Name: kiwiHR MCP by usefulapi
Author: usefulapi

kiwiHR MCP by usefulapi

Read kiwiHR employees, time off, timesheets, projects; create and update employees, timesheets.

Tool-list grade A Remote · Streamable HTTP No auth needed 30 tools v1.14.3 MIT

No reviews yet by usefulapiGitHub The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Read kiwiHR employees, time off, timesheets, projects; create and update employees, timesheets.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http kiwihr-mcp-by-usefulapi https://kiwihr.usefulapi.io/mcp

# 2 — ask your agent for something these tools do
#   kiwihr_list_users, kiwihr_get_user, kiwihr_list_teams and 27 more

kiwiHR MCP by usefulapi costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

usefulapi578 servers

25 categories

All 578 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

List or search employees (kiwiHR 'users') with name, work email, active flag, employee number, employment dates, position, team, location and manager. Filter by active state, team, location, position, e-mail or name. Payroll, bank, tax and insurance data are never included. GraphQL query users.

Parameter	Type	Required	Notes
is_active	boolean	no	true = active employees only, false = deactivated only. Omit for both.
team_id	string	no	Team id (from kiwihr_list_teams).
location_id	string	no	Location id (from kiwihr_list_locations).
position_id	string	no	Position id (from kiwihr_list_positions).
user_ids	array	no	Only these employee ids.
email	string	no	Work e-mail contains this text.
first_name	string	no	First name contains this text.
last_name	string	no	Last name contains this text.
employment_start_from	string	no	Only employees who started on or after this date.
sort_by	string	no	Sort field.
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

One employee by id: the list fields plus probation end, about-me, language, invitation status, work phones, all teams, work schedule and custom field values. With include_personal=true it also returns birth date, private e-mail and phone, nationality, gender, pronouns, home address, emergency contact and custom fields of the personal sections. Payroll, bank (IBAN/BIC), tax and insurance data are n

Parameter	Type	Required	Notes
user_id	string	yes	Employee id.
include_personal	boolean	no	Also return private data (birth date, private contact data, address, emergency contact). Default false.

List teams and departments (id, name, kind GROUP or DEPARTMENT). Use the ids to filter employees. GraphQL query teams.

Parameter	Type	Required	Notes
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

List office locations (id, name). Use the ids to filter employees. GraphQL query locations.

Parameter	Type	Required	Notes
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

List job positions (id, name). Use the ids to filter employees. GraphQL query positions.

Parameter	Type	Required	Notes
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

List the company's custom employee profile fields (id, name, section, data type, choice options). Payroll and bank sections are listed by name only; their values are never returned by any tool. GraphQL query customFields.

Parameter	Type	Required	Notes
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

List time off (absence) types such as vacation or sick leave: id, name, colour, visibility to team members. Use the ids with kiwihr_get_time_off_usage and kiwihr_list_time_off_balances. GraphQL query timeOffTypes.

Parameter	Type	Required	Notes
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

Time off balances of all employees: per employee and time off rule the allowance, accrued, used, requested, planned and available days, carry-over and the accrual/usage periods. Filter by time off type, active state and usage period. The API has no per-employee filter or paging for this query; read the result per user. GraphQL query timeOffBalances.

Parameter	Type	Required	Notes
time_off_type_id	string	no	Only this time off type (from kiwihr_list_time_off_types).
is_active	boolean	no	true = active balances only.
usage_period_start_from	string	no	Usage period starts on or after this date.
usage_period_end_to	string	no	Usage period ends on or before this date.
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).

Who took (or requested) how much time off in a date range: per employee the request count and used days for each time off rule of the chosen time off types. Use it for absence reports ('who was off in March?'). Optional employee filters as in kiwihr_list_users. GraphQL query timeOffRequestUsageStatements.

Parameter	Type	Required	Notes
date_from	string	yes	Range start (YYYY-MM-DD).
date_to	string	yes	Range end (YYYY-MM-DD).
time_off_type_ids	array	yes	Time off type ids (from kiwihr_list_time_off_types).
team_id	string	no	Only employees of this team.
location_id	string	no	Only employees at this location.
is_active	boolean	no	true = active employees only.
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

Daily timesheets of one employee (or the key's admin user when user_id is omitted) in a date range: expected, tracked, time off, holiday and break time in SECONDS, approval flag, time offs, holidays, entries (start/end, type, note, project) and break-rule violations. GraphQL query timesheets.

Parameter	Type	Required	Notes
user_id	string	no	Employee id. Omit for the admin user the API key acts as.
date_from	string	yes	Range start (YYYY-MM-DD).
date_to	string	yes	Range end (YYYY-MM-DD).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Days per page (1-100, default 50).

