Timix.AI
REMOTE · API.TIMIX.AI · SCANNED SEP 21
Time tracking, live project budgets, and billing exports for service firms.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability76
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 16024 tokens (~140/item across 114 items; 114 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 19 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "recall_timesheet" implies "withdraw" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 115 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the Timix.AI MCP server?
Timix.AI is a hosted endpoint at https://api.timix.ai/api/integration/v1/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.timix.ai
claude mcp add --transport http ai-timix-time-tracking 'https://api.timix.ai/api/integration/v1/mcp'
{
"mcpServers": {
"ai-timix-time-tracking": {
"url": "https://api.timix.ai/api/integration/v1/mcp"
}
}
} {
"servers": {
"ai-timix-time-tracking": {
"type": "http",
"url": "https://api.timix.ai/api/integration/v1/mcp"
}
}
} [mcp_servers.ai-timix-time-tracking] url = "https://api.timix.ai/api/integration/v1/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-timix-time-tracking": {
"type": "remote",
"url": "https://api.timix.ai/api/integration/v1/mcp",
"enabled": true
}
}
} openclaw mcp add ai-timix-time-tracking --url 'https://api.timix.ai/api/integration/v1/mcp' --transport streamable-http
mcp_servers:
ai-timix-time-tracking:
url: "https://api.timix.ai/api/integration/v1/mcp" {
"McpServers": {
"ai-timix-time-tracking": {
"Transport": "http",
"Url": "https://api.timix.ai/api/integration/v1/mcp"
}
}
} assistant mcp add ai-timix-time-tracking -t streamable-http -u 'https://api.timix.ai/api/integration/v1/mcp'
{
"mcpServers": {
"ai-timix-time-tracking": {
"type": "http",
"url": "https://api.timix.ai/api/integration/v1/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Aug 26 −1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 +1
- Stability: 0.97 → pass security
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://api.timix.ai/api/integration/v1/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.timix.ai | CN=WR3,O=Google Trust Services,C=US | 26 Aug 2026 | 24 Nov 2026 | RSA 2048 | SHA256-RSA | a61cff48fa6738ec0ae9c05e56e944bd |
| SANs: api.timix.ai | ||||||
| CN=WR3,O=Google Trust Services,C=US (CA) | CN=GTS Root R1,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | RSA 2048 | SHA256-RSA | 7ff005a91568d63abc22861684aa4b5a |
| CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 19 Jun 2020 | 28 Jan 2028 | RSA 4096 | SHA256-RSA | 77bd0d6cdb36f91aea210fc4f058d30d |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.timix.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| timix.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://api.timix.ai/.well-known/oauth-protected-resource/api/integration/v1/mcp"
Bearer resource_metadata="https://api.timix.ai/.well-known/oauth-protected-resource/api/integration/v1/mcp"| Header | Value |
|---|---|
| content-security-policy | default-src 'self'; script-src 'self' 'nonce-1qJessP83kxNpdzpf+wffg==' 'self'; style-src 'self' 'nonce-1qJessP83kxNpdzpf+wffg==' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' 'self' https://api.timix.ai wss://api.timix.ai; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(self), geolocation=(), gyroscope=(), layout-animations=(self), legacy-image-formats=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), oversized-images=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), sync-xhr=(), usb=(), vr=(), wake-lock=(), screen-wake-lock=(), web-share=(), xr-spatial-tracking=() |
Protected resource metadata
| Document | https://api.timix.ai/.well-known/oauth-protected-resource/api/integration/v1/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://api.timix.ai/api/integration/v1/mcp |
| Authorisation server | https://api.timix.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.timix.ai/api/integration/v1/mcp | Verified | 200 | |
| http (plaintext) | http://api.timix.ai/api/integration/v1/mcp | HTTPS enforced | 302 | https://api.timix.ai/api/integration/v1/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
update_frame_order ~256
Update an Open frame order's editable fields (reference, description, caps, dates, currency, notes). Closed frame orders cannot be edited; use this only for Open frame orders.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | – | Updated ISO 4217 currency code (e.g. USD). |
| description | string | – | Updated description (max 500 chars). |
| end_date | string | – | Updated end date (YYYY-MM-DD, >= start_date), or omit to clear. |
| frame_order_id | string | yes | Id of the frame order to update. |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| notes | string | – | Updated free-text notes (max 2000 chars). |
| reference | string | yes | New unique reference string for this (org, customer), max 100 chars. |
| start_date | string | – | Updated start date (YYYY-MM-DD), or omit to clear. |
| total_amount | number | – | Updated contracted amount cap (must be > 0, or omit/null to clear). |
| total_hours | number | – | Updated contracted hours cap (must be > 0, or omit/null to clear). |
No output schema declared.
