Keeping MCP server

by Red-Square-Software·io.github.Red-Square-Software/keeping-mcp·v1.0.1

No reviews yet

MCP server for the Keeping time-tracking API

B83/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B83/100

full report

Adoption

New

0 stars43 downloads/wk

Reviews

Write one

Nobody has reviewed Keeping yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Keeping tools (12, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

keeping_add_entrywrite action
Create a new time entry. DRY-RUN BY DEFAULT \u2014 call without confirm first to receive a would_post preview; call again with confirm: true ONLY after a human reviewed the preview. Body shape depends on the organisation's timesheet mode: 'times' mode requires start/end (HH:mm in org timezone); 'hours' mode requires a decimal hours value. Purpose defaults to 'work'. The date defaults to today in E
keeping_delete_entrywrite action
**DESTRUCTIVE: permanently deletes the entry** \u2014 cannot be undone. Owns the dry-run gate: without confirm: true, the tool fetches the entry and returns a would_delete preview so a human can verify the right entry is targeted. Only call with confirm: true after a human reviewed the preview.
keeping_list_entries
Returns time entries for a date range. Wire shape preserved exactly as returned by the Keeping API \u2014 no field renaming \u2014 so this tool doubles as schema discovery for Phase 3 write tools. Dates are calendar dates in YYYY-MM-DD; not UTC timestamps. Single-day calls hit `GET /{orgId}/time-entries?date=...`; multi-day ranges hit `GET /{orgId}/report/time-entries?from=...&to=...`.
keeping_me
Returns the authenticated user (id, first_name, surname, code, role, state) wrapped under a `user` key, plus the resolved `organisation_id`. Identity is cached for the server's lifetime. Pass the optional `organisation_id` input to override the KEEPING_ORG_ID default; required when the token has access to multiple organisations.
keeping_organisations
Returns the list of organisations the token can access. Each organisation includes feature flags (projects, tasks, timesheet_mode) verbatim from the API. Cached for the server's lifetime.
keeping_projects
Returns the list of projects available for the selected organisation. If the projects feature is disabled for the organisation, returns a human-readable note instead of an error. Not cached \u2014 fresh per call.
keeping_resume_timer
keeping_start_timer
Start a new ongoing time entry (a running timer). Implemented as POST /{orgId}/time-entries with `start` set and NO `end` / NO `hours` \u2014 Keeping interprets the omission of `end` as 'this entry is ongoing'. Returns { timer_id } on success; use this id with keeping_stop_timer or keeping_resume_timer. DRY-RUN BY DEFAULT \u2014 call without confirm first to receive a would_post preview; call agai
keeping_stop_timer
Stop an ongoing time entry (running timer) by setting its end. Implemented as PATCH /{orgId}/time-entries/{entry_id}/stop. Returns the updated entry plus server_time_ms \u2014 the millisecond-precision server timestamp captured from the X-Server-Time-Ms response header (TIMER-02). When the header is missing or unparseable, server_time_ms falls back to the local clock and a warning is logged to std
keeping_tasks
Returns the list of tasks available for the selected organisation. If the tasks feature is disabled for the organisation, returns a human-readable note instead of an error. Not cached \u2014 fresh per call.
keeping_timer_status
Returns the most recent time entry for the authenticated user plus a derived `is_running` boolean indicating whether a Keeping timer is currently running. Read-only; no API mutation. Use this to decide whether `keeping_stop_timer` (running timer \u2192 stop) or `keeping_resume_timer` (stopped entry \u2192 resume) is the appropriate next call (both ship in Phase 3).
keeping_update_entrywrite action
Edit an existing time entry owned by the authenticated user. PATCH semantics \u2014 only the fields you supply are updated. DRY-RUN BY DEFAULT \u2014 call without confirm first to receive a would_post preview; call again with confirm: true ONLY after a human reviewed the preview. NOTE: date, purpose, and user_id are immutable in Keeping; this tool does not accept them.

