# Bilflo MCP by usefulapi (remote · bilflo.usefulapi.io)

Read Bilflo clients, contract jobs, contractors and reports; update jobs, terminate or reopen them.

- Trust score: 61/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-25

## Components

- remote · `bilflo.usefulapi.io`: 61/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-bilflo/bilflo.md), [page](https://verifymcp.io/servers/io-usefulapi-bilflo/bilflo)

## Channel facts

- Endpoint: `https://bilflo.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.1.3`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-25.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 84/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2432 tokens (~93/item across 26 items; 26 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 88/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 64% of tool parameters carry a description.
- **Tool Safety**: 88/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 1 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "bilflo_list_job_pay_bill_items" implies "pay" and declares readOnlyHint instead, contradicting what its own name says it does.
  - An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the Bilflo MCP by usefulapi server?

Bilflo MCP by usefulapi is a hosted endpoint at https://bilflo.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-bilflo 'https://bilflo.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-bilflo": {
      "url": "https://bilflo.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-bilflo": {
      "type": "http",
      "url": "https://bilflo.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-bilflo]
url = "https://bilflo.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-bilflo": {
      "type": "remote",
      "url": "https://bilflo.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-bilflo --url 'https://bilflo.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-bilflo:
    url: "https://bilflo.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-bilflo": {
      "Transport": "http",
      "Url": "https://bilflo.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-bilflo -t streamable-http -u 'https://bilflo.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-bilflo": {
      "type": "http",
      "url": "https://bilflo.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-25 (score 61, 0)

- [functional improvement] Stability: unverified → 0.03
- [functional] Server version: 1.1.0 → 1.1.3

### 2026-10-24 (score 61)

First indexed and scored.

## MCP tools (26)

### `bilflo_list_clients` (~182 tokens)

List clients

The staffing company's clients (the customers contractors are placed with): id, business name, client code, phone, active flag. Each row carries the number of addresses and contacts; set include_details for the full address and contact lists. Bilflo returns every client at once, so this tool filters and pages the list itself. GET /v1/Clients.

Input parameters:

- `active_only` (boolean): Only active clients.
- `include_details` (boolean): Include each client's addresses and contacts (large; use with a small limit).
- `limit` (integer): Rows to return, 1-200 (default 50).
- `offset` (integer): Rows to skip (default 0). Bilflo does not page, so the list is cut here.
- `search` (string): Only clients whose business name or client code contains this text (case-insensitive).

### `bilflo_get_client` (~46 tokens)

Get client

One client with its addresses and contacts. GET /v1/Clients/{clientId}.

Input parameters:

- `client_id` (integer, required): Bilflo client id (from bilflo_list_clients).

### `bilflo_list_client_contacts` (~57 tokens)

List client contacts

The contacts (people at the client: name, title, phone, email, active flag) of one client. GET /v1/Clients/contact/{clientId}.

Input parameters:

- `client_id` (integer, required): Bilflo client id.

### `bilflo_list_client_addresses` (~48 tokens)

List client addresses

The addresses (work sites and billing addresses) of one client. GET /v1/Clients/addresses/{clientId}.

Input parameters:

- `client_id` (integer, required): Bilflo client id.

### `bilflo_list_client_agreements` (~49 tokens)

List client agreements

The agreements (billing terms) on file for one client. GET /v1/Clients/agreements/{clientId}.

Input parameters:

- `client_id` (integer, required): Bilflo client id.

### `bilflo_list_client_contract_pos` (~54 tokens)

List client contract POs

The contract purchase orders of one client (PO numbers and amounts used for billing). GET /v1/Clients/contractPOs/{clientId}.

Input parameters:

- `client_id` (integer, required): Bilflo client id.

### `bilflo_list_client_invoice_groups` (~53 tokens)

List client invoice groups

The contract invoice groups of one client (which jobs are invoiced together). GET /v1/Clients/contractInvoiceGroups/{clientId}.

Input parameters:

- `client_id` (integer, required): Bilflo client id.

### `bilflo_get_contract_job` (~82 tokens)

Get contract job

One contract job (a contractor placed with a client): client, contractor, title, start/end dates, status, overtime rule, timecard method, per-diem/expense/sick-time flags, workers' comp code and burden. GET /v1/ContractJobs/{jobId}.