No examples provided.
update_holiday_profile ~266
Update an existing holiday profile in your organization (name, holiday list, default-for-countries, active flag, or notes). The organization is fixed by your context. A profile's year cannot be changed. Only the fields you supply are changed; supplying holidays REPLACES the profile's holiday list. Holiday dates must fall within the profile's year.
| Name | Type | Req | Description |
|---|---|---|---|
| default_for_countries | string | – | Optional comma-separated ISO-2 country codes this profile is the default for, e.g. "US,CA". |
| holidays | string | – | A JSON array (as a string) that REPLACES the profile's holidays, each: {"date":"YYYY-MM-DD","name":"...","full_day_off":true|false,"window_start":"HH:mm","window_end":"HH:mm"}. Dates must be within t… |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| is_active | boolean | – | Whether the profile is active. |
| name | string | – | New profile name. |
| notes | string | – | Optional free-text notes. |
| profile_id | string | yes | Id of the holiday profile to update (required). Must belong to your organization. |
No output schema declared.
No examples provided.
update_org_settings ~293
Update core settings for your organization: name, country, default_time_zone, base_currency, first_day_of_month (1-28), auto_close_month_after_days, and the budget alert thresholds (budget_warning_threshold_percent must be less than budget_critical_threshold_percent). The organization is fixed by your context - never pass an organization id. Only the fields you provide are changed; everything else is left as-is.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_close_month_after_days | integer | – | Auto-close a month this many days after it ends (0 = never). |
| base_currency | string | – | Base ISO 4217 currency code (e.g. USD, EUR). |
| budget_critical_threshold_percent | integer | – | Utilization % at which a project is flagged Over-Budget (must be greater than the warning threshold). |
| budget_warning_threshold_percent | integer | – | Utilization % at which a project is flagged At-Risk (must be less than the critical threshold). |
| country | string | – | Organization country. |
| default_time_zone | string | – | Default IANA/Windows time zone id (e.g. America/New_York). |
| first_day_of_month | integer | – | Day the billing month starts (1-28). |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | – | Organization display name. |
No output schema declared.
No examples provided.
update_project ~292
Update an existing billing project in your organization. Only the fields you provide are changed (PATCH semantics). You can rename the project, update its description, change its status, toggle which billing types are allowed (TM/Fix/OVH), and set per-type hour limits. Discover ids with find_billing_work - never ask the user for an id.
| Name | Type | Req | Description |
|---|---|---|---|
| billing_types | string | – | Comma-separated list of billing types to allow on this project. One or more of: TM, Fix, OVH. Replaces the entire set — include all types you want to keep. |
| description | string | – | Project description (max 500 characters). |
| fix_hour_limit | integer | – | Fixed-price hour limit for this project (0 = unlimited). |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | – | New project name. |
| ovh_hour_limit | integer | – | Overhead hour limit for this project (0 = unlimited). |
| project_id | string | yes | Id of the project to update (required). Must be a project in your organization. |
| status | string | – | Project status. One of: Active, OnHold, Completed, Cancelled. |
| tm_hour_limit | integer | – | T&M (Time & Materials) hour limit for this project (0 = unlimited). |
No output schema declared.
No examples provided.
update_scheduled_report ~156
Update an existing scheduled report definition. Only the fields you provide are changed; unspecified fields keep their current values.
| Name | Type | Req | Description |
|---|---|---|---|
| cadence | string | – | New cadence: Daily, Weekly, or Monthly (optional). |
| format | string | – | New format: pdf or csv (optional). |
| id | string | yes | Id of the scheduled report to update. |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| is_active | boolean | – | Enable (true) or disable (false) the schedule (optional). |
| name | string | – | New name (optional). |
| recipients | string | – | New comma-separated recipient emails (optional). |
No output schema declared.
No examples provided.
update_subtask ~234
Update an existing subtask in your organization. Only the fields you provide are changed (PATCH semantics). You can rename the subtask, update its description, change its status, billing type, and set an hour limit. Discover ids with find_billing_work - never ask the user for an id.
| Name | Type | Req | Description |
|---|---|---|---|
| billing_type | string | – | Billing type for this subtask. One of: TM, Fix, OVH. Must be allowed by the parent task. |
| description | string | – | Subtask description. |
| hour_limit | integer | – | Hour limit for this subtask (0 = unlimited). Validated against the parent task's limit for the subtask's billing type. |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | – | New subtask name. |
| status | string | – | Subtask status. One of: Active, Inactive, Completed. |
| subtask_id | string | yes | Id of the subtask to update (required). Must be a subtask in your organization. |
No output schema declared.
No examples provided.
update_task ~223
Update an existing task in your organization. Only the fields you provide are changed (PATCH semantics). You can rename the task, update its description, change its status, and set per-type hour limits. Discover ids with find_billing_work - never ask the user for an id.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Task description. |
| fix_hour_limit | integer | – | Fixed-price hour limit for this task (0 = unlimited). |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| name | string | – | New task name. |
| ovh_hour_limit | integer | – | Overhead hour limit for this task (0 = unlimited). |
| status | string | – | Task status. One of: Active, Inactive, Completed. |
| task_id | string | yes | Id of the task to update (required). Must be a task in your organization. |
| tm_hour_limit | integer | – | T&M (Time & Materials) hour limit for this task (0 = unlimited). |
No output schema declared.
