# io.usefulapi/cliniko (remote · cliniko.usefulapi.io)

Hosted MCP server for Cliniko — patients, appointments, availability, and invoices for AI agents.

- Trust score: 18/100 (low)
- Change this week: −51
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `cliniko.usefulapi.io`: 18/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-cliniko/cliniko.md), [page](https://verifymcp.io/servers/io-usefulapi-cliniko/cliniko)

## Channel facts

- Endpoint: `https://cliniko.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to connect, but we couldn't read the tool list to see what that exposes.
  - HTTPS not yet verified: we couldn't determine whether a plaintext access path exists.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint returned HTTP 429.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 4 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add --transport http io-usefulapi-cliniko https://cliniko.usefulapi.io/mcp
```

### Codex

```toml
[mcp_servers.io-usefulapi-cliniko]
url = "https://cliniko.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-cliniko": {
      "type": "remote",
      "url": "https://cliniko.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-cliniko --url https://cliniko.usefulapi.io/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-cliniko:
    url: "https://cliniko.usefulapi.io/mcp"
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-cliniko": {
      "type": "http",
      "url": "https://cliniko.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 18, −54)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Stability: 0.20 → unverified
- [security regression] Authorization: pass → unverified
- [security regression] Transport: pass → fail
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: fail → unverified

### 2026-08-02 (score 72, +54)

- [security improvement] Authorization: unverified → pass
- [security improvement] Transport: fail → pass
- [functional regression] MCP protocol: unverified → fail
- [functional improvement] Endpoint reachability: not serving MCP → reachable
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] Tool coverage: unverified → 100

### 2026-08-01 (score 18, −53)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Stability: 0.13 → unverified
- [security regression] Authorization: pass → unverified
- [security regression] Transport: pass → fail
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: fail → unverified

### 2026-07-31 (score 71, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 68, −2)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-28 (score 69, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-07-27 (score 69, +57)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (17)

### `cliniko_get_account` (~43 tokens)

Get account details

Get the Cliniko account and subscription details for the authenticated API key. A good first call to sanity-check auth, shard, and User-Agent. GET /account.

### `cliniko_list_patients` (~145 tokens)

List patients

Search/list patients. Name/email filters use Cliniko 'contains' matching (q[]=field:~value). GET /patients.

Input parameters:

- `email` (string): Filter by email (contains match).
- `first_name` (string): Filter by first name (contains match).
- `last_name` (string): Filter by last name (contains match).
- `order` (string): Sort direction. asc | desc.
- `page` (integer): Page number (1-based). Default 1.
- `per_page` (integer): Results per page (max 100). Default 50.
- `sort` (string): Field to sort by, e.g. created_at.

### `cliniko_get_patient` (~30 tokens)

Get a patient

Fetch a single patient by id. GET /patients/{id}.

Input parameters:

- `id` (required): Patient id.

### `cliniko_list_appointments` (~213 tokens)

List appointments

List individual appointments, optionally filtered by patient/practitioner/business/type and a starts_at date-time window (starts_from / starts_to, ISO 8601). GET /individual_appointments.

Input parameters:

- `appointment_type_id`: Filter by appointment type id.
- `business_id`: Filter by business id.
- `order` (string): Sort direction. asc | desc.
- `page` (integer): Page number (1-based). Default 1.
- `patient_id`: Filter by patient id (q[]=patient_id:=).
- `per_page` (integer): Results per page (max 100). Default 50.
- `practitioner_id`: Filter by practitioner id.
- `sort` (string): Field to sort by, e.g. created_at.
- `starts_from` (string): Only appointments starting at/after this ISO 8601 time (q[]=starts_at:>).
- `starts_to` (string): Only appointments starting before this ISO 8601 time (q[]=starts_at:<).

### `cliniko_get_appointment` (~35 tokens)

Get an appointment

Fetch a single individual appointment by id. GET /individual_appointments/{id}.

Input parameters:

- `id` (required): Individual appointment id.

### `cliniko_list_practitioners` (~61 tokens)

List practitioners

List practitioners in the account. GET /practitioners.

Input parameters:

- `page` (integer): Page number (1-based). Default 1.
- `per_page` (integer): Results per page (max 100). Default 50.

### `cliniko_list_businesses` (~61 tokens)

List businesses

List businesses (practice locations) in the account. GET /businesses.

Input parameters:

- `page` (integer): Page number (1-based). Default 1.
- `per_page` (integer): Results per page (max 100). Default 50.

### `cliniko_list_appointment_types` (~59 tokens)

List appointment types

List appointment types (service definitions). GET /appointment_types.

Input parameters:

- `page` (integer): Page number (1-based). Default 1.
- `per_page` (integer): Results per page (max 100). Default 50.

