# Jisr MCP by usefulapi (remote · jisr.usefulapi.io)

Read employees, attendance, leave and payroll; create employee records and import device punches.

- Trust score: 18/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `jisr.usefulapi.io`: 18/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-jisr/jisr.md), [page](https://verifymcp.io/servers/io-usefulapi-jisr/jisr)

## Channel facts

- Endpoint: `https://jisr.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.7.3`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Tool Safety**: 0/100
  - Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 5 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### How do I install the Jisr MCP by usefulapi server?

Jisr MCP by usefulapi is a hosted endpoint at https://jisr.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-jisr 'https://jisr.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-jisr": {
      "url": "https://jisr.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-jisr": {
      "type": "http",
      "url": "https://jisr.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-jisr]
url = "https://jisr.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-jisr": {
      "type": "remote",
      "url": "https://jisr.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-jisr --url 'https://jisr.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-jisr:
    url: "https://jisr.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-jisr": {
      "Transport": "http",
      "Url": "https://jisr.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-jisr -t streamable-http -u 'https://jisr.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-jisr": {
      "type": "http",
      "url": "https://jisr.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-02 (score 18, −47)

- [security regression] Endpoint reachability: reachable → not serving MCP
- [security regression] Tool safety: pass → unverified
- [security regression] Authorization: pass → unverified
- [security regression] Stability: 0.03 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-11-01 (score 65, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-31 (score 64)

First indexed and scored.

## MCP tools (16)

### `jisr_list_employees` (~311 tokens)

List employees

List the organization's employees (active by default) with code, names (English/Arabic), job title, department, business unit, employment type, line manager, joining date and status. Filter by active/inactive status, creation date and joining, termination or deletion date ranges. If the API key also has the 'Get Employee Financial Info' / 'Accounting Info' permissions, Jisr adds salary, bank (IBAN) and accounting fields: sensitive HR data. GET /openapi/v1/employees.

Input parameters:

- `created_from` (string): Only employees created on or after this date (yyyy-mm-dd).
- `deleted_from` (string): Only employees deleted from the system on or after this date.
- `deleted_to` (string): Only employees deleted from the system on or before this date.
- `joining_from` (string): Only employees who joined on or after this date.
- `joining_to` (string): Only employees who joined on or before this date.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `rpp` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `rpp`.
- `status` (string): Only active or only inactive employees.
- `terminated_from` (string): Only employees off-boarded on or after this date.
- `terminated_to` (string): Only employees off-boarded on or before this date.

### `jisr_get_employee` (~90 tokens)

Get employee

One employee's profile by id (UUID from jisr_list_employees): names, code, gender, marital status, phone, emails, date of birth, passport/ID number, address, line manager, department, business unit, employment type, location, nationality and contract. GET /openapi/v1/employees/basic_info?id=.

Input parameters:

- `id` (string, required): Employee id (UUID).

### `jisr_get_employee_financial_info` (~73 tokens)

Get employee financial info

One employee's financial details by id: salary components and bank account (IBAN). Sensitive payroll data; needs the 'Get Employee Financial Info' permission on the API key. GET /openapi/v1/employees/financial_info?id=.

Input parameters:

- `id` (string, required): Employee id (UUID).

### `jisr_list_lookup` (~129 tokens)

List lookup values

List one of the organization's lookup tables: departments, employment_types, business_units, locations, nationalities or outsourcing_companies, with their ids and English/Arabic names. Use the ids when creating an employee. GET /openapi/v1/lookups/{table}.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `rpp` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `rpp`.
- `table` (string, required): Which lookup table.

### `jisr_list_attendance_summary` (~184 tokens)

List attendance summary

Attendance summary per employee for a date range (default: the current month): total working hours, late arrival, early departure, extra and approved overtime, absence days and records. Filter by one employee or by active/inactive status. GET /openapi/v1/attendance/summary.

Input parameters:

- `employee_id` (string): Only this employee (UUID).
- `from` (string): Period start (yyyy-mm-dd). Default: start of the current month.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `rpp` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `rpp`.
- `status` (string): Only active or inactive employees.
- `to` (string): Period end (yyyy-mm-dd).

