Timix.AI
REMOTE · API.TIMIX.AI · SCANNED AUG 3
Time tracking, live project budgets, and billing exports for service firms.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability63
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 16024 tokens (~140/item across 114 items; 114 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · api.timix.ai
claude mcp add --transport http ai-timix-time-tracking https://api.timix.ai/api/integration/v1/mcp
[mcp_servers.ai-timix-time-tracking] url = "https://api.timix.ai/api/integration/v1/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-timix-time-tracking": {
"type": "remote",
"url": "https://api.timix.ai/api/integration/v1/mcp",
"enabled": true
}
}
} openclaw mcp add ai-timix-time-tracking --url https://api.timix.ai/api/integration/v1/mcp --transport streamable-http
mcp_servers:
ai-timix-time-tracking:
url: "https://api.timix.ai/api/integration/v1/mcp" {
"mcpServers": {
"ai-timix-time-tracking": {
"type": "http",
"url": "https://api.timix.ai/api/integration/v1/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 +5
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 69
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://api.timix.ai/api/integration/v1/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.timix.ai | CN=WR3,O=Google Trust Services,C=US | 1 Jul 2026 | 29 Sept 2026 | RSA 2048 | SHA256-RSA | 9a8126b91b1bfeb909ff0edf4643fc6a |
| SANs: api.timix.ai | ||||||
| CN=WR3,O=Google Trust Services,C=US (CA) | CN=GTS Root R1,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | RSA 2048 | SHA256-RSA | 7ff005a91568d63abc22861684aa4b5a |
| CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 19 Jun 2020 | 28 Jan 2028 | RSA 4096 | SHA256-RSA | 77bd0d6cdb36f91aea210fc4f058d30d |
DNSSEC insecure
Validation of api.timix.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| timix.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://api.timix.ai/.well-known/oauth-protected-resource/api/integration/v1/mcp"
Bearer resource_metadata="https://api.timix.ai/.well-known/oauth-protected-resource/api/integration/v1/mcp"| Header | Value |
|---|---|
| content-security-policy | default-src 'self'; script-src 'self' 'nonce-CoIExtzimYUJeaGXSpwQ9Q==' 'self'; style-src 'self' 'nonce-CoIExtzimYUJeaGXSpwQ9Q==' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' 'self' https://api.timix.ai wss://api.timix.ai; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), layout-animations=(self), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), sync-xhr=(), usb=(), vr=(), wake-lock=(), screen-wake-lock=(), web-share=(), xr-spatial-tracking=() |
Protected resource metadata
| Document | https://api.timix.ai/.well-known/oauth-protected-resource/api/integration/v1/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://api.timix.ai/api/integration/v1/mcp |
| Authorisation server | https://api.timix.ai |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.timix.ai/api/integration/v1/mcp | Verified | 200 | |
| http (plaintext) | http://api.timix.ai/api/integration/v1/mcp | HTTPS enforced | 302 | https://api.timix.ai/api/integration/v1/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
update_frame_order ~256
Update an Open frame order's editable fields (reference, description, caps, dates, currency, notes). Closed frame orders cannot be edited; use this only for Open frame orders.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | — | Updated ISO 4217 currency code (e.g. USD). |
| description | string | — | Updated description (max 500 chars). |
| end_date | string | — | Updated end date (YYYY-MM-DD, >= start_date), or omit to clear. |
| frame_order_id | string | yes | Id of the frame order to update. |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| notes | string | — | Updated free-text notes (max 2000 chars). |
| reference | string | yes | New unique reference string for this (org, customer), max 100 chars. |
| start_date | string | — | Updated start date (YYYY-MM-DD), or omit to clear. |
| total_amount | number | — | Updated contracted amount cap (must be > 0, or omit/null to clear). |
| total_hours | number | — | Updated contracted hours cap (must be > 0, or omit/null to clear). |
No output schema declared.
