Name: Kolay IK MCP by usefulapi
Author: usefulapi

Kolay IK MCP by usefulapi

Read employees, leave and payroll; create leave, time records and events in Kolay IK.

Tool-list grade A Remote · Streamable HTTP No auth needed 30 tools v1.1.3 MIT

No reviews yet by usefulapiGitHub The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Read employees, leave and payroll; create leave, time records and events in Kolay IK.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http kolay-ik-mcp-by-usefulapi https://kolay-ik.usefulapi.io/mcp

# 2 — ask your agent for something these tools do
#   kolayik_get_me, kolayik_list_people, kolayik_get_person and 27 more

Kolay IK MCP by usefulapi costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

usefulapi578 servers

25 categories

All 578 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

The Kolay IK user the API token belongs to: id, name, email, work email. A cheap check that the connection works. GET /v2/profile/me.

No parameter schema on file.

List employees (id, first and last name), 60 per page. By default only active employees; set status to terminated for people who left. Search by name with q. Filter by hire date (active people) or termination date (terminated people). The reply has total, currentPage and lastPage; request the next page with page. POST /v2/person/list (a read).

Parameter	Type	Required	Notes
status	string	no	active (default) or terminated.
q	string	no	Search text in first and last name (or the national id number).
hired_from	string	no	Active people hired on or after this date.
hired_to	string	no	Active people hired on or before this date.
terminated_from	string	no	Terminated people who left on or after this date.
terminated_to	string	no	Terminated people who left on or before this date.
page	integer	no	Page number, from 1 (default 1).

Full profile of one employee: contact data, employment dates, contract, units, compensation and custom data fields. National id numbers and bank numbers are removed. GET /v2/person/view/{id}.

Parameter	Type	Required	Notes
person_id	string	yes	Person id (from kolayik_list_people).

Short profile of one employee: name, contact data, current units (company, location, department, position) and manager. GET /v2/person/view-summary/{id}.

Parameter	Type	Required	Notes
person_id	string	yes	Person id.

Leave entitlement of one employee per leave type: earned, used, carried over and unused days. GET /v2/person/leave-status/{id}.

Parameter	Type	Required	Notes
person_id	string	yes	Person id.

Trainings assigned to one employee. GET /v2/person/list-trainings/{id}.

Parameter	Type	Required	Notes
person_id	string	yes	Person id.

The custom data fields a person can have (fieldToken, type, category). Use the fieldToken in kolayik_update_person and kolayik_create_person. GET /v2/person/show-available-data-fields.

No parameter schema on file.

The organization tree: unit types (company, branch, department, position ...) and their items with ids. GET /v2/unit/show-unit-tree.

No parameter schema on file.

The approval chains configured in the account (leave, expense and similar), with their steps and approvers. Filter by name or by a person in the steps. GET /v2/approval-process/list.

Parameter	Type	Required	Notes
search	string	no	Name contains this text.
person_id	string	no	Only chains with this person in a step.

List leave (time off) records, newest data first as the vendor orders them. Filter by status, a date range or one person. Each record has the leave type, dates, person, replacement, status (approved/waiting/rejected) and used days. GET /v2/leave/list.

Parameter	Type	Required	Notes
status	string	no	waiting, approved, rejected or cancelled.
start_date	string	no	Leaves from this date on.
end_date	string	no	Leaves up to this date.
person_id	string	no	Only this person.
include_inactive_employees	boolean	no	Include people who have left (default false).
limit	integer	no	Results per page, 1-100.

One leave record with type, dates, return date, comment, person, replacement person, status and used days. GET /v2/leave/view/{id}.

Parameter	Type	Required	Notes
leave_id	string	yes	Leave id (from kolayik_list_leaves).

WRITE: records leave for an employee and deducts the used days from their balance. The vendor may approve it immediately, and it is visible to the employee and their manager. Find the leave type id in an existing leave record (kolayik_list_leaves) or the person's balances (kolayik_get_person_leave_balances). Not idempotent: a second call creates a second record. POST /v2/leave/create.

