Loading ToolBench

Reading the current corpus…

mcp-timesheet MCP server · C · ToolBench

← Browse

mcp-timesheet

github.com/Pachac/mcp-timesheet

Timesheet Management System

2026-07-28+STDIO8 tools

61/100

Definition Quality66

Protocol Readiness50

SupportabilityNot measured-

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

Server has 8 tools with basic naming and descriptions, but significant gaps in schema completeness, parameter documentation, and error handling. Tool names follow verb_noun convention (get_*, add_*, edit_*, delete_*, store_*), which is good. However, descriptions are minimal (10-50 chars for most tools), parameter descriptions lack detail about formats/constraints, and output schemas are not documented. Error handling is present but generic. No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels. The store_output tool is a security concern, accepts arbitrary file paths without validation.

Tools (8)

add_timesheetwriteauthsource verified67/100

Add a timesheet entry for a specific project, activity, and date. The date format is YYYY-MM-DD.

delete_timesheetdestructiveauthsource verified68/100

Delete a timesheet entry by its ID.

edit_timesheetreversibleauthsource verified67/100

Edit a timesheet entry for a specific project, activity, and date. The date format is YYYY-MM-DD.

get_activitiesread onlyauthsource verified68/100

Get all activities available to be filled in the timesheet for a specific project

get_issuesread onlyauthsource verified68/100

Get all issues available to be filled in the timesheet for a specific project

get_projectsread onlyauthsource verified65/100

Get all projects available to be filled in the timesheet

get_timesheetsread only

Issues (5)

HIGHconstrained-input ↗

Parameter descriptions lack format/constraint details. 'date' params say 'YYYY-MM-DD' in tool description but not in parameter schema. 'hours' has no min/max bounds. LLMs cannot infer valid ranges.

add_timesheetedit_timesheetget_timesheets

CRITICALtool-gateway ↗

store_output accepts arbitrary file_name without path validation. LLM could write to parent directories (../../../etc/passwd) or overwrite critical files. No sanitization visible in code.

store_output

HIGHresponse-shaper ↗

Output schemas not documented. Tools return Pydantic models (Project, Activity, TimesheetEntry) but LLM has no schema reference. Cannot plan downstream tool calls or extract fields reliably.

get_projectsget_activitiesget_issuesget_timesheetsadd_timesheet

MEDIUMtool-annotation ↗

Recommendations

Add parameter descriptions with explicit constraints: 'date (string, YYYY-MM-DD format, required)', 'hours (number, 0.25 - 24 per day, required)', 'project_id (integer, ≥1, required)'.
Sanitize file_name in store_output: reject paths containing '/', '\', '..', or absolute paths. Use os.path.basename() to extract filename only.
Document output schemas in tool descriptions: 'Returns list of Project objects with fields: id (int), name (str), parent (str|null), grandparent (str|null)'.
Add tool annotations via FastMCP: @app.tool(annotations={'readOnlyHint': True}) for get_* tools; @app.tool(annotations={'destructiveHint': True}) for delete_timesheet.
Improve error messages: 'Invalid date format: got "2024-13-45". Use YYYY-MM-DD (e.g., 2024-01-15).' instead of generic exception strings.

Score history

Overall score trend

First recorded score · v2 rubric

61/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	C	61	2026-07-28+	v2