No examples provided.
update_holiday_profile ~266
Update an existing holiday profile in your organization (name, holiday list, default-for-countries, active flag, or notes). The organization is fixed by your context. A profile's year cannot be changed. Only the fields you supply are changed; supplying holidays REPLACES the profile's holiday list. Holiday dates must fall within the profile's year.
| Name | Type | Req | Description |
|---|---|---|---|
| default_for_countries | string | — | Optional comma-separated ISO-2 country codes this profile is the default for, e.g. "US,CA". |
| holidays | string | — | A JSON array (as a string) that REPLACES the profile's holidays, each: {"date":"YYYY-MM-DD","name":"...","full_day_off":true|false,"window_start":"HH:mm","window_end":"HH:mm"}. Dates must be within t… |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| is_active | boolean | — | Whether the profile is active. |
| name | string | — | New profile name. |
| notes | string | — | Optional free-text notes. |
| profile_id | string | yes | Id of the holiday profile to update (required). Must belong to your organization. |
No output schema declared.
No examples provided.
update_org_settings ~293
Update core settings for your organization: name, country, default_time_zone, base_currency, first_day_of_month (1-28), auto_close_month_after_days, and the budget alert thresholds (budget_warning_threshold_percent must be less than budget_critical_threshold_percent). The organization is fixed by your context - never pass an organization id. Only the fields you provide are changed; everything else is left as-is.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_close_month_after_days | integer | — | Auto-close a month this many days after it ends (0 = never). |
| base_currency | string | — | Base ISO 4217 currency code (e.g. USD, EUR). |
| budget_critical_threshold_percent | integer | — | Utilization % at which a project is flagged Over-Budget (must be greater than the warning threshold). |
| budget_warning_threshold_percent | integer | — | Utilization % at which a project is flagged At-Risk (must be less than the critical threshold). |
| country | string | — | Organization country. |
| default_time_zone | string | — | Default IANA/Windows time zone id (e.g. America/New_York). |
| first_day_of_month | integer | — | Day the billing month starts (1-28). |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | — | Organization display name. |
No output schema declared.
No examples provided.
update_project ~292
Update an existing billing project in your organization. Only the fields you provide are changed (PATCH semantics). You can rename the project, update its description, change its status, toggle which billing types are allowed (TM/Fix/OVH), and set per-type hour limits. Discover ids with find_billing_work - never ask the user for an id.
| Name | Type | Req | Description |
|---|---|---|---|
| billing_types | string | — | Comma-separated list of billing types to allow on this project. One or more of: TM, Fix, OVH. Replaces the entire set — include all types you want to keep. |
| description | string | — | Project description (max 500 characters). |
| fix_hour_limit | integer | — | Fixed-price hour limit for this project (0 = unlimited). |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | — | New project name. |
| ovh_hour_limit | integer | — | Overhead hour limit for this project (0 = unlimited). |
| project_id | string | yes | Id of the project to update (required). Must be a project in your organization. |
| status | string | — | Project status. One of: Active, OnHold, Completed, Cancelled. |
| tm_hour_limit | integer | — | T&M (Time & Materials) hour limit for this project (0 = unlimited). |
No output schema declared.
No examples provided.
update_scheduled_report ~156
Update an existing scheduled report definition. Only the fields you provide are changed; unspecified fields keep their current values.
| Name | Type | Req | Description |
|---|---|---|---|
| cadence | string | — | New cadence: Daily, Weekly, or Monthly (optional). |
| format | string | — | New format: pdf or csv (optional). |
| id | string | yes | Id of the scheduled report to update. |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| is_active | boolean | — | Enable (true) or disable (false) the schedule (optional). |
| name | string | — | New name (optional). |
| recipients | string | — | New comma-separated recipient emails (optional). |
No output schema declared.
No examples provided.
update_subtask ~234
Update an existing subtask in your organization. Only the fields you provide are changed (PATCH semantics). You can rename the subtask, update its description, change its status, billing type, and set an hour limit. Discover ids with find_billing_work - never ask the user for an id.
| Name | Type | Req | Description |
|---|---|---|---|
| billing_type | string | — | Billing type for this subtask. One of: TM, Fix, OVH. Must be allowed by the parent task. |
| description | string | — | Subtask description. |
| hour_limit | integer | — | Hour limit for this subtask (0 = unlimited). Validated against the parent task's limit for the subtask's billing type. |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | — | New subtask name. |
| status | string | — | Subtask status. One of: Active, Inactive, Completed. |
| subtask_id | string | yes | Id of the subtask to update (required). Must be a subtask in your organization. |
No output schema declared.
