Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

UseHourly

NPM · USEHOURLY-MCP · 2 COMPONENTS

Freelancer time tracking for AI assistants: log time, timers, timesheets, sign-off links, invoices.

+3 this week 80 Trust /100

Last scanned (12 hours ago)

Scores higher than 65% of npm servers

Category Finance and Payments

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 15 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability85
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 2956 tokens (~86/item across 34 items; 32 tools + 2 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management63
  • Stability observed for 19 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
  • Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 34 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
What we tested

Checks we ran (16)

  • Malware scan
  • Known CVEs
  • Install scripts
  • Dependency health
  • Source repository
  • Provenance
  • License
  • Maintenance
  • Security disclosure
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this package (2)

  • Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
  • Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

  • 31 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 29 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 26 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

  • 24 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 22 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/usehourly-mcp@1.1.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 32 exposed · ~2,805 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
annual_report ~52

One calendar year: hours and earnings by quarter, month, client and project, plus invoices issued and paid (cash and accrual views).

NameTypeReqDescription
yearintegeryesCalendar year, e.g. 2026
NameTypeReqDescription
clientsarrayyes–
invoicesobjectyesInvoices issued in the year (accrual view)
monthsarrayyes–
outstandingobjectyesIssued this year and still unpaid at year end
projectsarrayyes–
quartersarrayyes–
receivedobjectyesPayments received in the year (cash view)
totalsobjectyes–
yearnumberyes–

No examples provided.

archive_client ~35

Hide a client from the lists. Its time and invoices are kept.

NameTypeReqDescription
clientstringyesClient id or exact client name
NameTypeReqDescription
archivedstringyesThe client's name
okbooleanyes–

No examples provided.

archive_project ~48

Hide a project from the lists. Its time and invoices are kept.

NameTypeReqDescription
projectstringyesProject id, or "Client / Project" (just the project name works when it is unique)
NameTypeReqDescription
archivedstringyes"Client / Project"
okbooleanyes–

No examples provided.

create_client ~53

Add a client. Names are unique per account.

NameTypeReqDescription
colorstring–Hex colour such as #6366f1
namestringyesThe client's name (unique per account, max 80 characters)
NameTypeReqDescription
clientobjectyes–

No examples provided.

create_invoice ~214

Issue an invoice for a client from billable time between two dates. Totals are computed on the server from the logged entries (one line per project). The number defaults to the next INV-<year>-NNN. This creates a permanent record; confirm the client, period and dates with the user first.

NameTypeReqDescription
clientstringyesClient id or exact client name
compact_notesboolean–Shorten entry descriptions to about 100 characters
due_date––Payment due date, YYYY-MM-DD, or null for none
fromstringyesFirst day of the billed period
include_detailboolean–Print each entry under the lines
issue_datestringyesThe invoice date, YYYY-MM-DD
notesstring–Notes printed on the invoice (max 1,000 characters)
numberstring–Invoice number; defaults to the next INV-<year>-NNN
tostringyesLast day of the billed period
NameTypeReqDescription
clientstringyes–
hoursnumberyes–
idstringyes–
linesarrayyesOne line per project
numberstringyes–
periodstringyes"YYYY-MM-DD to YYYY-MM-DD"
totalnumberyesDollars

No examples provided.

create_project ~122

Add a project under a client, with an hourly rate in the client's currency (its own, else the account's) and whether it is billable.

NameTypeReqDescription
billableboolean–Whether the time goes on invoices (default true)
clientstringyesClient id or exact client name
hourly_ratenumber–Amount per hour in the client's currency (its own, else the account's), e.g. 85 or 62.5 (default 0)
namestringyesThe project's name (max 80 characters)
NameTypeReqDescription
projectobjectyes–

No examples provided.

delete_entry ~37

Permanently delete one time entry. Confirm with the user before calling this.

NameTypeReqDescription
idstringyesThe entry id (from list_entries)
NameTypeReqDescription
okbooleanyes–

No examples provided.

delete_invoice ~50

Permanently delete an invoice record. The time entries stay. Confirm with the user before calling this.