### `jisr_list_attendance_punches` (~194 tokens)

List attendance punches

List raw clock-in/out punches that were received from punch devices, either the ones that were processed successfully or the ones that failed, in a time window (Jisr's default: the last hour). Each punch has id, punch_time, employee_code, terminal_sn and clocking_id. GET /openapi/v1/attendance_logs.

Input parameters:

- `from` (string): Window start, yyyy-mm-dd hh:mm:ss. Default: one hour ago.
- `limit` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `limit`.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `status` (string, required): Which punches: processed successfully, or failed.
- `to` (string): Window end, yyyy-mm-dd hh:mm:ss. Default: now.

### `jisr_get_annual_leave_balances` (~135 tokens)

Get annual leave balances

Annual leave balance summaries per employee (all employees, or only the given employee codes, at most 100). Only the annual leave type is supported by Jisr. GET /openapi/v1/employee_leaves/summary.

Input parameters:

- `employee_codes` (array): Employee codes (not ids) to include; omit for everyone.
- `limit` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `limit`.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.

### `jisr_list_paygroups` (~99 tokens)

List pay groups

List the organization's pay groups (id and name). The pay group id is needed for payroll and accrual queries. GET /openapi/v1/paygroups.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `rpp` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `rpp`.

### `jisr_list_payroll_transactions` (~283 tokens)

List payroll transactions

Payroll transactions per employee for one settlement type. type 'payrun' (the regular payroll) needs pay_period and paygroup_id; 'final_settlements', 'vacations_settlements' and 'out_off_payroll_transactions' need a from/to date range. Optionally filter by employee ids or transaction type ids (jisr_list_gl_transaction_types). Sensitive payroll data. GET /openapi/v1/payroll_transactions.

Input parameters:

- `employee_ids` (array): Only these employees (UUIDs).
- `from` (string): Start date (yyyy-mm-dd). Required for the other types.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `pay_period` (string): First day of a confirmed month (yyyy-mm-01). Required for type payrun.
- `paygroup_id` (string): Pay group id (UUID, jisr_list_paygroups). Required for type payrun.
- `rpp` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `rpp`.
- `to` (string): End date (yyyy-mm-dd). Required for the other types.
- `transaction_type_ids` (array): Only these transaction types (UUIDs).
- `type` (string, required): Which settlement.

### `jisr_list_accrual_transactions` (~177 tokens)

List accrual transactions

Accruals per employee for a confirmed pay period: vacations, end_of_service or tickets_provision (amount, vacation days). Sensitive payroll data. GET /openapi/v1/accrual_transactions.

Input parameters:

- `accrual_type` (string, required): Accrual type.
- `employee_ids` (array): Only these employees (UUIDs).
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `pay_period` (string, required): First day of a confirmed month (yyyy-mm-01).
- `paygroup_id` (string, required): Pay group id (UUID, jisr_list_paygroups).
- `rpp` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `rpp`.

### `jisr_get_employee_monthly_payables` (~97 tokens)

Get employee monthly payables

One employee's payables for a month: net salary, earnings, additions and deductions with breakdowns. Only available to organizations Jisr has whitelisted for this API. Sensitive payroll data. GET /openapi/v1/employee_monthly_payables.

Input parameters:

- `employee_id` (string, required): Employee id (UUID).
- `pay_period_start` (string, required): First day of the month (yyyy-mm-01).

### `jisr_list_gl_transaction_types` (~116 tokens)

List transaction types

List the payroll (GL) transaction types: id, category (allowances, loan types...), English/Arabic name and status. Use the ids to filter jisr_list_payroll_transactions. GET /openapi/v1/gl_transaction_types.

Input parameters:

- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `rpp` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `rpp`.

### `jisr_list_audit_events` (~216 tokens)

List audit events

The organization's audit trail: who did what and when (module, feature, action, actor, success). Filter by module, event name, event type and a time range. GET /openapi/v1/audit_events.

