# io.github.udah1/hilan-mcp (npm · hilan-mcp)

Pull Hilan (Hilanet / חילן, חילנט) payslips and Form 106 into any AI assistant.

- Trust score: 64/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-07

## Components

- npm · `hilan-mcp`: 64/100 (this document), [markdown](https://verifymcp.io/servers/udah1-hilan-mcp/hilan-mcp.md), [page](https://verifymcp.io/servers/udah1-hilan-mcp/hilan-mcp)

## Channel facts

- Registry: `npm`
- Package: `hilan-mcp`
- Version: `0.3.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-07.

- **Supply Chain Security**: 82/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects uuid 8.3.2, reached via node-notifier > uuid. A fixed version is available.
  - No install/post-install scripts declared.
  - Dependency health was assessed across the 181 of 185 dependencies we could resolve, so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1189 tokens (~108/item across 11 items; 11 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add udah1-hilan-mcp -- npx -y hilan-mcp
```

### Codex

```bash
codex mcp add udah1-hilan-mcp -- npx -y hilan-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "udah1-hilan-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "hilan-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add udah1-hilan-mcp --command npx --arg -y --arg hilan-mcp
```

### Hermes

```yaml
mcp_servers:
  udah1-hilan-mcp:
    command: "npx"
    args: ["-y", "hilan-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "udah1-hilan-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hilan-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-07 (score 64, +30)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 100

### 2026-08-06 (score 34)

First indexed and scored.

## MCP tools (11)

### `dismissUpdateNotice` (~87 tokens)

Call this after the user declines an update offered via an "_updateNotice" field on a previous tool response, passing that same version string, so hilan-mcp stops mentioning that specific version. It will still notify about a newer version later.

Input parameters:

- `version` (string, required): The version string from the _updateNotice you want to dismiss, e.g. "0.2.0"

### `listTenants` (~19 tokens)

List configured Hilan tenants (no secrets returned)

### `syncPayslips` (~170 tokens)

Log into a Hilan tenant (using previously ingested credentials) and sync recent payslips (structured Bruto/Neto/parts + PDF)

Input parameters:

- `monthsBack` (integer): How many recent months to sync (default 3). The tenant itself caps how far back its payslip archive actually goes — this is just a sanity ceiling, not a real limit.
- `skipPdf` (boolean): If true, only fetch/store the structured Bruto/Neto/parts data and skip downloading PDFs — much faster for quick numeric questions. Any previously-downloaded PDF for a month is left untouched. Defaul…
- `tenant` (string): Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env

### `downloadCombinedPayslipsPdf` (~187 tokens)

Downloads ONE PDF covering every payslip in a date range (instead of one file per month) — handy for printing/sharing a multi-year span at once. Automatically splits into multiple files for very long ranges (Hilan's combined-PDF endpoint has a practical ceiling of roughly 12-15 years per file due to a URL-length limit on their end).

Input parameters:

- `fromMonth` (string, required): Start of the range (inclusive), "MM_YYYY" or "MM/YYYY", e.g. "01/2020"
- `tenant` (string): Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env
- `toMonth` (string, required): End of the range (inclusive), "MM_YYYY" or "MM/YYYY", e.g. "12/2025"

### `getPersonalDetails` (~88 tokens)

Logs in and fetches personal details (name, national ID, birthdate, address, phone, email, work start date, job type). This is a live lookup, not stored in the local database.

Input parameters:

- `tenant` (string): Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env

### `resyncPayslipMonth` (~186 tokens)

Re-fetch a single specific month (structured data, and by default the PDF too), overwriting whatever is already stored for it. Use this to retry one bad/truncated PDF, or to quickly check one month's numbers, instead of re-running syncPayslips over the whole history.

Input parameters:

- `period` (string, required): The month to resync, as "MM_YYYY" (matches the stored period key) or "MM/YYYY", e.g. "10_2019" or "10/2019"
- `skipPdf` (boolean): If true, only fetch the structured Bruto/Neto/parts data and skip the PDF — fast, no browser download. Default false.
- `tenant` (string): Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env

### `syncForm106` (~98 tokens)

Log into a Hilan tenant and download Form 106 (annual tax summary) for a given year, or the default year

Input parameters:

- `tenant` (string): Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env
- `year` (string): Tax year, e.g. "2025" (defaults to the tenant's current default year)

### `getSalaryTrends` (~232 tokens)

Computes salary growth trends from locally-synced payslips (no live login needed): yearly average Bruto/Neto, year-over-year % change between adjacent years, CAGR between the first and last full (12-month) calendar year, overall growth (first vs. last synced month), and notable jumps (>=10% YoY change in Bruto). Prefer this over raw `query` for "how has my salary grown" style questions — it also groups/sorts by actual calendar year, which plain `period` text sorting gets wrong across years (e.g. "01_2011" sorts before "02_2010").

Input parameters:

- `fromYear` (integer): Only include calendar years >= this (e.g. 2015). Defaults to the earliest synced year.
- `tenant` (string): Tenant subdomain, e.g. "amdocs". Optional if this server has COMPANY_URL / COMPANY_TENANT / COMPANY_CODE set in its env
- `toYear` (integer): Only include calendar years <= this (e.g. 2024). Defaults to the latest synced year.

### `listTables` (~29 tokens)

List queryable tables (payslips, form106 — credentials/sessions are never exposed here)

### `describeTable` (~35 tokens)

Get columns and indexes for a table (payslips or form106 only)

Input parameters:

- `table` (string, required): Table to describe

### `query` (~58 tokens)

Execute a SELECT-only SQL query against payslips/form106 (allowlisted; credentials/sessions/tenants are never reachable)

Input parameters:

- `sql` (string, required): SQL SELECT query, e.g. "SELECT * FROM payslips ORDER BY period DESC"

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/udah1-hilan-mcp/hilan-mcp#diagnostics

## Score history

- 2026-08-07: 64
- 2026-08-06: 34

## Links

- npm package: https://www.npmjs.com/package/hilan-mcp
- Socket report: https://socket.dev/npm/package/hilan-mcp
- Repository: https://github.com/udah1/hilan-mcp
- Changelog RSS feed: https://verifymcp.io/servers/udah1-hilan-mcp/hilan-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/udah1-hilan-mcp/hilan-mcp.json
- HTML version of this page: https://verifymcp.io/servers/udah1-hilan-mcp/hilan-mcp