NameTypeReqDescription
invoicestringyesInvoice id or invoice number, e.g. INV-2026-004
NameTypeReqDescription
okbooleanyes–

No examples provided.

get_client ~36

One client's billing details: full legal name and address as printed on invoices.

NameTypeReqDescription
clientstringyesClient id or exact client name
NameTypeReqDescription
addressstring|nullyes–
currencystringyesThe currency this client's rates and invoices are in
has_logobooleanyes–
idstringyes–
legal_namestring|nullyes–
namestringyes–

No examples provided.

get_invoice ~76

The frozen invoice as issued: seller, client, lines per project and totals. Set include_detail for the per-entry breakdown. Logos are left out.

NameTypeReqDescription
include_detailboolean–Include the per-entry breakdown under the lines
invoicestringyesInvoice id or invoice number, e.g. INV-2026-004
NameTypeReqDescription
idstringyes–
snapshotobjectyes–

No examples provided.

get_running_timer ~27

The timer that is running now, with elapsed minutes, or null when none is running.

Input schema present but exposes no named parameters.

NameTypeReqDescription
running–yesThe running timer, or null

No examples provided.

get_timesheet ~148

The timesheet for a date range as a grid: one row per project, hours per day, totals per project and per day, and the weekdays with nothing logged. Optionally for one client or one project. Use this to 'show me my timesheet for last week' or to check a sheet before sharing it. Days marked non-billable still count here.

NameTypeReqDescription
clientstring–Only this client: id or exact name
fromstringyesFirst day to include, YYYY-MM-DD
projectstring–Only this project: id or "Client / Project"
tostringyesLast day to include (inclusive), YYYY-MM-DD
NameTypeReqDescription
day_totalsobjectyesHours per date across the rows
daysarrayyesThe dates that have time logged, oldest first
fromstringyes–
rowsarrayyes–
scopestringyesThe client or project the sheet is for, or All clients
tostringyes–
total_hoursnumberyes–
weekdays_without_timearrayyesMonday to Friday dates in the range with nothing logged

No examples provided.

list_clients ~35

Active clients, each with its currency and its active projects. Rates are in the client's currency (its own, else the account's).

Input schema present but exposes no named parameters.

NameTypeReqDescription
clientsarrayyes–

No examples provided.

list_entries ~103

Time entries between two dates (inclusive), newest first, with totals per project and per day. Optionally limited to one project. Use this for 'what did I log last week' and to check a day before adding time.

NameTypeReqDescription
fromstringyesFirst day to include, YYYY-MM-DD
projectstring–Only this project: id or "Client / Project"
tostringyesLast day to include (inclusive), YYYY-MM-DD
NameTypeReqDescription
entriesarrayyesNewest first, at most 500
fromstringyes–
summaryobjectyes–
tostringyes–
truncatedbooleanyesTrue when more than 500 entries matched

No examples provided.

list_invoices ~164

Invoice history (newest 200 at most), each with the currency it was issued in. Filter by text, client, paid status or issue-date range. unpaid_totals has one figure per currency; unpaid_total is only set when every match is in one currency.

NameTypeReqDescription
clientstring–Only this client: id or exact name
issued_fromstring–Only invoices issued on or after this date
issued_tostring–Only invoices issued on or before this date
querystring–Matches number, client, notes, project names and entry notes
sortstring–newest/oldest by issue date, highest/lowest by total
statusstring–Filter by whether the invoice has been paid
NameTypeReqDescription
countnumberyes–
invoicesarrayyes–
unpaid_totalnumber|nullyesStill unpaid across the matches, in their currency; null when the matches use more than one currency
unpaid_totalsobjectyesStill unpaid per currency code, e.g. { USD: 150 }

No examples provided.

list_projects ~61

Every active project with its client and hourly rate. Use the "label" ("Client / Project") or the id wherever a project is asked for. Set include_archived to also see archived ones.

NameTypeReqDescription
include_archivedboolean–Also list archived projects
NameTypeReqDescription
archivedarray––
projectsarrayyes–

No examples provided.

log_time ~156

Add one time entry: a project, a date, how long, and what was done. Give minutes or a duration text. This adds a new entry; it never merges with an existing one. Check list_entries first if the day may already be logged.