Input parameters:

- `event_name` (array): Event names, e.g. login.
- `event_type` (array): Event types, e.g. updated.
- `from` (string): Only events created at or after this ISO 8601 date-time, e.g. 2026-10-01T00:00:00Z.
- `module_name` (array): Module names, e.g. security.
- `page` (integer): Page number, from 1 (default 1). Pass the previous reply's next_page.
- `per_page` (integer): Results per page, 1-100 (Jisr's default is 100). Sent as `per_page`.
- `to` (string): Only events created at or before this ISO 8601 date-time.

### `jisr_list_webhooks` (~73 tokens)

List webhooks

List the webhooks registered for the organization: name, endpoint host, method, status. Authentication data, custom header values and the endpoint's path and query (they can hold secrets) are hidden. Read-only; this server does not create or change webhooks. GET /openapi/v1/webhooks.

### `jisr_create_employee` (~323 tokens)

Create employee

WRITE: register a new employee in Jisr (they are invited to the system by email). Not reversible through this server: there is no delete tool. Get department_id, employment_type_id, location_id and nationality_id from jisr_list_lookup first. Names need at least two parts. POST /openapi/v1/employees.

Input parameters:

- `code` (string, required): Employee code, unique within the organization.
- `contract_end_date` (string): Contract end date (yyyy-mm-dd), for fixed-term contracts.
- `contract_period` (string, required): Contract period.
- `contract_type` (string, required): Contract type.
- `department_id` (integer, required): Department id (jisr_list_lookup departments).
- `document_number` (string, required): National ID or Iqama number.
- `email` (string, required): Work email.
- `employment_type_id` (integer, required): Employment type id (jisr_list_lookup employment_types).
- `full_name_ar` (string, required): Full name in Arabic (at least two words).
- `full_name_en` (string, required): Full name in English (at least two words).
- `gender` (string, required)
- `joining_date` (string, required): Joining date (yyyy-mm-dd).
- `location_id` (integer, required): Location id (jisr_list_lookup locations).
- `marital_status` (string, required)
- `nationality_id` (integer, required): Nationality id (jisr_list_lookup nationalities).
- `outsourcing_company_id` (integer): Outsourcing company id, for outsourced staff.
- `personal_email` (string): Personal email (unique among active employees).

### `jisr_create_attendance_punches` (~93 tokens)

Import attendance punches

WRITE: send a batch of raw clock-in/out punches (at most 100) from a punch device into Jisr attendance. Jisr processes them asynchronously; check the result with jisr_list_attendance_punches. Each punch carries the unique id its device generated; do not invent ids. POST /openapi/v1/attendance_logs.

Input parameters:

- `punches` (array, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-jisr/jisr#diagnostics

## Score history

- 2026-11-05: 18
- 2026-11-04: 18
- 2026-11-03: 18
- 2026-11-02: 18
- 2026-11-01: 65
- 2026-10-31: 64

## Common questions

### What is the Jisr MCP by usefulapi server?

Jisr MCP by usefulapi is listed in the public MCP registry as io.usefulapi/jisr. Read employees, attendance, leave and payroll; create employee records and import device punches. This page covers its hosted endpoint (https://jisr.usefulapi.io/mcp).

### Is the Jisr MCP by usefulapi server safe to use?

Jisr MCP by usefulapi scores 18 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Jisr MCP by usefulapi server expose?

Jisr MCP by usefulapi exposes 16 tools: jisr_list_employees, jisr_get_employee, jisr_get_employee_financial_info, jisr_list_lookup, jisr_list_attendance_summary, and 11 more. Their descriptions and schemas cost roughly 2,593 tokens of context every time the server is loaded.

### Does the Jisr MCP by usefulapi server require authentication?

Its publisher declares no required credentials for Jisr MCP by usefulapi. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

### Is the Jisr MCP by usefulapi server still maintained?

Jisr MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Jisr MCP by usefulapi server?

VerifyMCP ran 4 checks on Jisr MCP by usefulapi, covering TLS certificate, HSTS header, DNSSEC and Transport. 7 items could not be completed, a gap on our side rather than a finding about Jisr MCP by usefulapi: Authorization, HTTPS, Schema quality, Stability and 3 more. 5 categories score 0 for that reason, because we only credit what we can confirm. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://jisr.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/jisr/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-jisr/jisr.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-jisr/jisr/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/io-usefulapi-jisr/jisr.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-jisr/jisr