Parameter	Type	Required	Notes
person_id	string	yes	The employee taking leave.
leave_type_id	string	yes	Leave type id (for example from kolayik_get_person_leave_balances).
start_date	string	yes	Start, yyyy-mm-dd hh:mm:ss.
end_date	string	yes	End, yyyy-mm-dd hh:mm:ss.
comment	string	no	Note on the leave record.
replacement_person_id	string	no	Colleague covering during the leave.

List time records (work hours, overtime) with person, start and end, minutes used, status and type. Filter by person, type, status and date range. The reply has searchCount, totalCount, page and limit. POST /v2/timelog/list (a read).

Parameter	Type	Required	Notes
person_id	string	no	Only this person.
type	string	no	work or overtime.
status	string	no	waiting, approved, rejected or cancelled.
start_date	string	no	Records from this date on.
end_date	string	no	Records up to this date.
sort_type	string	no	Sort by startDate (default) or endDate.
sort_order	string	no	Sort direction (default desc).
limit	integer	no	Results per page, 1-100.
page	integer	no	Page number, from 1 (default 1).

One time record by id. GET /v2/timelog/view/{id}.

Parameter	Type	Required	Notes
timelog_id	string	yes	Timelog id (from kolayik_list_timelogs).

WRITE: adds a time record (work hours or overtime) for an employee. With status approved it counts immediately (overtime may flow into payroll); with waiting it enters the approval process. Not idempotent: a second call creates a second record. POST /v2/timelog/create.

Parameter	Type	Required	Notes
person_id	string	yes	The employee.
start_date	string	yes	Start, yyyy-mm-dd hh:mm:ss.
end_date	string	yes	End, yyyy-mm-dd hh:mm:ss.
type	string	no	work or overtime.
status	string	yes	waiting (goes through the approval process), approved (counts immediately), rejected or cancelled.
description	string	no	Note on the record.

WRITE (destructive): permanently deletes one time record. This cannot be undone. DELETE /v2/timelog/delete/{id}.

Parameter	Type	Required	Notes
timelog_id	string	yes	Timelog id to delete.

List employee transactions (expenses, advance payments, bonuses, overtime pay, deductions) with amount, currency, status, paid flag and items. Filter by person, type, status, paid and date range. POST /v2/transaction/list (a read).

Parameter	Type	Required	Notes
person_id	string	no	Only this person.
type	string	no	Transaction type.
status	string	no	draft, waiting, approved or rejected.
paid	boolean	no	true = only paid, false = only unpaid.
start_date	string	no	Transactions from this date on.
end_date	string	no	Transactions up to this date.
limit	integer	no	Results per page, 1-100.
page	integer	no	Page number, from 1 (default 1).

One transaction (expense, advance, bonus ...) with its items. GET /v2/transaction/view/{id}.

Parameter	Type	Required	Notes
transaction_id	string	yes	Transaction id (from kolayik_list_transactions).

Expense categories of the account (for example taxi, meals), optionally filtered by title or enabled state. GET /v2/expense/list-categories.

Parameter	Type	Required	Notes
title	string	no	Category title contains this text.
enabled	boolean	no	true = only enabled categories, false = only disabled.

Payroll runs of a year: id, period, number of employees, payslips created, errors and total employer cost. Needs a token with the payroll:list scope. Use the id with kolayik_get_payroll_sheet. GET /v2/payroll/list.

Parameter	Type	Required	Notes
year	integer	no	Year (default: the current year).

The full payroll sheet (carsaf bordro) of one payroll run: every employee's gross, net, tax and insurance columns. This is sensitive salary data of all employees (or the filtered ones). Needs a token with the payroll-sheet:view scope. Filter by name, status, salary period, insurance, tax, expense center or units. POST /v2/payroll-sheet/view/{id} (a read).

Parameter	Type	Required	Notes
payroll_id	string	yes	Payroll run id (from kolayik_list_payrolls).
search	string	no	Employee name contains this text.
status	array	no	Calculation statuses (OR).
salary_period	array	no	Salary period types (OR).
unit_item_ids	array	no	Groups of unit item ids from kolayik_list_units.