The timesheet of ONE employee for ONE day (user_id omitted = the admin user the key acts as), with all entries and their ids (needed to update or delete an entry). Times in seconds. GraphQL query timesheet.

Parameter	Type	Required	Notes
user_id	string	no	Employee id. Omit for the admin user the API key acts as.
date	string	yes	Day (YYYY-MM-DD).

Attendance summary of ONE employee over a date range: expected, tracked, total, time off and holiday time (seconds) and days, balance, overtime, meal vouchers, and tracked time per project. GraphQL query attendanceStatement.

Parameter	Type	Required	Notes
user_id	string	yes	Employee id.
date_from	string	yes	Range start (YYYY-MM-DD).
date_to	string	yes	Range end (YYYY-MM-DD).

Attendance summaries of ALL employees over a date range (expected vs tracked time, time off, holidays, balance, overtime, tracked time per project). Optionally only employees with time tracked on a project, or with uncategorized time; inactive employees can be included. GraphQL query attendanceStatements.

Parameter	Type	Required	Notes
date_from	string	yes	Range start (YYYY-MM-DD).
date_to	string	yes	Range end (YYYY-MM-DD).
project_id	string	no	Only employees with tracked time in this project.
has_uncategorized_time	boolean	no	true = only employees with tracked time not assigned to any project.
include_inactive_users	boolean	no	Also include deactivated employees (default false).
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).

Current overtime balance (seconds) per employee. GraphQL query overtimeBalanceStatements.

Parameter	Type	Required	Notes
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

List time-tracking projects (id, name, status ACTIVE or INACTIVE). GraphQL query projects.

Parameter	Type	Required	Notes
status	string	no	Only projects with this status.
sort_by	string	no	—
sort_direction	string	no	Sort direction (default ASC).
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

One time-tracking project by id (name, status). GraphQL query project.

Parameter	Type	Required	Notes
project_id	string	yes	Project id.

List onboarding/offboarding journeys (id, name, status DRAFT/ONGOING/COMPLETED/CANCELLED, assignee, journey type, custom date). Filter by status, assignee, type or team. GraphQL query journeys.

Parameter	Type	Required	Notes
status	string	no	Only journeys with this status.
assignee_ids	array	no	Only journeys assigned to these employee ids.
journey_type_ids	array	no	Only these journey types (from kiwihr_list_journey_types).
team_ids	array	no	Only journeys of employees in these teams.
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

One journey by id with its steps (name, description, fixed start and due dates). With include_personal=true it also returns the private e-mail address stored on the journey. GraphQL query journey.

Parameter	Type	Required	Notes
journey_id	string	yes	Journey id.
include_personal	boolean	no	Also return the private e-mail on the journey. Default false.

List journey templates (id, name, description, type). Use a template id with kiwihr_create_journey. GraphQL query journeyTemplates.

Parameter	Type	Required	Notes
journey_type_id	string	no	Only templates of this journey type.
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

List journey types such as pre-onboarding, onboarding or offboarding (id, name, key, archived date). GraphQL query journeyTypes.

Parameter	Type	Required	Notes
offset	integer	no	Items to skip (default 0). The reply's pageInfo.next says whether there is another page.
limit	integer	no	Items per page (1-100, default 50).

WRITE: add a time entry to the timesheet of one employee on one day (user_id omitted = the admin user the key acts as). type MANUAL = worked time (give start_at and end_at as HH:mm:ss, or a part_of_day), BREAK = a break. Optional project and note. Creates a new entry each call (not idempotent). Returns the updated day. GraphQL mutation createTimesheetEntry.

Parameter	Type	Required	Notes
user_id	string	no	Employee id. Omit for the admin user the API key acts as.
date	string	yes	Day (YYYY-MM-DD).
type	string	yes	MANUAL = worked time, BREAK = break.
start_at	string	no	Start time HH:mm:ss.
end_at	string	no	End time HH:mm:ss.
part_of_day	string	no	For day-based tracking instead of start/end.
project_id	string	no	Project id (from kiwihr_list_projects).
note	string	no	Note for the entry.

WRITE: change an existing timesheet entry (get its id from kiwihr_get_timesheet): times, part of day, project or note. Only the fields you pass are changed. Setting the same values again gives the same result. Returns the updated day. GraphQL mutation updateTimesheetEntry.

Parameter	Type	Required	Notes
entry_id	string	yes	Timesheet entry id.
start_at	string	no	New start time HH:mm:ss.
end_at	string	no	New end time HH:mm:ss.
part_of_day	string	no	New part of day.
project_id	string	no	New project id.
note	string	no	New note.

