# RotaCloud MCP by usefulapi (remote · rotacloud.usefulapi.io)

Read RotaCloud shifts, attendance, leave, availability and payroll; create shifts and handle leave.

- Trust score: 64/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-16

## Components

- remote · `rotacloud.usefulapi.io`: 64/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-rotacloud/rotacloud.md), [page](https://verifymcp.io/servers/io-usefulapi-rotacloud/rotacloud)

## Channel facts

- Endpoint: `https://rotacloud.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.2.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-16.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 80/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3618 tokens (~139/item across 26 items; 26 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 20/100
  - Stability observed for 6 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 88/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 1 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "rotacloud_list_pay_periods" implies "pay" and declares readOnlyHint instead, contradicting what its own name says it does.
  - An AI judge read all 27 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the RotaCloud MCP by usefulapi server?

RotaCloud MCP by usefulapi is a hosted endpoint at https://rotacloud.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-rotacloud 'https://rotacloud.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-rotacloud": {
      "url": "https://rotacloud.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-rotacloud": {
      "type": "http",
      "url": "https://rotacloud.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-rotacloud]
url = "https://rotacloud.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-rotacloud": {
      "type": "remote",
      "url": "https://rotacloud.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-rotacloud --url 'https://rotacloud.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-rotacloud:
    url: "https://rotacloud.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-rotacloud": {
      "Transport": "http",
      "Url": "https://rotacloud.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-rotacloud -t streamable-http -u 'https://rotacloud.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-rotacloud": {
      "type": "http",
      "url": "https://rotacloud.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-15 (score 64, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-14 (score 63, +2)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional] The server now declares the “prompts” capability
- [functional] First check of Schema quality: 100
- [functional] New prompt “getting_started”
- [functional] Server version: 1.4.0 → 1.5.0

### 2026-10-13 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-12 (score 60, +1)

- [functional improvement] Stability: unverified → 0.07

### 2026-10-10 (score 59)

First indexed and scored.

## MCP tools (26)

### `rotacloud_list_accounts` (~93 tokens)

List accounts

The RotaCloud account(s) this API key belongs to: name, plan, time zone, employee count. GET /accounts.

Input parameters:

- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_list_users` (~142 tokens)

List users

List employees (users) with their level, roles, locations, contact details and pay settings. Use it to map user ids in shifts, leave and attendance to names. GET /users.

Input parameters:

- `ids` (array): Only these user ids.
- `include_deleted` (boolean): Include deleted (former) users.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `locations` (array): Only users in these location ids.
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_get_user` (~35 tokens)

Get user

One employee by id. GET /users/{id}.

Input parameters:

- `user_id` (integer, required): RotaCloud user id.

### `rotacloud_list_locations` (~107 tokens)

List locations

List locations (sites/branches) with address, time zone and managers. GET /locations.

Input parameters:

- `ids` (array): Only these location ids.
- `include_deleted` (boolean): Include deleted locations.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_list_roles` (~107 tokens)

List roles

List job roles (positions) with colour, default break and pay rate. GET /roles.

Input parameters:

- `ids` (array): Only these role ids.
- `include_deleted` (boolean): Include deleted roles.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_list_shifts` (~345 tokens)

List shifts

List rota shifts in a time range: start/end times (Unix seconds), break, assigned user (null = open shift), location, role, notes, published and acknowledged state. Filter by users, locations, roles, open or published. GET /shifts.

Input parameters:

- `end` (required): Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `include_deleted` (boolean): Include deleted shifts.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `locations` (array): Only shifts at these location ids.
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `open` (boolean): true = only open (unassigned) shifts, false = only assigned shifts.
- `published` (boolean): true = only published shifts, false = only unpublished (draft) shifts.
- `roles` (array): Only shifts with these role ids.
- `start` (required): Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `users` (array): Only shifts of these user ids (add 0 to include open shifts).

### `rotacloud_get_shift` (~36 tokens)

Get shift

One shift by id. GET /shifts/{id}.

Input parameters:

- `shift_id` (integer, required): RotaCloud shift id.

### `rotacloud_list_swap_requests` (~99 tokens)

List shift swap requests

List shift swap requests with their status, the shifts and the users involved. GET /swap_requests.

