io.github.udah1/hilan-mcp

NPM · HILAN-MCP · SCANNED AUG 7

Pull Hilan (Hilanet / חילן, חילנט) payslips and Form 106 into any AI assistant.

Available components

64 64 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security82

No malware found by supply-chain analysis.Pass
CVE check failed: a known high-severity CVE affects uuid 8.3.2, reached via node-notifier > uuid. A fixed version is available. View diagnostics → Fail
No install/post-install scripts declared.Pass
Dependency health was assessed across the 181 of 185 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 0 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability77

AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 1189 tokens (~108/item across 11 items; 11 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · hilan-mcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add udah1-hilan-mcp -- npx -y hilan-mcp

# add to Codex CLI

codex mcp add udah1-hilan-mcp -- npx -y hilan-mcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "udah1-hilan-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "hilan-mcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add udah1-hilan-mcp --command npx --arg -y --arg hilan-mcp

# ~/.hermes/config.yaml

mcp_servers:
  udah1-hilan-mcp:
    command: "npx"
    args: ["-y", "hilan-mcp"]

// mcp.json

{
  "mcpServers": {
    "udah1-hilan-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hilan-mcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

7 Aug 26 +30
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Schema quality: pass functional
- First check of Tool coverage: 100 functional
6 Aug 26 34

First indexed and scored.

Show 1 earlier entry Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 7 Aug 2026 · Analysed npm/[email protected]

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	npm

Vulnerabilities 1 finding

ID	CVE	Severity	Vector	Fix available
GHSA-w5hq-g745-h8pq	CVE-2026-41907	high	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	yes

Dependencies 181 packages

Packages resolved	181
Deprecated	136
Stale	64
Tree resolution	Partial

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools · 11 exposed · ~1,189 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

describeTable ~35

Get columns and indexes for a table (payslips or form106 only)

Input Output Examples

Name	Type	Req	Description
table	string	yes	Table to describe

No output schema declared.

No examples provided.

dismissUpdateNotice ~87

Call this after the user declines an update offered via an "_updateNotice" field on a previous tool response, passing that same version string, so hilan-mcp stops mentioning that specific version. It will still notify about a newer version later.

Input Output Examples

Name	Type	Req	Description
version	string	yes	The version string from the _updateNotice you want to dismiss, e.g. "0.2.0"

No output schema declared.

No examples provided.

downloadCombinedPayslipsPdf ~187

Downloads ONE PDF covering every payslip in a date range (instead of one file per month) — handy for printing/sharing a multi-year span at once. Automatically splits into multiple files for very long ranges (Hilan's combined-PDF endpoint has a practical ceiling of roughly 12-15 years per file due to a URL-length limit on their end).

Input Output Examples

Name	Type	Req	Description
fromMonth	string	yes	Start of the range (inclusive), "MM_YYYY" or "MM/YYYY", e.g. "01/2020"
tenant	string	–	Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env
toMonth	string	yes	End of the range (inclusive), "MM_YYYY" or "MM/YYYY", e.g. "12/2025"

No output schema declared.

No examples provided.

getPersonalDetails ~88

Logs in and fetches personal details (name, national ID, birthdate, address, phone, email, work start date, job type). This is a live lookup, not stored in the local database.

Input Output Examples

Name	Type	Req	Description
tenant	string	–	Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env

No output schema declared.

No examples provided.

getSalaryTrends ~232

Computes salary growth trends from locally-synced payslips (no live login needed): yearly average Bruto/Neto, year-over-year % change between adjacent years, CAGR between the first and last full (12-month) calendar year, overall growth (first vs. last synced month), and notable jumps (>=10% YoY change in Bruto). Prefer this over raw `query` for "how has my salary grown" style questions — it also groups/sorts by actual calendar year, which plain `period` text sorting gets wrong across years (e.g. "01_2011" sorts before "02_2010").

Input Output Examples

Name	Type	Req	Description
fromYear	integer	–	Only include calendar years >= this (e.g. 2015). Defaults to the earliest synced year.
tenant	string	–	Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env
toYear	integer	–	Only include calendar years <= this (e.g. 2024). Defaults to the latest synced year.

No output schema declared.

No examples provided.

listTables ~29

List queryable tables (payslips, form106 — credentials/sessions are never exposed here)

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

listTenants ~19

List configured Hilan tenants (no secrets returned)

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

query ~58

Execute a SELECT-only SQL query against payslips/form106 (allowlisted; credentials/sessions/tenants are never reachable)

Input Output Examples

Name	Type	Req	Description
sql	string	yes	SQL SELECT query, e.g. "SELECT * FROM payslips ORDER BY period DESC"

No output schema declared.

No examples provided.

resyncPayslipMonth ~186

Re-fetch a single specific month (structured data, and by default the PDF too), overwriting whatever is already stored for it. Use this to retry one bad/truncated PDF, or to quickly check one month's numbers, instead of re-running syncPayslips over the whole history.

Input Output Examples

Name	Type	Req	Description
period	string	yes	The month to resync, as "MM_YYYY" (matches the stored period key) or "MM/YYYY", e.g. "10_2019" or "10/2019"
skipPdf	boolean	–	If true, only fetch the structured Bruto/Neto/parts data and skip the PDF — fast, no browser download. Default false.
tenant	string	–	Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env

No output schema declared.

No examples provided.

syncForm106 ~98

Log into a Hilan tenant and download Form 106 (annual tax summary) for a given year, or the default year

Input Output Examples

Name	Type	Req	Description
tenant	string	–	Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env
year	string	–	Tax year, e.g. "2025" (defaults to the tenant's current default year)

No output schema declared.

No examples provided.

syncPayslips ~170

Log into a Hilan tenant (using previously ingested credentials) and sync recent payslips (structured Bruto/Neto/parts + PDF)

Input Output Examples

Name	Type	Req	Description
monthsBack	integer	–	How many recent months to sync (default 3). The tenant itself caps how far back its payslip archive actually goes — this is just a sanity ceiling, not a real limit.
skipPdf	boolean	–	If true, only fetch/store the structured Bruto/Neto/parts data and skip downloading PDFs — much faster for quick numeric questions. Any previously-downloaded PDF for a month is left untouched. Defaul…
tenant	string	–	Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

6 Aug 7 Aug