No examples provided.
update_task ~223
Update an existing task in your organization. Only the fields you provide are changed (PATCH semantics). You can rename the task, update its description, change its status, and set per-type hour limits. Discover ids with find_billing_work - never ask the user for an id.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | — | Task description. |
| fix_hour_limit | integer | — | Fixed-price hour limit for this task (0 = unlimited). |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | — | New task name. |
| ovh_hour_limit | integer | — | Overhead hour limit for this task (0 = unlimited). |
| status | string | — | Task status. One of: Active, Inactive, Completed. |
| task_id | string | yes | Id of the task to update (required). Must be a task in your organization. |
| tm_hour_limit | integer | — | T&M (Time & Materials) hour limit for this task (0 = unlimited). |
No output schema declared.
No examples provided.
update_time_report ~169
Update fields on one of your own time entries (PATCH — only the fields you supply are changed; everything else is left as-is). Supply the time_report_id plus any combination of date, start_time, hours, and text.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | — | New date (ISO 8601 YYYY-MM-DD). |
| hours | number | — | New duration in hours (> 0 and ≤ 24). |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| start_time | string | — | New start time in 24-h HH:mm. |
| text | string | — | New description (max 1000 characters). |
| time_report_id | string | yes | Id of the time entry to update. |
No output schema declared.
No examples provided.
update_user_preferences ~242
Update your own UI preferences: default time-entry view, sub-views, theme, and time format. Only the fields you provide are changed (PATCH semantics). Applies to your account globally across all organizations. The user is fixed by your context — you can only change your own preferences.
| Name | Type | Req | Description |
|---|---|---|---|
| default_day_sub_view | string | — | Default sub-view for the day view. One of: timeline, list, stats, table. |
| default_month_sub_view | string | — | Default sub-view for the month view. One of: calendar, list, timeline. |
| default_time_entry_view | string | — | Default time-entry view. One of: day, week, month. |
| default_week_sub_view | string | — | Default sub-view for the week view. One of: calendar, list, timeline. |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| theme_preference | string | — | UI theme preference. One of: light, dark, system. |
| time_format | string | — | Clock format. One of: 12h, 24h. |
No output schema declared.
No examples provided.
update_user_profile ~185
Update a team member's organization-profile fields: first name, last name, country, timezone, and job title. Only the fields you provide are changed (PATCH semantics). Role changes are not supported here — use the dedicated role-change tool. The organization is fixed by your context — never pass an organization id. You cannot target a user more privileged than yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | — | Updated country. |
| first_name | string | — | Updated first name. |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| job_title | string | — | Updated job title. |
| last_name | string | — | Updated last name. |
| org_user_id | string | yes | Id of the OrganizationUser to update. |
| timezone | string | — | Updated timezone (IANA or Windows id). |
No output schema declared.
No examples provided.
use_favorite ~76
Record that a time-entry favorite was used, incrementing its use count and updating last-used timestamp.
| Name | Type | Req | Description |
|---|---|---|---|
| favorite_id | string | yes | Id of the favorite to record usage for. |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
No output schema declared.
No examples provided.
validate_import ~57
Validate a bulk-import CSV without persisting anything. Returns row-level errors and a summary so you can fix the file before calling commit_import.
| Name | Type | Req | Description |
|---|---|---|---|
| csv_content | string | yes | The CSV content to validate (use the template from get_import_template). |
No output schema declared.
No examples provided.
void_invoice ~158
Void an issued invoice (reason required): releases source hours back to Approved and retains the immutable void record. IRREVERSIBLE. Call once with no token to preview; re-call with the returned confirm_token and an idempotency_key to commit.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm_token | string | — | Token returned by the preview (call this tool once with no token to get it). Required to commit; expires in ~10 minutes. |
| idempotency_key | string | — | Required when committing (confirm_token present): retrying with the same key returns the original result instead of acting twice. |
| invoice_id | string | yes | Id of the issued invoice to void. |
| reason | string | yes | Required reason for voiding (recorded in the audit trail). |
No output schema declared.
No examples provided.
write_off_time ~162
Write off hours from an approved time report, removing them from the billable pool without invoicing (e.g. discounts or goodwill). Requires Finance role or above.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | — | Set true to perform the action. Omit or false returns a preview only — nothing is written. |
| hours | number | yes | Number of hours to write off (required, must be > 0 and ≤ remaining billable hours). |
| idempotency_key | string | — | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| reason | string | yes | Reason for the write-off (required). |
| time_report_id | string | yes | ID of the approved time report to write off hours from (required). |
No output schema declared.
No examples provided.