Input parameters:

- `include_deleted` (boolean): Include deleted swap requests.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_list_day_notes` (~134 tokens)

List day notes

List day notes (notices pinned to rota dates, e.g. events or deliveries), optionally for one location. GET /day_notes.

Input parameters:

- `end` (string): Last date (yyyy-mm-dd).
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `location` (integer): Only notes for this location id.
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `start` (string): First date (yyyy-mm-dd).

### `rotacloud_list_attendance` (~283 tokens)

List attendance records

List time & attendance records (clock-in/out times, breaks, minutes late, hours, approval state) in a time range. GET /attendance.

Input parameters:

- `approved` (boolean): true = only approved records, false = only unapproved.
- `end` (required): Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `include_deleted` (boolean): Include deleted records.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `locations` (array): Only these location ids.
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `roles` (array): Only these role ids.
- `start` (required): Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `users` (array): Only these user ids.

### `rotacloud_list_clocked_in` (~99 tokens)

List clocked-in users

Who is clocked in right now: user, location, role, clock-in time, minutes late and break state. GET /users_clocked_in.

Input parameters:

- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_list_leave` (~237 tokens)

List leave

List booked leave (holiday, sickness, etc.) with type, user, dates, hours and status. Filter by date range or leave year, users and leave types; pending/denied/expired requests are excluded unless asked for. GET /leave.

Input parameters:

- `end` (string): Last date (yyyy-mm-dd).
- `include_deleted` (boolean): Include deleted leave.
- `include_denied` (boolean): Include denied leave requests.
- `include_expired` (boolean): Include expired leave requests.
- `include_requested` (boolean): Include pending leave requests.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `start` (string): First date (yyyy-mm-dd).
- `types` (array): Only these leave type ids (see rotacloud_list_leave_types).
- `users` (array): Only these user ids.
- `year` (integer): Leave year instead of a date range.

### `rotacloud_list_leave_requests` (~109 tokens)

List leave requests

List leave requests awaiting a decision (and past ones): user, leave type, dates, half days, the employee's message. GET /leave_requests.

Input parameters:

- `include_deleted` (boolean): Include deleted requests.
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_get_leave_request` (~42 tokens)

Get leave request

One leave request by id, with the per-day breakdown. GET /leave_requests/{id}.

Input parameters:

- `request_id` (integer, required): Leave request id.

### `rotacloud_list_leave_types` (~97 tokens)

List leave types

List leave types (Holiday, Sickness, Unpaid, ...) with id, short name and whether employees can request them. GET /leave_types.

Input parameters:

- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.

### `rotacloud_list_holiday_allowances` (~113 tokens)

List holiday allowances

Every employee's holiday allowance for a leave year (default and custom allowance, unit, carried over). GET /holiday_allowances/{year}.

Input parameters:

- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `year` (integer, required): Leave year, e.g. 2026.

### `rotacloud_get_availability` (~122 tokens)

Get availability

Employees' availability per date in a range (available / unavailable times). GET /availability.

Input parameters:

- `end` (string, required): Last date (yyyy-mm-dd).
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `start` (string, required): First date (yyyy-mm-dd).
- `users` (array): Only these user ids.

### `rotacloud_list_days_off` (~120 tokens)

List days off

Employees' scheduled days off per date in a range. GET /days_off.

Input parameters:

- `end` (string, required): Last date (yyyy-mm-dd).
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `start` (string, required): First date (yyyy-mm-dd).
- `users` (array): Only these user ids.

### `rotacloud_list_pay_periods` (~118 tokens)

List pay periods

List pay periods overlapping a date range (id, name, start/end date, locked). GET /pay_periods.

Input parameters:

- `end` (string, required): Last date (yyyy-mm-dd).
- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `start` (string, required): First date (yyyy-mm-dd).

### `rotacloud_get_payroll` (~128 tokens)

Get payroll for a pay period

Payroll for one pay period, per employee: pay settings, attendance worked, paid/unpaid leave, overtime and pay totals. Contains pay data. GET /pay_periods/{id}/payroll.

Input parameters:

- `limit` (integer): Results per page, 1-500 (RotaCloud may cap it lower; the reply's total and next_offset show what is left).
- `offset` (integer): Index of the first result; pass the previous reply's next_offset.
- `pay_period_id` (integer, required): Pay period id (from rotacloud_list_pay_periods).