Input parameters:

- `job_id` (integer, required): Bilflo contract job id.

### `bilflo_list_job_pay_bill_items` (~63 tokens)

List job pay/bill items

The pay and bill rates (pay/bill items such as Regular, Overtime) of one contract job. GET /v1/ContractJobs/{jobId}/payBillItems.

Input parameters:

- `job_id` (integer, required): Bilflo contract job id.

### `bilflo_list_job_approvers` (~50 tokens)

List job approvers

Who approves the timecards of one contract job. GET /v1/ContractJobs/{jobId}/approvers.

Input parameters:

- `job_id` (integer, required): Bilflo contract job id.

### `bilflo_list_job_purchase_orders` (~48 tokens)

List job purchase orders

The purchase orders attached to one contract job. GET /v1/ContractJobs/{jobId}/purchaseOrders.

Input parameters:

- `job_id` (integer, required): Bilflo contract job id.

### `bilflo_get_job_custom_fields` (~48 tokens)

Get job custom fields

The custom field values of one contract job. GET /v1/ContractJobs/{jobId}/customFields.

Input parameters:

- `job_id` (integer, required): Bilflo contract job id.

### `bilflo_get_direct_hire` (~63 tokens)

Get direct hire

One direct hire (a permanent placement): header, fee/split data, contacts and custom fields as Bilflo returns them. GET /v1/DirectHires/{jobId}.

Input parameters:

- `job_id` (integer, required): Bilflo direct hire job id.

### `bilflo_get_contractor` (~86 tokens)

Get contractor

One contractor: profile (name, email, phone, address, W2/1099), jobs, checks paid, work status, benefit settings and custom fields. Social security number, date of birth and bank details are removed from the reply. GET /v1/Users/contractors/{contractorId}.

Input parameters:

- `contractor_id` (integer, required): Bilflo contractor id.

### `bilflo_get_team_member` (~65 tokens)

Get team member

One back-office team member (staffing company user): profile, roles and compensation settings. Government ids and bank details are removed. GET /v1/Users/teamMember/{id}.

Input parameters:

- `team_member_id` (integer, required): Bilflo team member (user) id.

### `bilflo_list_overtime_rules` (~42 tokens)

List overtime rules

The company's overtime rules (id, name, state). Use the ids with bilflo_update_contract_job. GET /v1/OvertimeRules.

### `bilflo_get_company_setting` (~62 tokens)

Get company setting

One of the company's lookup lists: workers_comp_codes, payment_terms, remittances, burden_settings, benefit_rules, states or pay_bill_items. GET /v1/CompanySettings/{setting}.

Input parameters:

- `setting` (string, required): Which list to read.

### `bilflo_list_custom_fields` (~46 tokens)

List custom fields

The company's custom fields (active and inactive) with type, requiredness per service offering and, for list fields, the selectable items. GET /v1/CustomFields.

### `bilflo_list_custom_field_items` (~82 tokens)

List custom field items

The selectable items of one custom list field (id from bilflo_list_custom_fields). Items of a field named like personal data (SSN, date of birth, bank account, password) are not shown. GET /v1/CustomFields/items.

Input parameters:

- `custom_field_id` (integer, required): Custom field id (from bilflo_list_custom_fields).

### `bilflo_run_report` (~99 tokens)

Run custom report

Run one of the company's saved custom reports and return its rows. Report parameters are report specific key/value pairs, for example {"Start": "2026-01-01", "End": "2026-01-31"}. Reads data only. POST /v1/Reports/{reportId}/Execute.

Input parameters:

- `parameters` (object): Report parameters as key/value pairs.
- `report_id` (integer, required): Bilflo custom report id.

### `bilflo_create_client` (~78 tokens)

Create client

WRITE: creates a new client (customer) in Bilflo with the given business name and returns its id. It is visible to the whole staffing company and used for billing, so check bilflo_list_clients first to avoid a duplicate. POST /v1/Clients.

Input parameters:

- `business_name` (string, required): Business name of the new client.

### `bilflo_update_client` (~122 tokens)

Update client

WRITE: changes only the client fields you pass (business name, client code, phone, fax, active flag); the rest stay as they are. Setting is_active=false deactivates the client. PATCH /v1/Clients/{clientId}.