Public scan report

scanner v0.1.9 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings

Code scan2 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 104 days ago8/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Keeping compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 83/100; higher than 65% of 48,255 servers
Tools: 12; the typical server has 7
Tools that change things: 25%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 43; more than 35% of 12,191 servers with a package

What its tools let an agent do: 9 read · 3 change

Install Keeping in Claude Code, Cursor or VS Code

Runs npx -y keeping-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add keeping-mcp -- npx -y keeping-mcp

Add to Cursor

What the publisher says

From the Keeping repository's README, as published. We do not edit it. Read it on GitHub

keeping-mcp

Open-source Model Context Protocol (MCP) server that exposes the Keeping (api.keeping.nl) time-tracking API as tools an AI coding assistant can call. Built for solo developers who use Claude Code (or any MCP-capable client) and want their billable hours logged into Keeping at the end of a session instead of typed in by hand, while keeping Keeping's existing native Jortt invoicing integration intact. Every write tool is dry-run by default — your hours never reach Keeping until you explicitly confirm.

## ⚠ Writes are dry-run BY DEFAULT

Every write tool (keepingaddentry, keepingupdateentry, keepingdeleteentry,

keepingstarttimer, keepingstoptimer, keepingresumetimer) returns a

preview unless you pass confirm: true in the tool call.

Setting KEEPINGREQUIRECONFIRM=false in your environment disables this gate.

Writes then happen on the first call — there is no second chance.

Recommendation: never disable this gate unless you are running

the server in a non-interactive automation context and have explicitly accepted

the loss of the confirmation step.

Install

From npm

No install required — npx fetches the package on first run:

KEEPING_TOKEN=kp_live_your_token_here npx -y keeping-mcp

The server speaks the MCP stdio protocol and stays in the foreground waiting for JSON-RPC frames on stdin — exit with Ctrl+C. In practice you do not run it by hand; an MCP-capable client (Claude Code, Claude Desktop, Cursor, etc.) spawns it for you using the config snippets below.

Optional — install globally so keeping-mcp is on your PATH:

npm install -g keeping-mcp
KEEPING_TOKEN=kp_live_your_token_here keeping-mcp

Requires Node.js >=22. The package is published to npmjs.com/package/keeping-mcp with sigstore provenance attestations.

Claude Code on Windows 11

Add to %APPDATA%\Claude\claudedesktopconfig.json or to your project's .mcp.json file.

{
  "mcpServers": {
    "keeping-mcp": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "keeping-mcp"],
      "env": {
        "KEEPING_TOKEN": "kp_live_your_token_here"
      }
    }
  }
}

The cmd /c wrapper is required on Windows — npx resolves to npx.cmd, and Claude Code's process spawn does not search PATHEXT extensions (see anthropics/claude-code#58510).

Claude Code on macOS / Linux

Add to ~/Library/Application Support/Claude/claudedesktopconfig.json (macOS) or ~/.config/Claude/claudedesktopconfig.json (Linux), or your project's .mcp.json.

{
  "mcpServers": {
    "keeping-mcp": {
      "command": "npx",
      "args": ["-y", "keeping-mcp"],
      "env": {
        "KEEPING_TOKEN": "kp_live_your_token_here"
      }
    }
  }
}

Other MCP clients

Any MCP-capable client that supports the stdio transport works. The server is started by npx -y keeping-mcp and reads KEEPING_TOKEN from its environment. Discoverable in the MCP Registry as io.github.Red-Square-Software/keeping-mcp.

Get a Keeping access token

Sign in to your Keeping account.
Open Preferences (top-right menu).
Find the section Show features for developers and enable it.
A new Personal access tokens section appears.
Click Generate new token, name it (e.g. "Claude Code"), and copy the value.
Store it as KEEPING_TOKEN in your shell environment OR in your Claude Code config env block.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Keeping: common questions

Is Keeping MCP server safe?: Mostly: it is graded B (83/100). Read the Keeping safety report
How do I install Keeping?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Keeping need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Keeping maintained?: The last commit was 142 days ago (2026-06-15). The latest release is v1.0.1.
How does Keeping compare with other MCP servers?: safety score 83/100 (higher than 65% of 48,255 servers); tools 12 (the typical server has 7); tools that change things 25% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.