NameTypeReqDescription
datestringyesThe day the work was done, YYYY-MM-DD
durationstring–Duration text such as "1h30" (use this or minutes)
minutesinteger–Whole minutes worked (use this or duration)
notestring–What was done (max 2,000 characters)
projectstringyesProject id, or "Client / Project" (just the project name works when it is unique)
NameTypeReqDescription
loggedobjectyes–

No examples provided.

log_time_on_days ~170

Add the same entry (project, minutes, note) on up to 31 dates. Days that already have time for this project are skipped and reported unless skip_existing is false.

NameTypeReqDescription
datesarrayyesThe days to log, YYYY-MM-DD (1 to 31 dates)
durationstring–Duration text per day, such as "1h30" (use this or minutes)
minutesinteger–Whole minutes per day (use this or duration)
notestring–What was done (max 2,000 characters)
projectstringyesProject id, or "Client / Project" (just the project name works when it is unique)
skip_existingboolean–Skip days that already have time for this project (default true)
NameTypeReqDescription
creatednumberyesDays that got an entry
minutesnumberyesMinutes logged on each day
projectstringyes"Client / Project"
skippedarrayyesDays skipped because they already had time

No examples provided.

mark_invoice_paid ~70

Record the date an invoice was paid (this matters for cash-basis taxes), or pass null to mark it unpaid again.

NameTypeReqDescription
invoicestringyesInvoice id or invoice number, e.g. INV-2026-004
paid_date–yesYYYY-MM-DD, or null for unpaid
NameTypeReqDescription
okbooleanyes–
paidDatestring|nullyesThe paid date, or null when marked unpaid

No examples provided.

merge_entries ~65

Fold several entries (same project, same day) into the first one: minutes are added and notes joined. The others are removed.

NameTypeReqDescription
idsarrayyesIds of the entries to merge; the first one is kept (2 to 20, same project and day)
NameTypeReqDescription
idstringyesThe kept entry
mergednumberyesHow many entries were folded together
minutesnumberyesIts new total

No examples provided.

next_invoice_number ~47

The suggested next invoice number for a year, such as INV-2026-004.

NameTypeReqDescription
yearintegeryesYear of the invoice issue date, e.g. 2026
NameTypeReqDescription
numberstringyesFor example INV-2026-004

No examples provided.

parse_duration ~58

Turn text like "1h30", "1:30" or "2.5" into whole minutes, the way UseHourly reads it.

NameTypeReqDescription
textstringyesThe duration text to read, e.g. 1h30
NameTypeReqDescription
errorstring––
hoursnumber––
minutesnumber|nullyesWhole minutes, or null when the text could not be read

No examples provided.

project_totals ~61

Logged hours per project: all time and within a date range (for example this month).

NameTypeReqDescription
fromstringyesFirst day of the range, YYYY-MM-DD
tostringyesLast day of the range (inclusive), YYYY-MM-DD
NameTypeReqDescription
fromstringyes–
projectsarrayyes–
tostringyes–

No examples provided.

set_day_totals ~127

Set one project's total minutes for up to 31 days: more than 0 creates or updates that day's single entry, 0 clears it. Days that hold several entries or a running timer are skipped and reported, never merged. A note, when given, is applied to every day written.

NameTypeReqDescription
cellsarrayyesOne item per day to set (1 to 31 days)
notestring–Description applied to every day written
projectstringyesProject id, or "Client / Project" (just the project name works when it is unique)
NameTypeReqDescription
creatednumberyes–
deletednumberyes–
projectstringyes"Client / Project"
skippedarrayyesDays skipped: several entries or a running timer
updatednumberyes–

No examples provided.

share_timesheet ~240

Freeze the hours of a date range (optionally one client or project) into a private link a client can open without an account, read, print and approve. The link shows hours and, unless include_notes is false, the work descriptions; never rates or amounts. Anyone with the link can read it until it expires, so confirm the range, the client and whether to include notes with the user before calling. The link is returned only once: pass it on to the user. Not available on demo accounts.

