Timesheet MCP Server (timesheetIO/timesheet-mcp) is an MCP server listed on the M8ven Trust Index. It scores 68 out of 100, grade C. It declares 41 tools. No publisher has claimed this listing.

C
Caution
68/100

Timesheet MCP Server

Enables natural language control of the Timesheet API for timer management, task tracking, and project management through MCP tools.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

timesheetIO

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 7 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: TIMESHEET_API_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes41 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

timer_start

Use this when the user wants to begin tracking time on a specific project. The user can optionally specify a custom start time in the past, otherwise it defaults to now.

timer_stop

Use this when the user wants to stop the currently active timer and complete the time tracking session. The user can optionally specify when the timer should be stopped.

timer_pause

Use this when the user wants to pause the timer to take a break. This temporarily stops time tracking while keeping the task active.

timer_resume

Use this when the user wants to resume time tracking after a break or pause. This restarts the timer from its paused state.

timer_status

Use this when the user wants to check the current state of their timer, including whether it's running, paused, or stopped, and details about the active task.

timer_update

Use this when the user wants to modify details of the currently running timer task, such as description, location, billability, or mood rating.

task_add_note

Use this when the user wants to add a text note or comment to the currently running task for future reference or documentation.

task_add_expense

Use this when the user wants to record an expense or cost associated with the currently running task, such as travel, materials, or client entertainment.

task_add_pause

Use this when the user wants to manually record a past break or pause period that was not tracked in real-time.

team_list

Use this when the user wants to view or search for teams. IMPORTANT: Use this tool to find team IDs by searching team names, which can then be used to filter projects. Supports text search and pagination.

project_list

Use this when the user wants to view their projects. IMPORTANT: When the user asks for a specific number (e.g., "show me 5 projects"), use the limit parameter to control how many projects are returned. Always use pagination to avoid loading all projects unnecessarily. Supports filtering by team, sta

project_create

Use this when the user wants to create a new project to organize their time tracking.

project_update

Use this when the user wants to modify an existing project's details such as title, description, or archive status.

project_delete

Use this when the user wants to permanently delete a project. WARNING: This is a destructive operation that cannot be undone. All associated tasks will remain but will lose their project association.

project_get

Use this when the user wants to view detailed information about a specific project.

task_list

Use this when the user wants to view their time entries. IMPORTANT: When the user asks for a specific number (e.g., "show me 10 tasks"), use the limit parameter to control how many tasks are returned. Always use pagination to avoid loading all tasks unnecessarily. Supports extensive filtering by org

task_create

Use this when the user wants to manually create a time entry for past work, rather than using the timer.

task_update

Use this when the user wants to modify details of an existing time entry such as times, description, or billing status.

task_delete

Use this when the user wants to permanently delete a time entry. WARNING: This is a destructive operation that cannot be undone.

task_get

Use this when the user wants to view detailed information about a specific time entry/task.

auth_configure

Use this when the user needs to configure API key authentication for the Timesheet MCP server. NOTE: This will be deprecated once OAuth 2.1 is implemented.

report_document_get

Use this when the user wants to retrieve formatted document/invoice data including tasks, expenses, and financial calculations. Returns JSON data ready for display.

report_document_pdf

Use this when the user wants to generate and download a PDF version of a document/invoice. Returns a download URL for the PDF file.

report_document_xml

Use this when the user wants to generate XML representation of a document for e-invoicing (Zugferd, XRechnung, ebInterface). Returns XML data for electronic invoice processing.

report_task_get

Use this when the user wants to retrieve formatted task data including time tracking, rates, and project details.

report_task_pdf

Use this when the user wants to generate and download a PDF report for a specific task.

report_expense_get

Use this when the user wants to retrieve formatted expense data including amounts and receipt information.

report_expense_pdf

Use this when the user wants to generate and download a PDF report for a specific expense including receipt images.

report_note_get

Use this when the user wants to retrieve formatted note data including content and attachments.

report_note_pdf

Use this when the user wants to generate and download a PDF report for a specific note including images.

export_generate

Use this when the user wants to export their timesheet data in Excel (xlsx), CSV, or PDF format. Returns a download URL for the export file.

export_send

Use this when the user wants to generate and send a timesheet export directly to an email address.

export_from_template

Use this when the user wants to generate an export using a previously saved template with specific date range.

export_fields

Use this when the user wants to see what fields/columns are available for customizing exports.

export_report_types

Use this when the user wants to see what report types are available for export (e.g., detailed, summary, by project).

export_template_list

Use this when the user wants to see their saved export templates for quick recurring exports.

export_template_get

Use this when the user wants to view details of a specific export template.

export_template_create

Use this when the user wants to save their export configuration as a reusable template.

export_template_update

Use this when the user wants to modify an existing export template.

export_template_delete

Use this when the user wants to delete an export template. This cannot be undone.

statistics_get

Use this when the user wants to see time tracking statistics, summaries, or reports for a date range. Returns aggregated totals, project breakdowns, and daily/weekly hour charts.

// known CVEs in dependencies7 high3 medium3 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.25.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.25.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

highpostcss@8.5.6GHSA-6g55-p6wh-862q

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

highpostcss@8.5.6GHSA-r28c-9q8g-f849

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

highvite@7.1.11GHSA-fx2h-pf6j-xcff

vite: `server.fs.deny` bypass on Windows alternate paths

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCOMPONENT_BASE_URL
configCOMPONENT_HOST
configCOMPONENT_PORT
configHOST
configMCP_ENDPOINT_PATH
configMCP_SERVER_URL
configNGROK_URL
🔐 secretTIMESHEET_API_TOKENyour-api-token-here
configTIMESHEET_API_URL
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

All four hints declared on every tool

38/41 tools missing one or more hints — timer_start (missing: idempotentHint); timer_stop (missing: idempotentHint); timer_pause (missing: idempotentHint), +35 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

18/41 tools referenced in tests (44%)

Write tests that reference each tool by name so every tool has at least one test.

Secrets not logged

1 secret value sent to console.log

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.25.1 (high), @modelcontextprotocol/sdk@1.25.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

5 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/timesheetio/timesheet-mcp?variant=verified)](https://m8ven.ai/mcp/timesheetio/timesheet-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 74f8280500fc47039f8a9811327f493a8e128384
code hash: 20c6247c92c1c0f7fff93ca59477848474b2d5e56d0a87b1b112f8006e9ff5ee
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client