WRITE, DESTRUCTIVE: permanently delete one timesheet entry by id (get it from kiwihr_get_timesheet). This cannot be undone. Returns true when deleted. GraphQL mutation deleteTimesheetEntry.

Parameter	Type	Required	Notes
entry_id	string	yes	Timesheet entry id.

WRITE: create a time-tracking project (name, status ACTIVE or INACTIVE; default ACTIVE). Creates a new project each call (not idempotent). GraphQL mutation createProject.

Parameter	Type	Required	Notes
name	string	yes	Project name.
status	string	no	ACTIVE projects can be used for time tracking.

WRITE: rename a project or switch it ACTIVE/INACTIVE (INACTIVE projects can no longer be used for time tracking). Only the fields you pass are changed. GraphQL mutation updateProject.

Parameter	Type	Required	Notes
project_id	string	yes	Project id.
name	string	no	New name.
status	string	no	New status.

WRITE: add a new employee record (first name, last name and work e-mail are required; optional start date, manager, teams, position, location and phones). Creates a new employee each call (not idempotent). No invitation is sent by this tool. Payroll and bank data cannot be set. GraphQL mutation createUser.

Parameter	Type	Required	Notes
first_name	string	yes	—
last_name	string	yes	—
email	string	yes	Work e-mail address.
employment_start_date	string	no	First day of employment (YYYY-MM-DD).
manager_id	string	no	Manager's employee id.
team_ids	array	no	Team ids (from kiwihr_list_teams).
position_id	string	no	Position id (from kiwihr_list_positions).
location_id	string	no	Location id (from kiwihr_list_locations).
work_phones	array	no	—
gender	string	no	—

WRITE: change an employee's work profile: name, start date, about-me, work phones, position, team(s), location, manager. Only the fields you pass are changed (team_ids replaces the whole team list). Private, payroll and bank data cannot be changed with this tool. GraphQL mutation updateUser.

Parameter	Type	Required	Notes
user_id	string	yes	Employee id.
first_name	string	no	—
last_name	string	no	—
employment_start_date	string	no	—
about_me	string	no	—
work_phones	array	no	Replaces the list of work phones.
position_id	string	no	—
team_ids	array	no	Replaces the list of teams.
location_id	string	no	—
manager_id	string	no	—

WRITE, ACCESS-CHANGING: deactivate an active employee (typically after they leave): they lose access to kiwiHR and drop out of active lists. Reversible with kiwihr_activate_user. GraphQL mutation deactivateUser.

Parameter	Type	Required	Notes
user_id	string	yes	Employee id.

WRITE: re-activate a deactivated employee so they appear in active lists and can use kiwiHR again. GraphQL mutation activateUser.

Parameter	Type	Required	Notes
user_id	string	yes	Employee id.

WRITE: create an onboarding/offboarding journey for an employee from a journey type and optionally a template (ids from kiwihr_list_journey_types / kiwihr_list_journey_templates). Creates a new journey each call (not idempotent). It does not publish it; check the status in the reply. GraphQL mutation createJourney.

Parameter	Type	Required	Notes
journey_type_id	string	yes	Journey type id.
assignee_id	string	yes	Employee id the journey is for.
journey_template_id	string	no	Journey template id.
name	string	no	Journey name.
personal_email	string	no	Private e-mail (for pre-onboarding).
custom_date	string	no	Custom date steps can relate to (YYYY-MM-DD).
custom_date_name	string	no	Label of the custom date.
pre_onboarding_access	boolean	no	Enable pre-onboarding access.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install kiwiHR MCP by usefulapi or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 1.14.3 · scanned 6 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 1 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digestb8951a33be4ea6ac1f92f487a45966f245f02f89b832bf5c05e36953f8d83d59

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
kiwihr_list_users	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_get_user	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_teams	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_locations	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_positions	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_custom_fields	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_time_off_types	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_time_off_balances	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_get_time_off_usage	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_timesheets	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_get_timesheet	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_get_attendance_statement	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_attendance_statements	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_overtime_balances	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_projects	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_get_project	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_journeys	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_get_journey	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_journey_templates	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_list_journey_types	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kiwihr_create_timesheet_entry	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
kiwihr_update_timesheet_entry	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kiwihr_delete_timesheet_entry	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kiwihr_create_project	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
kiwihr_update_project	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kiwihr_create_user	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
kiwihr_update_user	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kiwihr_deactivate_user	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kiwihr_activate_user	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
kiwihr_create_journey	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digestb8951a33be4ea6ac

Scanned2026-11-06

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

kiwiHR MCP by usefulapi

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also