Input parameters:

- `business_name` (string)
- `client_code` (string)
- `client_id` (integer, required): Bilflo client id.
- `fax` (string)
- `is_active` (boolean): false deactivates the client, true reactivates it.
- `phone` (string)

### `bilflo_update_contract_job` (~225 tokens)

Update contract job

WRITE: changes only the contract job fields you pass (title, overtime rule, workers' comp code, burden, per-diem/expenses/sick-time/meal-period flags); the rest stay as they are. Pay and bill rates change payroll and invoices, so confirm values with the user. Client, contractor, dates and status cannot be changed here. PATCH /v1/ContractJobs/{jobId}.

Input parameters:

- `burden_manual` (number): Manual burden value.
- `is_allow_skip_lunch` (boolean)
- `is_expenses_enabled` (boolean)
- `is_per_diem_enabled` (boolean)
- `is_sick_time_enabled` (boolean)
- `is_waive_meal_period` (boolean)
- `job_id` (integer, required): Bilflo contract job id.
- `job_title` (string)
- `overtime_rule_id` (integer): Overtime rule id (bilflo_list_overtime_rules).
- `workers_comp_code_id` (integer): Workers' comp code id (bilflo_get_company_setting workers_comp_codes).

### `bilflo_terminate_contract_job` (~103 tokens)

Terminate contract job

WRITE: ends a contract job on the given date (the contractor stops being placed with the client; no more timecards are expected after it). Affects payroll and invoicing. A terminated job can be brought back with bilflo_reopen_contract_job. POST /v1/ContractJobs/terminate.

Input parameters:

- `end_date` (string, required): Last day of the job, yyyy-mm-dd.
- `job_id` (integer, required): Bilflo contract job id.

### `bilflo_reopen_contract_job` (~127 tokens)

Reopen contract job

WRITE: reopens a terminated contract job (like the Open Job button): the job becomes active again, the end date is cleared, the contractor is made active and the missing timecards from the reopen date's week are created. Fails if the job is not terminated or the company plan has no room for another active job. POST /v1/ContractJobs/{jobId}/reopen.

Input parameters:

- `job_id` (integer, required): Bilflo contract job id.
- `reopen_date` (string, required): Date to reopen from, yyyy-mm-dd (not before the job start).

### `bilflo_update_contractor` (~196 tokens)

Update contractor contact details

WRITE: changes only the contractor contact fields you pass (name, title, email, phone, address, company); the rest stay as they are. Tax, bank, social security number and activation are not changeable here. PATCH /v1/Users/contractors/{contractorId}.

Input parameters:

- `address1` (string)
- `address2` (string)
- `city` (string)
- `contractor_company` (string): The contractor's own company name (1099).
- `contractor_id` (integer, required): Bilflo contractor id.
- `email_address` (string)
- `first_name` (string)
- `last_name` (string)
- `middle_name` (string)
- `phone` (string)
- `phone_ext` (string)
- `state_code` (string): Two-letter state code.
- `title` (string)
- `zip_code` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-bilflo/bilflo#diagnostics

## Score history

- 2026-10-25: 61
- 2026-10-24: 61

## Common questions

### What is the Bilflo MCP by usefulapi server?

Bilflo MCP by usefulapi is listed in the public MCP registry as io.usefulapi/bilflo. Read Bilflo clients, contract jobs, contractors and reports; update jobs, terminate or reopen them. This page covers its hosted endpoint (https://bilflo.usefulapi.io/mcp).

### Is the Bilflo MCP by usefulapi server safe to use?

Bilflo MCP by usefulapi scores 61 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Bilflo MCP by usefulapi server expose?

Bilflo MCP by usefulapi exposes 26 tools: bilflo_list_clients, bilflo_get_client, bilflo_list_client_contacts, bilflo_list_client_addresses, bilflo_list_client_agreements, and 21 more. Their descriptions and schemas cost roughly 2,176 tokens of context every time the server is loaded.

### Does the Bilflo MCP by usefulapi server require authentication?

Yes. Bilflo MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Bilflo MCP by usefulapi server still maintained?

Bilflo MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://bilflo.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/bilflo/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-bilflo/bilflo.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-bilflo/bilflo.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-bilflo/bilflo