List company calendar events (meetings, holidays) with title, start, end and comment. Filter by text and date range. The reply has searchCount, totalCount, page and limit. GET /v2/event/list.

Parameter	Type	Required	Notes
search	string	no	Title contains this text.
start	string	no	Events from this date on.
end	string	no	Events up to this date.
limit	integer	no	Results per page, 1-100.
page	integer	no	Page number, from 1 (default 1).

One calendar event. GET /v2/event/view/{id}.

Parameter	Type	Required	Notes
event_id	string	yes	Event id (from kolayik_list_events).

WRITE: adds an event to the company calendar, visible to the employees who see it. Not idempotent. POST /v2/event/create.

Parameter	Type	Required	Notes
title	string	yes	Event title.
start	string	yes	Start, yyyy-mm-dd hh:mm:ss.
end	string	yes	End, yyyy-mm-dd hh:mm:ss.
comment	string	no	Event description.

WRITE: changes the title, times or comment of a calendar event (the vendor requires title, start and end). PUT /v2/event/update/{id}.

Parameter	Type	Required	Notes
event_id	string	yes	Event id.
title	string	yes	Event title.
start	string	yes	Start, yyyy-mm-dd hh:mm:ss.
end	string	yes	End, yyyy-mm-dd hh:mm:ss.
comment	string	no	Event description.

WRITE (destructive): permanently deletes one calendar event. This cannot be undone. DELETE /v2/event/delete/{id}.

Parameter	Type	Required	Notes
event_id	string	yes	Event id to delete.

List the trainings defined in the account. Filter by title text. The reply has searchCount, totalCount, page and limit. GET /v2/training/list.

Parameter	Type	Required	Notes
search	string	no	Title contains this text.
limit	integer	no	Results per page, 1-100.
page	integer	no	Page number, from 1 (default 1).

One training with its details. GET /v2/training/view/{id}.

Parameter	Type	Required	Notes
training_id	string	yes	Training id (from kolayik_list_trainings).

WRITE: adds a new employee (only first and last name are required). Creates a real HR record that may send the person an invitation, depending on the account settings. Not idempotent: calling it twice creates a duplicate. Further data goes in data_fields (see kolayik_list_person_fields). POST /v2/person/create.

Parameter	Type	Required	Notes
first_name	string	yes	First name.
last_name	string	yes	Last name.
email	string	no	Personal email.
work_email	string	no	Work email.
employment_start_date	string	no	First day of employment.
birthday	string	no	Date of birth.
data_fields	array	no	Extra data fields as {fieldToken, value}.

WRITE: changes basic data of one employee; only the fields you pass change. Pass null for an optional field to clear it. Further data goes in data_fields (see kolayik_list_person_fields). Changes the HR record immediately. PUT /v2/person/update.

Parameter	Type	Required	Notes
person_id	string	yes	Person id.
first_name	string	no	First name.
last_name	string	no	Last name.
email		no	Personal email; null clears it.
work_email		no	Work email; null clears it.
data_fields	array	no	Data fields as {fieldToken, value}.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Kolay IK MCP by usefulapi or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 1.1.3 · scanned 6 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 1 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digestc8c835e617a269a2e5027d12eeae3ca00d761320ebf410cfd66388cbbe7ec886

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
kolayik_get_me	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_people	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_person	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_person_summary	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_person_leave_balances	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_person_trainings	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_person_fields	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_units	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_approval_processes	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_leaves	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_leave	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_create_leave	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kolayik_list_timelogs	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_timelog	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_create_timelog	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kolayik_delete_timelog	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kolayik_list_transactions	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_transaction	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_expense_categories	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_payrolls	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_payroll_sheet	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_list_events	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_event	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_create_event	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kolayik_update_event	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kolayik_delete_event	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kolayik_list_trainings	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_get_training	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
kolayik_create_person	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
kolayik_update_person	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digestc8c835e617a269a2

Scanned2026-11-06

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Kolay IK MCP by usefulapi

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also