solidtime-mcp-server (SwamiRama/solidtime-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 70 out of 100, grade C. It declares 22 tools. No publisher has claimed this listing.

C
Caution
70/100

solidtime-mcp-server

MCP server for SolidTime — the open-source time tracking app. Enables start/stop timers, manage time entries, projects, clients, tags, and tasks directly from MCP-compatible clients.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

SwamiRama

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
22 tools verified — handlers match their declared behaviour
8 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: SOLIDTIME_API_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes22 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

solidtime_list_clients

List all clients in the organization. Optionally filter by archived status.

solidtime_create_client

Create a new client.

solidtime_update_client

Update a client's name.

solidtime_list_projects

List all projects in the organization. Optionally filter by archived status.

solidtime_create_project

Create a new project.

solidtime_update_project

Update an existing project. Only provided fields will be changed.

solidtime_delete_project

Permanently delete a project. This cannot be undone.

solidtime_list_tags

List all tags in the organization.

solidtime_create_tag

Create a new tag.

solidtime_update_tag

Update a tag's name.

solidtime_list_tasks

List tasks. Optionally filter by project or done status.

solidtime_create_task

Create a new task within a project.

solidtime_update_task

Update a task's name, done status, or estimated time.

solidtime_get_active_timer

Get the currently running timer, or null if no timer is active.

solidtime_start_timer

Start a new running timer. Checks for an existing active timer first. Use solidtime_stop_timer to stop it later.

solidtime_stop_timer

Stop the currently running timer by setting end time to now.

solidtime_list_time_entries

List time entries with optional filters. Returns newest first. Use limit/offset for pagination.

solidtime_create_time_entry

Create a completed time entry with start and end times. For running timers, use solidtime_start_timer instead.

solidtime_update_time_entry

Update an existing time entry. Only provided fields will be changed.

solidtime_delete_time_entry

Permanently delete a time entry. This cannot be undone.

solidtime_get_time_entry_report

Get aggregated time entry data grouped by a dimension (day, week, month, year, project, client, task, user, billable, description, tag). Optionally add a sub-grouping.

solidtime_get_current_user

Get the current user profile including name, email, timezone, and the resolved member_id for this organization.

// known CVEs in dependencies2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.6.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.6.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretSOLIDTIME_API_TOKENYes — Your SolidTime API token
configSOLIDTIME_API_URLNo https://app.solidtime.io Base URL for self-hosted instances
configSOLIDTIME_ORGANIZATION_IDYes — Your organization UUID
// quality suggestions

Tool inputs are validated

18/22 tool handlers declare input schemas (82%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/22 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/swamirama/solidtime-mcp-server?variant=verified)](https://m8ven.ai/mcp/swamirama/solidtime-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: e2f18cf326ff4890825818824c735f60bdb59b6d
code hash: 741049f4baa6b9d36caba2c017bb1b2604d05642ba6cc03c460c20b808947026
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client