NameTypeReqDescription
clientstring–Only this client: id or exact name
expires_in_daysnumber–How long the link works: 7, 30, 90 days (default 30)
fromstringyesFirst day to include, YYYY-MM-DD
include_notesboolean–Show the work descriptions to the client (default true)
projectstring–Only this project: id or "Client / Project"
titlestring–A heading for the sheet (default: client and dates)
tostringyesLast day to include (inclusive), YYYY-MM-DD
NameTypeReqDescription
expires_in_daysnumberyes–
fromstringyes–
includes_notesbooleanyes–
notestringyes–
tostringyes–
urlstringyesThe private link to send to the client. Shown only once

No examples provided.

start_timer ~95

Start a timer on a project. A timer that is already running is stopped first, so only one runs at a time.

NameTypeReqDescription
datestringyesThe day the timer starts on, YYYY-MM-DD
notestring–What is being worked on (max 2,000 characters)
projectstringyesProject id, or "Client / Project" (just the project name works when it is unique)
NameTypeReqDescription
startedobjectyes–

No examples provided.

stop_timer ~29

Stop the running timer. Elapsed time is rounded up to the next minute (at least 1).

Input schema present but exposes no named parameters.

NameTypeReqDescription
stoppedobjectyes–

No examples provided.

unarchive_project ~38

Bring an archived project (and its client, if archived) back.

NameTypeReqDescription
projectstringyesArchived project id or "Client / Project"
NameTypeReqDescription
okbooleanyes–
restoredstringyes"Client / Project"

No examples provided.

update_client ~81

Rename a client or change the legal name and address printed on its invoices. Only the fields you pass change; the logo is kept.

NameTypeReqDescription
addressstring–Empty string clears it
clientstringyesClient id or exact client name
legal_namestring–Empty string clears it
namestring–New display name
NameTypeReqDescription
clientstringyesThe client's name now
okbooleanyes–

No examples provided.

update_entry ~131

Change an entry's project, date, minutes or note. Only the fields you pass change.

NameTypeReqDescription
datestring–Move the entry to this day, YYYY-MM-DD
durationstring–New duration text such as "1h30" (use this or minutes)
idstringyesThe entry id (from list_entries)
minutesinteger–New whole minutes (use this or duration)
notestring–New description (max 2,000 characters)
projectstring–Move the entry to this project: id or "Client / Project"
NameTypeReqDescription
updatedobjectyes–

No examples provided.

update_project ~132

Rename a project, move it to another client, or change its rate or billable flag. Only the fields you pass change.

NameTypeReqDescription
billableboolean–Whether the time goes on invoices
clientstring–Move the project to this client
hourly_ratenumber–New amount per hour in the client's currency (its own, else the account's), e.g. 85 or 62.5
namestring–New project name
projectstringyesProject id, or "Client / Project" (just the project name works when it is unique)
NameTypeReqDescription
projectobjectyes–

No examples provided.

whoami ~44

The signed-in account (name, email, currency, business details printed on invoices) and what this token may do (read or write). Call this first to confirm the connection.

Input schema present but exposes no named parameters.

NameTypeReqDescription
businessobjectyes–
currencystringyesISO 4217 code every amount is in, e.g. USD or EUR
emailstringyes–
idstringyes–
member_sincestringyesISO time the account was made
namestring|nullyes–
token_accessstringyesWhat this token may do

No examples provided.

Install

How do I install the UseHourly MCP server?

UseHourly runs locally as an npm package, launched with npx -y usehourly-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · usehourly-mcp

# add to Claude Code
claude mcp add app-usehourly-usehourly -- npx -y usehourly-mcp
Common questions

What is the UseHourly MCP server?

UseHourly is an MCP server listed in the public MCP registry as app.usehourly/usehourly. Freelancer time tracking for AI assistants: log time, timers, timesheets, sign-off links, invoices. This page covers its npm package (usehourly-mcp).

Is the UseHourly MCP server safe to use?

UseHourly scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the UseHourly MCP server expose?

UseHourly exposes 32 tools: whoami, list_projects, list_clients, get_client, list_entries, and 27 more. Their descriptions and schemas cost roughly 2,805 tokens of context every time the server is loaded.

Is the UseHourly MCP server still maintained?

UseHourly is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the UseHourly MCP server under?

UseHourly declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

What did VerifyMCP test on the UseHourly MCP server?

VerifyMCP ran 16 checks on UseHourly, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.