
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@clicktime/mcp-server
Advanced tools
ClickTime MCP Tech Demo for AI agents to interact with ClickTime API
A Model Context Protocol (MCP) tech demo that lets AI agents – like Claude Desktop – securely interact with ClickTime's time‑tracking, project‑management, and expense‑management APIs.
⚠️ Demo Package Notice: This is a technical demonstration package. ClickTime is not currently providing official support for this package, but we will be updating it constantly as we continue development. Use at your own discretion and expect frequent changes.
MCP is a specification that gives AI tools a secure, structured way to call external services. For ClickTime, it means Claude can:
Requirement | Notes |
---|---|
Claude Desktop (v≥1.9) | macOS & Windows. Linux users can run the browser version or a VM – the setup script will error on non‑supported OSes. |
Node.js (v18 or higher) | Needed to run the MCP server. |
ClickTime API Token | Treat it like a password and rotate regularly. |
Download from https://claude.ai/download and pick Check for Updates in the menu after install.
Open Terminal / Command Prompt
Cmd + Space
, type Terminal, then press EnterWindows + R
, type cmd, then press EnterIn the window that appears, type:
node --version
You should see something like v18.17.0
.
If you see "command not found" (macOS) or "'node' is not recognized…" (Windows), install the LTS build from https://nodejs.org (v18 or newer).
🔒 Keep this token secret – anyone with the string can act as you.
Open Terminal / Command Prompt
Cmd + Space
, type Terminal, press EnterWindows + R
, type cmd, press EnterThen copy‑paste the command below (replace <YOUR_CLICKTIME_API_TOKEN>
with your real token) and press Enter:
npx @clicktime/mcp-server@latest setup:claude <YOUR_CLICKTIME_API_TOKEN>
That's it! Restart Claude Desktop and start talking to ClickTime.
Privacy tip: Terminal/PowerShell keeps a history of commands you run. If you don't want the line that contains your ClickTime token to stick around, delete it afterwards (
history -d
on macOS/Linux,Clear-History
in PowerShell) or, in bash/zsh, start the command with a space so it isn't recorded.
If you prefer not to include your token in the command line:
export CLICKTIME_API_TOKEN=<YOUR_CLICKTIME_API_TOKEN>
npx @clicktime/mcp-server@latest setup:claude
If you prefer full control:
clicktime
block inside "mcpServers"
:{
"mcpServers": {
"clicktime": {
"command": "npx",
"args": ["@clicktime/mcp-server", "-t", "<YOUR_CLICKTIME_API_TOKEN>"]
}
}
}
Examples Claude now understands:
💡 Receipt expenses – drag an image into Claude, then say "Create an expense from this receipt." Claude will ask for the file path and do the rest.
Quick expenses – "Add $25.50 lunch expense for today."
Receipt upload
Expense sheets – "Create expense sheet 'Conference Travel – June 2025'. "
Save the receipt image (JPG, PNG, GIF, BMP, or PDF ≤ 2 MB).
Drag & drop the image into Claude Desktop.
Ask: "Create an expense from this receipt."
When prompted, paste the full file path.
Claude extracts the data and creates the expense in ClickTime.
Symptom | Fix |
---|---|
"Invalid API token" | Re‑copy token from ClickTime My Preferences. |
"ClickTime API token is required" | Provide token as argument: npx @clicktime/mcp-server@latest setup:claude YOUR_TOKEN |
"Unsupported platform" | Setup script supports macOS/Windows only. Linux users: configure manually or use VM. |
"File too large / unsupported" | Ensure image ≤ 2 MB & is JPG/PNG/GIF/BMP/PDF. |
"File not found / ENOENT" | Use the exact path (see path‑copy tips above). |
Claude can't see ClickTime tools | Restart Claude; verify mcpServers JSON; check Node v18+. |
Permission denied | Confirm your ClickTime account has Time Tracking, Expenses, and/or Time Off modules enabled. |
"Failed to connect to ClickTime API" | Verify token and internet connection. |
add_time_entry
get_recent_time_entries
update_time_entry
delete_time_entry
add_expense_item
add_expense_from_receipt
create_expense_sheet
✨get_my_expense_sheets
list_my_expense_types
list_my_projects
list_my_tasks
get_project_details
create_time_off_request
- Create a time off request (automatically handles both approval/non-approval types)remove_time_off
- RECOMMENDED: Smart removal that automatically determines whether to delete an entry or cancel a requestget_time_off
- Get time off entriesget_time_off_requests
- List time off requestsget_time_off_request_details
- Get detailed info about a specific requestget_time_off_request_actions
- Get available actions for a requestget_time_off_balance
- Check time off balancelist_time_off_types
- List available time off typesHow it works:
create_time_off_request
automatically checks if approval is required and uses the correct endpointremove_time_off
automatically determines whether to delete an entry (non-approval) or cancel a request (approval-required)MIT © ClickTime Team
FAQs
ClickTime MCP Tech Demo for AI agents to interact with ClickTime API
The npm package @clicktime/mcp-server receives a total of 28 weekly downloads. As such, @clicktime/mcp-server popularity was classified as not popular.
We found that @clicktime/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.