# Timebook (npm · @squidcode/timebook)

Track time on usetimebook.com - start/stop timers, log entries, list projects/clients.

- Trust score: 77/100 (medium)
- Change this week: +31
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `usetimebook.com`: 38/100, [markdown](https://verifymcp.io/servers/squidcode-timebook/usetimebook.md), [page](https://verifymcp.io/servers/squidcode-timebook/usetimebook)
- npm · `@squidcode/timebook`: 77/100 (this document), [markdown](https://verifymcp.io/servers/squidcode-timebook/squidcode-timebook.md), [page](https://verifymcp.io/servers/squidcode-timebook/squidcode-timebook)

## Channel facts

- Registry: `npm`
- Package: `@squidcode/timebook`
- Version: `0.6.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (108 of 112), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (108 of 112), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to squidcode/timebook-cli).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 58 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 898 tokens (~74/item across 12 items; 12 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add squidcode-timebook -- npx -y @squidcode/timebook
```

### Codex

```bash
codex mcp add squidcode-timebook -- npx -y @squidcode/timebook
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "squidcode-timebook": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@squidcode/timebook"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add squidcode-timebook --command npx --arg -y --arg @squidcode/timebook
```

### Hermes

```yaml
mcp_servers:
  squidcode-timebook:
    command: "npx"
    args: ["-y", "@squidcode/timebook"]
```

### Other

```json
{
  "mcpServers": {
    "squidcode-timebook": {
      "command": "npx",
      "args": [
        "-y",
        "@squidcode/timebook"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 77, +56)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: squidcode/timebook-cli
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional] First check of Schema quality: unverified
- [functional] Licence: MIT

### 2026-07-31 (score 21, −7)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 28, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (12)

### `whoami` (~22 tokens)

Return the currently authenticated Timebook user (id, email, name).

### `list_projects` (~28 tokens)

List all projects available to the current token. Returns id, name, and client for each project.

### `list_clients` (~17 tokens)

List all clients available to the current token.

### `get_active_timer` (~30 tokens)

Return the currently running timer (project, description, started_at), or null if no timer is running.

### `start_timer` (~98 tokens)

Start a timer on a project. Stops any other running timer first — Timebook allows only one active timer at a time.

Input parameters:

- `description` (string): What the user is working on (visible in the time entry).
- `project` (string, required): Project id (UUID) or exact project name. Use list_projects to discover.
- `rate` (string): Optional rate id (UUID) or exact rate name (e.g. "Software Development").

### `stop_timer` (~26 tokens)

Stop the currently running timer. Returns { stopped: false } if no timer was running.

### `log_time` (~202 tokens)

Log a manual (past) time entry. Provide either `duration` (relative to now), or both `startTime` and `endTime` (absolute ISO-8601 timestamps).

Input parameters:

- `description` (string): What the user worked on.
- `duration` (string): How long the work took. Accepts "1h", "45m", "1h30m", "1.5h", "1:30", or "90" (interpreted as minutes).
- `endTime` (string): ISO-8601 end time. Required if duration is omitted.
- `project` (string, required): Project id (UUID) or exact project name.
- `rate` (string): Optional rate id or exact rate name (e.g. "Software Development").
- `startTime` (string): ISO-8601 start time (e.g. "2026-05-04T09:00:00Z"). Required if duration is omitted.

### `list_entries` (~126 tokens)

List recent time entries, optionally filtered by project and/or date range. Returns at most 50 entries by default; pass a higher `limit` to see more.

Input parameters:

- `endDate` (string): ISO-8601 — only entries whose start time is on or before this.
- `limit` (integer): Maximum number of entries to return. Defaults to 50.
- `project` (string): Optional project id or exact name. Omit to list across all projects.
- `startDate` (string): ISO-8601 — only entries whose start time is on or after this.

### `update_entry` (~162 tokens)

Edit one or more fields on an existing time entry. Any combination is valid; unset fields are left as-is. Server-enforced authorship rule: this token can only edit entries it created itself (sessions and admins bypass).

Input parameters:

- `description` (string|null): New description / note. Pass empty string or null to clear.
- `duration` (string): New duration, e.g. "1h30m" or "45m".
- `endTime` (string): ISO-8601 end time.
- `id` (string, required): Entry id (uuid).
- `project` (string): Reassign — project id or name.
- `rate` (string): New rate — id or name.
- `startTime` (string): ISO-8601 start time.

### `delete_entry` (~48 tokens)

Delete a time entry. Server enforces: not invoiced, and either this token created it or the caller is an admin / web session.

Input parameters:

- `id` (string, required): Entry id (uuid).

### `create_client` (~64 tokens)

Create a client (the person/company you bill). Needed before any project or time entry can exist. Typical first step on a fresh account.

Input parameters:

- `email` (string): Optional billing/contact email.
- `name` (string, required): Client name, e.g. 'Acme Corp'.

### `create_project` (~75 tokens)

Create a project under a client. Time entries are always tracked against a project. Typical second step on a fresh account, after create_client.

Input parameters:

- `client` (string, required): Client - id or exact name.
- `description` (string): Optional project description.
- `name` (string, required): Project name, e.g. 'Website redesign'.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/squidcode-timebook/squidcode-timebook#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 77
- 2026-08-01: 21
- 2026-07-31: 21
- 2026-07-30: 28
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@squidcode/timebook
- Socket report: https://socket.dev/npm/package/@squidcode/timebook
- Repository: https://github.com/squidcode/timebook-cli
- Website: https://usetimebook.com/
- Changelog RSS feed: https://verifymcp.io/servers/squidcode-timebook/squidcode-timebook/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/squidcode-timebook/squidcode-timebook/changelog.json
- HTML version of this page: https://verifymcp.io/servers/squidcode-timebook/squidcode-timebook