### `cliniko_list_products` (~55 tokens)

List products

List billable products/items. GET /products.

Input parameters:

- `page` (integer): Page number (1-based). Default 1.
- `per_page` (integer): Results per page (max 100). Default 50.

### `cliniko_list_invoices` (~105 tokens)

List invoices

List invoices, optionally filtered by patient. GET /invoices.

Input parameters:

- `order` (string): Sort direction. asc | desc.
- `page` (integer): Page number (1-based). Default 1.
- `patient_id`: Filter by patient id (q[]=patient_id:=).
- `per_page` (integer): Results per page (max 100). Default 50.
- `sort` (string): Field to sort by, e.g. created_at.

### `cliniko_get_invoice` (~31 tokens)

Get an invoice

Fetch a single invoice by id. GET /invoices/{id}.

Input parameters:

- `id` (required): Invoice id.

### `cliniko_list_treatment_notes` (~98 tokens)

List treatment notes

List treatment notes, optionally filtered by patient. NOTE: treatment notes are protected health information (PHI) — handle with care. Read-only. GET /treatment_notes.

Input parameters:

- `page` (integer): Page number (1-based). Default 1.
- `patient_id`: Filter by patient id (q[]=patient_id:=).
- `per_page` (integer): Results per page (max 100). Default 50.

### `cliniko_get_treatment_note` (~51 tokens)

Get a treatment note

Fetch a single treatment note by id. NOTE: treatment notes are protected health information (PHI). Read-only. GET /treatment_notes/{id}.

Input parameters:

- `id` (required): Treatment note id.

### `cliniko_list_available_times` (~156 tokens)

List available times

List bookable appointment slots for a business + practitioner + appointment type within a date range (from/to, yyyy-mm-dd, span <= 7 days). High-value booking-slot lookup. GET /businesses/{business_id}/practitioners/{practitioner_id}/appointment_types/{appointment_type_id}/available_times.

Input parameters:

- `appointment_type_id` (required): Appointment type id (path).
- `business_id` (required): Business id (path).
- `from` (string, required): Range start yyyy-mm-dd (cannot be more than 7 days before `to`).
- `practitioner_id` (required): Practitioner id (path).
- `to` (string, required): Range end yyyy-mm-dd (cannot be more than 7 days after `from`).

### `cliniko_next_available_time` (~110 tokens)

Next available time

Get the single next bookable slot for a business + practitioner + appointment type (optionally from a date). GET /businesses/{business_id}/practitioners/{practitioner_id}/appointment_types/{appointment_type_id}/next_available_time.

Input parameters:

- `appointment_type_id` (required): Appointment type id (path).
- `business_id` (required): Business id (path).
- `from` (string): Optional earliest date yyyy-mm-dd to search from.
- `practitioner_id` (required): Practitioner id (path).

### `cliniko_create_patient` (~174 tokens)

Create a patient

WRITE — creates a REAL new patient record in the live Cliniko practice. Requires first_name + last_name. POST /patients.

Input parameters:

- `address_1` (string): Street address line 1.
- `city` (string): City.
- `country_code` (string): ISO country code, e.g. AU.
- `date_of_birth` (string): Date of birth yyyy-mm-dd.
- `email` (string): Email address.
- `first_name` (string, required): Patient first name (required).
- `last_name` (string, required): Patient last name (required).
- `notes` (string): Free-text notes.
- `phone_number` (string): A phone number (stored as a Mobile phone number).
- `post_code` (string): Post / ZIP code.
- `state` (string): State / region.

### `cliniko_create_appointment` (~173 tokens)

Create an appointment

WRITE — books a REAL new individual appointment in the live Cliniko practice. Requires patient_id, practitioner_id, business_id, appointment_type_id, and starts_at (ISO 8601). ends_at defaults from the appointment type if omitted. POST /individual_appointments.

Input parameters:

- `appointment_type_id` (required): Appointment type id (required).
- `business_id` (required): Business id (required).
- `ends_at` (string): End time, ISO 8601. Defaults from the appointment type if omitted.
- `notes` (string): Appointment notes.
- `patient_id` (required): Patient id (required).
- `practitioner_id` (required): Practitioner id (required).
- `starts_at` (string, required): Start time, ISO 8601 e.g. 2026-07-20T09:00:00Z (required).

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-cliniko/cliniko#diagnostics

## Score history

- 2026-08-03: 18
- 2026-08-02: 72
- 2026-08-01: 18
- 2026-07-31: 71
- 2026-07-30: 68
- 2026-07-29: 70
- 2026-07-28: 69
- 2026-07-27: 69
- 2026-07-26: 12

## Links

- Remote endpoint: https://cliniko.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-cliniko/cliniko/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-cliniko/cliniko/changelog.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-cliniko/cliniko