Axios
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
ALLOWED_EMAILSand/or ALLOWED_EMAIL_DOMAINS, CLIO_CLIENT_ID / CLIO_CLIENT_SECRET,ALLOWED_EMAIL_DOMAINSALLOWED_EMAILS and/or , CLIO_CLIENT_ID / CLIO_CLIENT_SECRET,ANTHROPIC_API_KEYBOX_USER_TOKENSDATABASE_SSLENABLE_DIAGNOSTIC_TOOLSclient cannot fetch; everything mutating; and theGIT_BRANCHGIT_COMMIT_SHAGROW_CLIENT_IDauthorized by a separate Clio Platform app (/GROW_CLIENT_SECRET,GROW_CLIENT_SECRETauthorized by a separate Clio Platform app (GROW_CLIENT_ID/,GROW_OAUTH_PKCEGROW_OAUTH_SCOPEdefault , requested alongside the unchangedMCP_API_KEYSStatic bearer key (MCP_API_KEYS)MCP_STATIC_CLIENT_IDMCP_STATIC_CLIENT_ID / _SECRET, verified locally then swapped for the Microsoft credentialsMCP_STATIC_CLIENT_NAMEMCP_STATIC_CLIENT_SECRETMCP_STATIC_CLIENT_SECRET_SHA256Set the printed MCP_STATIC_CLIENT_ID andMS_CLIENT_SECRETMS_TENANT_ID, MS_CLIENT_ID (+ if confidential), MCP_AUDIENCE, MCP_SCOPE_NAME,OAUTH_ALLOWED_REDIRECT_URISOAUTH_DCR_ENABLEDOWNER_EMAILSThe custom RomSum/NRN event types (event_type / event_type_id) are owner-only. Set OWNER_EMAILS (comma-separated, defaults to the original author) to control who gets them. For every other user, create_calendar_entry / update_calendar_entry ignore those inputs; the response lists what was ignored. Calendar placement/reassignment is NOT gated — see the next row.PUPPETEER_EXECUTABLE_PATHREVIEW_PASSWORDSOURCE_VERSIONUPLOAD_SECRETSet too if you use the [binary upload endpoint](#binary-upload-endpoint-post-upload).CLIO_ACCESS_TOKENCLIO_CLIENT_IDALLOWED_EMAILS and/or ALLOWED_EMAIL_DOMAINS, / CLIO_CLIENT_SECRET,CLIO_CLIENT_SECRETALLOWED_EMAILS and/or ALLOWED_EMAIL_DOMAINS, CLIO_CLIENT_ID / ,CLIO_REFRESH_TOKENCLIO_BASE_URLCLIO_API_BASE_URLDependencies
14 runtime dependencies (7 dev), 1 flagged: puppeteer-core
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
157/157 tools missing one or more hints — get_ar_aging (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_wip_report (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_trust_balances (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +154 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
146/157 tool handlers declare input schemas (93%)
Declare an inputSchema with zod/joi/yup on every tool definition.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 28/157 tools referenced in tests (18%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 14 high severity in production deps — axios@1.13.6 (high), axios@1.13.6 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/romanoandsumner/clio-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check