Back to Home
pfaeffli icon

clockodo-mcp-server

Verified Safe

by pfaeffli

Overview

MCP server wrapper for the Clockodo time tracking API, offering time tracking, HR analytics, and team management with role-based access.

Installation

Run Command
docker run --rm -i -e CLOCKODO_API_USER=your@email.com -e CLOCKODO_API_KEY=your_api_key -e CLOCKODO_MCP_ROLE=employee ghcr.io/pfaeffli/clockodo-mcp-server:latest

Environment Variables

  • CLOCKODO_API_USER
  • CLOCKODO_API_KEY
  • CLOCKODO_USER_AGENT
  • CLOCKODO_BASE_URL
  • CLOCKODO_EXTERNAL_APP_CONTACT
  • CLOCKODO_MCP_TRANSPORT
  • CLOCKODO_MCP_HOST
  • CLOCKODO_MCP_PORT
  • CLOCKODO_MCP_ROLE
  • CLOCKODO_MCP_PRESET
  • CLOCKODO_MCP_ENABLE_HR_READONLY
  • CLOCKODO_MCP_ENABLE_USER_READ
  • CLOCKODO_MCP_ENABLE_USER_EDIT
  • CLOCKODO_MCP_ENABLE_TEAM_LEADER
  • CLOCKODO_MCP_ENABLE_ADMIN_READ
  • CLOCKODO_MCP_ENABLE_ADMIN_EDIT

Security Notes

The server follows good security practices: API credentials are exclusively loaded from environment variables and not hardcoded. Sensitive information is masked in logs. The codebase is structured with clear separation of concerns, and `httpx` is used with proper error handling. Multi-stage Docker builds reduce attack surface. The project explicitly warns about the experimental HTTP/SSE transport's lack of built-in authentication, rate limiting, and audit trails, recommending it only for development or behind a robust reverse proxy with external security measures. The core code itself is well-secured.

Similar Servers

Stats

Interest Score0
Security Score9
Cost ClassMedium
Avg Tokens2500
Stars0
Forks0
Last Update2026-01-19

Tags

Time TrackingHR ManagementAPI WrapperClockodoMCP