### `rotacloud_create_shift` (~246 tokens)

Create shift

WRITE: create a shift on the rota. Leave user_id out for an open shift. Unpublished by default (employees see it once published). POST /shifts.

Input parameters:

- `end_time` (required): Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `location_id` (integer, required): Location id.
- `minutes_break` (integer): Unpaid break in minutes.
- `notes` (string): Shift notes shown to the employee.
- `published` (boolean): Publish immediately (default false).
- `role_id` (integer): Role id.
- `start_time` (required): Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `user_id` (integer): Assigned user id; omit for an open shift.

### `rotacloud_update_shift` (~252 tokens)

Update shift

WRITE: change a shift's times, assignee, location, role, break, notes or published state. Only the fields you pass change. POST /shifts/{id}.

Input parameters:

- `end_time`: Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `location_id` (integer): New location id.
- `minutes_break` (integer): Unpaid break in minutes.
- `notes` (string): Shift notes.
- `published` (boolean): Published state.
- `role_id` (integer): New role id.
- `shift_id` (integer, required): Shift id.
- `start_time`: Unix timestamp (seconds), an ISO 8601 date (2026-10-12 = 00:00 UTC) or an ISO 8601 date-time with a time zone (2026-10-12T09:00:00+01:00 or ...Z).
- `user_id`: New assignee; null makes it an open shift.

### `rotacloud_publish_shifts` (~49 tokens)

Publish shifts

WRITE: publish shifts so the assigned employees see them (and get notified). POST /shifts_published.

Input parameters:

- `shift_ids` (array, required): Ids of the shifts to publish.

### `rotacloud_create_leave_request` (~175 tokens)

Request leave

WRITE: submit a leave request on behalf of an employee (sent as that user, for a manager to approve). POST /leave_requests with the User header.

Input parameters:

- `end_am_pm` (string): 'am' ends at midday (half day); default 'pm'.
- `end_date` (string, required): Last day (yyyy-mm-dd).
- `leave_type_id` (integer, required): Leave type id (see rotacloud_list_leave_types; must be requestable).
- `message` (string): Message from the employee to the manager.
- `start_am_pm` (string): 'pm' starts at midday (half day); default 'am'.
- `start_date` (string, required): First day (yyyy-mm-dd).
- `user_id` (integer, required): The employee requesting leave (the request is made as this user).

### `rotacloud_approve_leave_request` (~63 tokens)

Approve leave request

WRITE: approve a pending leave request (it becomes booked leave and the employee is notified). POST /leave_requests/{id}/approve.

Input parameters:

- `admin_message` (string): Message to the employee.
- `request_id` (integer, required): Leave request id.

### `rotacloud_deny_leave_request` (~59 tokens)

Deny leave request

WRITE: deny a pending leave request (the employee is notified). POST /leave_requests/{id}/deny.

Input parameters:

- `admin_message` (string): Reason shown to the employee.
- `request_id` (integer, required): Leave request id.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-rotacloud/rotacloud#diagnostics

## Score history

- 2026-10-16: 64
- 2026-10-15: 64
- 2026-10-14: 63
- 2026-10-13: 61
- 2026-10-12: 60
- 2026-10-10: 59

## Common questions

### What is the RotaCloud MCP by usefulapi server?

RotaCloud MCP by usefulapi is listed in the public MCP registry as io.usefulapi/rotacloud. Read RotaCloud shifts, attendance, leave, availability and payroll; create shifts and handle leave. This page covers its hosted endpoint (https://rotacloud.usefulapi.io/mcp).

### Is the RotaCloud MCP by usefulapi server safe to use?

RotaCloud MCP by usefulapi scores 64 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the RotaCloud MCP by usefulapi server expose?

RotaCloud MCP by usefulapi exposes 26 tools: rotacloud_list_accounts, rotacloud_list_users, rotacloud_get_user, rotacloud_list_locations, rotacloud_list_roles, and 21 more. Their descriptions and schemas cost roughly 3,410 tokens of context every time the server is loaded.

### Does the RotaCloud MCP by usefulapi server require authentication?

Yes. RotaCloud MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the RotaCloud MCP by usefulapi server still maintained?

RotaCloud MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 16 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://rotacloud.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/rotacloud/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-rotacloud/rotacloud.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-rotacloud/rotacloud.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-rotacloud/rotacloud