No examples provided.
update_time_report ~169
Update fields on one of your own time entries (PATCH — only the fields you supply are changed; everything else is left as-is). Supply the time_report_id plus any combination of date, start_time, hours, and text.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | New date (ISO 8601 YYYY-MM-DD). |
| hours | number | – | New duration in hours (> 0 and ≤ 24). |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| start_time | string | – | New start time in 24-h HH:mm. |
| text | string | – | New description (max 1000 characters). |
| time_report_id | string | yes | Id of the time entry to update. |
No output schema declared.
No examples provided.
update_user_preferences ~242
Update your own UI preferences: default time-entry view, sub-views, theme, and time format. Only the fields you provide are changed (PATCH semantics). Applies to your account globally across all organizations. The user is fixed by your context — you can only change your own preferences.
| Name | Type | Req | Description |
|---|---|---|---|
| default_day_sub_view | string | – | Default sub-view for the day view. One of: timeline, list, stats, table. |
| default_month_sub_view | string | – | Default sub-view for the month view. One of: calendar, list, timeline. |
| default_time_entry_view | string | – | Default time-entry view. One of: day, week, month. |
| default_week_sub_view | string | – | Default sub-view for the week view. One of: calendar, list, timeline. |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| theme_preference | string | – | UI theme preference. One of: light, dark, system. |
| time_format | string | – | Clock format. One of: 12h, 24h. |
No output schema declared.
No examples provided.
update_user_profile ~185
Update a team member's organization-profile fields: first name, last name, country, timezone, and job title. Only the fields you provide are changed (PATCH semantics). Role changes are not supported here — use the dedicated role-change tool. The organization is fixed by your context — never pass an organization id. You cannot target a user more privileged than yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Updated country. |
| first_name | string | – | Updated first name. |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| job_title | string | – | Updated job title. |
| last_name | string | – | Updated last name. |
| org_user_id | string | yes | Id of the OrganizationUser to update. |
| timezone | string | – | Updated timezone (IANA or Windows id). |
No output schema declared.
No examples provided.
use_favorite ~76
Record that a time-entry favorite was used, incrementing its use count and updating last-used timestamp.
| Name | Type | Req | Description |
|---|---|---|---|
| favorite_id | string | yes | Id of the favorite to record usage for. |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
No output schema declared.
No examples provided.
validate_import ~57
Validate a bulk-import CSV without persisting anything. Returns row-level errors and a summary so you can fix the file before calling commit_import.
| Name | Type | Req | Description |
|---|---|---|---|
| csv_content | string | yes | The CSV content to validate (use the template from get_import_template). |
No output schema declared.
No examples provided.
void_invoice ~158
Void an issued invoice (reason required): releases source hours back to Approved and retains the immutable void record. IRREVERSIBLE. Call once with no token to preview; re-call with the returned confirm_token and an idempotency_key to commit.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm_token | string | – | Token returned by the preview (call this tool once with no token to get it). Required to commit; expires in ~10 minutes. |
| idempotency_key | string | – | Required when committing (confirm_token present): retrying with the same key returns the original result instead of acting twice. |
| invoice_id | string | yes | Id of the issued invoice to void. |
| reason | string | yes | Required reason for voiding (recorded in the audit trail). |
No output schema declared.
No examples provided.
write_off_time ~162
Write off hours from an approved time report, removing them from the billable pool without invoicing (e.g. discounts or goodwill). Requires Finance role or above.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Set true to perform the action. Omit or false returns a preview only — nothing is written. |
| hours | number | yes | Number of hours to write off (required, must be > 0 and ≤ remaining billable hours). |
| idempotency_key | string | – | Optional caller-supplied key; retrying with the same key returns the original result instead of acting twice. |
| reason | string | yes | Reason for the write-off (required). |
| time_report_id | string | yes | ID of the approved time report to write off hours from (required). |
No output schema declared.
No examples provided.
What is the Timix.AI MCP server?
Timix.AI is an MCP server listed in the public MCP registry as ai.timix/time-tracking. Time tracking, live project budgets, and billing exports for service firms. This page covers its hosted endpoint (https://api.timix.ai/api/integration/v1/mcp).
Is the Timix.AI MCP server safe to use?
Timix.AI scores 88 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Timix.AI MCP server expose?
Timix.AI exposes 114 tools: get_hours_summary, get_dashboard_metrics, get_customer_info, get_project_status, get_billing_report, and 109 more. Their descriptions and schemas cost roughly 15,980 tokens of context every time the server is loaded.
Does the Timix.AI MCP server require authentication?
Yes. Timix.AI asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Timix.AI MCP server still maintained?
Timix.AI is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.