Timesheet MCP Server (timesheetIO/timesheet-mcp) is an MCP server listed on the M8ven Trust Index. It scores 68 out of 100, grade C. It declares 41 tools. No publisher has claimed this listing.
Enables natural language control of the Timesheet API for timer management, task tracking, and project management through MCP tools.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
timesheetIO
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
timer_startUse this when the user wants to begin tracking time on a specific project. The user can optionally specify a custom start time in the past, otherwise it defaults to now.
timer_stopUse this when the user wants to stop the currently active timer and complete the time tracking session. The user can optionally specify when the timer should be stopped.
timer_pauseUse this when the user wants to pause the timer to take a break. This temporarily stops time tracking while keeping the task active.
timer_resumeUse this when the user wants to resume time tracking after a break or pause. This restarts the timer from its paused state.
timer_statusUse this when the user wants to check the current state of their timer, including whether it's running, paused, or stopped, and details about the active task.
timer_updateUse this when the user wants to modify details of the currently running timer task, such as description, location, billability, or mood rating.
task_add_noteUse this when the user wants to add a text note or comment to the currently running task for future reference or documentation.
task_add_expenseUse this when the user wants to record an expense or cost associated with the currently running task, such as travel, materials, or client entertainment.
task_add_pauseUse this when the user wants to manually record a past break or pause period that was not tracked in real-time.
team_listUse this when the user wants to view or search for teams. IMPORTANT: Use this tool to find team IDs by searching team names, which can then be used to filter projects. Supports text search and pagination.
project_listUse this when the user wants to view their projects. IMPORTANT: When the user asks for a specific number (e.g., "show me 5 projects"), use the limit parameter to control how many projects are returned. Always use pagination to avoid loading all projects unnecessarily. Supports filtering by team, sta…
project_createUse this when the user wants to create a new project to organize their time tracking.
project_updateUse this when the user wants to modify an existing project's details such as title, description, or archive status.
project_deleteUse this when the user wants to permanently delete a project. WARNING: This is a destructive operation that cannot be undone. All associated tasks will remain but will lose their project association.
project_getUse this when the user wants to view detailed information about a specific project.
task_listUse this when the user wants to view their time entries. IMPORTANT: When the user asks for a specific number (e.g., "show me 10 tasks"), use the limit parameter to control how many tasks are returned. Always use pagination to avoid loading all tasks unnecessarily. Supports extensive filtering by org…
task_createUse this when the user wants to manually create a time entry for past work, rather than using the timer.
task_updateUse this when the user wants to modify details of an existing time entry such as times, description, or billing status.
task_deleteUse this when the user wants to permanently delete a time entry. WARNING: This is a destructive operation that cannot be undone.
task_getUse this when the user wants to view detailed information about a specific time entry/task.
auth_configureUse this when the user needs to configure API key authentication for the Timesheet MCP server. NOTE: This will be deprecated once OAuth 2.1 is implemented.
report_document_getUse this when the user wants to retrieve formatted document/invoice data including tasks, expenses, and financial calculations. Returns JSON data ready for display.
report_document_pdfUse this when the user wants to generate and download a PDF version of a document/invoice. Returns a download URL for the PDF file.
report_document_xmlUse this when the user wants to generate XML representation of a document for e-invoicing (Zugferd, XRechnung, ebInterface). Returns XML data for electronic invoice processing.
report_task_getUse this when the user wants to retrieve formatted task data including time tracking, rates, and project details.
report_task_pdfUse this when the user wants to generate and download a PDF report for a specific task.
report_expense_getUse this when the user wants to retrieve formatted expense data including amounts and receipt information.
report_expense_pdfUse this when the user wants to generate and download a PDF report for a specific expense including receipt images.
report_note_getUse this when the user wants to retrieve formatted note data including content and attachments.
report_note_pdfUse this when the user wants to generate and download a PDF report for a specific note including images.
export_generateUse this when the user wants to export their timesheet data in Excel (xlsx), CSV, or PDF format. Returns a download URL for the export file.
export_sendUse this when the user wants to generate and send a timesheet export directly to an email address.
export_from_templateUse this when the user wants to generate an export using a previously saved template with specific date range.
export_fieldsUse this when the user wants to see what fields/columns are available for customizing exports.
export_report_typesUse this when the user wants to see what report types are available for export (e.g., detailed, summary, by project).
export_template_listUse this when the user wants to see their saved export templates for quick recurring exports.
export_template_getUse this when the user wants to view details of a specific export template.
export_template_createUse this when the user wants to save their export configuration as a reusable template.
export_template_updateUse this when the user wants to modify an existing export template.
export_template_deleteUse this when the user wants to delete an export template. This cannot be undone.
statistics_getUse this when the user wants to see time tracking statistics, summaries, or reports for a date range. Returns aggregated totals, project breakdowns, and daily/weekly hour charts.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
vite: `server.fs.deny` bypass on Windows alternate paths
COMPONENT_BASE_URLCOMPONENT_HOSTCOMPONENT_PORTHOSTMCP_ENDPOINT_PATHMCP_SERVER_URLNGROK_URLTIMESHEET_API_TOKENyour-api-token-hereTIMESHEET_API_URLPORTAll four hints declared on every tool
38/41 tools missing one or more hints — timer_start (missing: idempotentHint); timer_stop (missing: idempotentHint); timer_pause (missing: idempotentHint), +35 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
18/41 tools referenced in tests (44%)
Write tests that reference each tool by name so every tool has at least one test.
Secrets not logged
1 secret value sent to console.log
Redact or omit secret values from log output.
Production dependencies are patched
0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.25.1 (high), @modelcontextprotocol/sdk@1.25.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
5 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/timesheetio/timesheet-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check