MCP.Market

Hilan MCP server

by udah1·io.github.udah1/hilan-mcp·v0.3.2·6 stars
No reviews yet

Pull Hilan (Hilanet / חילן, חילנט) payslips and Form 106 into any AI assistant.

B71/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B71/100

full report

Adoption
Growing

6 stars39 downloads/wk

Reviews

Write one

Nobody has reviewed Hilan yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Hilan tools (13, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • debugCallAsmx

    DEBUG/exploration only: raw pass-through to any PaySlipApiapi/Form106Apiapi .asmx endpoint on a logged-in session, for testing API behavior. Not for regular use.

  • debugDownloadPdf

    DEBUG/exploration only: download an arbitrary relative PDF URL (e.g. one returned by debugCallAsmx) to inspect it. Not for regular use.

  • describeTable
  • dismissUpdateNoticewrite action

    Call this after the user declines an update offered via an "_updateNotice" field on a previous tool response, passing that same version string, so hilan-mcp stops mentioning that specific version. It will still notify about a newer version later.

  • downloadCombinedPayslipsPdf
  • getPersonalDetails

    Logs in and fetches personal details (name, national ID, birthdate, address, phone, email, work start date, job type). This is a live lookup, not stored in the local database.

  • getSalaryTrends
  • listTables

    List queryable tables (payslips, form106 — credentials/sessions are never exposed here)

  • listTenants

    List configured Hilan tenants (no secrets returned)

  • querywrite action

    Execute a SELECT-only SQL query against payslips/form106 (allowlisted; credentials/sessions/tenants are never reachable)

  • resyncPayslipMonth
  • syncForm106

    Log into a Hilan tenant and download Form 106 (annual tax summary) for a given year, or the default year

  • syncPayslips

    Log into a Hilan tenant (using previously ingested credentials) and sync recent payslips (structured Bruto/Neto/parts + PDF)

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

1 medium
  • Code scan37 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 48 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    dist/services/HilanClient.js: … const fields = await page.$$eval('#mainForm input[type="text"], #mainForm…
Overall 71/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Hilan compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
71/100
higher than 37% of 48,273 servers
Tools
13
the typical server has 7
Tools that change things
15%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
6
more than 85% of 28,534 servers
Downloads a week
39
more than 31% of 11,915 servers with a package

What its tools let an agent do: 9 read · 4 change

Install Hilan in Claude Code, Cursor or VS Code

Runs npx -y hilan-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add hilan-mcp -- npx -y hilan-mcp
Add to Cursor

What the publisher says

From the Hilan repository's README, as published. We do not edit it. Read it on GitHub

hilan-mcp

An MCP server for Hilan (Hilanet / חילן, חילנט) — pull your payslips and Form 106 into any AI assistant, for any Hilan tenant.

There's no official Hilan API. hilan-mcp drives a real (headless) Chromium browser via Playwright to log in, then reuses that same authenticated session to call Hilan's internal endpoints and download PDFs — no fragile hand-rolled cookie replay, and no plaintext secrets stored anywhere.

Table of contents

  • Features
  • How it works
  • Setup
  • 0. If you're on npm 12 or newer
  • 1. Register a tenant and enter credentials
  • 2. Add the server to your MCP client config
  • 3. Use it
  • For AI agents setting this up on a user's behalf
  • MCP tools
  • Scope
  • Reliability notes
  • Security model

Features

  • 📄 Payslips — structured Bruto/Neto/salary-parts data, plus the PDF, for any month in the tenant's history.
  • 🧾 Form 106 — annual tax summary PDFs, per year.
  • 🔐 Encrypted local storage — SQLCipher-encrypted SQLite, key never written to disk in plaintext; OS-native credential store (Keychain/DPAPI/Secret Service) support.
  • 🏢 Any Hilan tenant — login form fields are detected per-tenant instead of hardcoded to one employer.
  • 💬 Answers, not raw JSON — tools like query answer "how much did I earn in June?" straight from local data, no network round-trip.
  • 🔄 Self-updating awareness — the server checks for newer versions and lets your AI agent offer to update you, without needing its own UI.

How it works

This server drives a real (headless) Chromium browser via Playwright to log in, then reuses that same authenticated browser context's HTTP client (context.request) to call Hilan's internal .asmx JSON endpoints and download PDFs — so it automatically inherits whatever cookies/headers a real page load would have set up, instead of a fragile hand-rolled cookie replay.

Login form fields differ per Hilan tenant (some have 2 fields, some 3), so the login form is inspected fresh for each tenant the first time you ingest credentials, rather than hardcoded to one company.

Setup

0. If you're on npm 12 or newer

npm 12 blocks dependency install scripts unless you allow them, and one of this package's dependencies (better-sqlite3-multiple-ciphers, the encrypted SQLite engine) needs its install script to compile a native binding. Without it, setup appears to succeed and then every tool that touches the database fails. Allow it once, for all future npx and global installs:

npm config set allow-scripts=better-sqlite3-multiple-ciphers --location=user

Or per install, if you'd rather not set it globally:

npm install -g --allow-scripts=better-sqlite3-multiple-ciphers hilan-mcp

On npm 11 and older this isn't needed — install scripts still run by default. Check with npm --version.

1. Register a tenant and enter credentials

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Hilan: common questions

Is Hilan MCP server safe?
Mostly: it is graded B (71/100). Read the Hilan safety report
How do I install Hilan?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Hilan need an API key?
Yes. The registry entry asks for HILAN_DB_KEY.
Is Hilan maintained?
The last commit was 87 days ago (2026-08-07). The latest release is v0.3.2.
How does Hilan compare with other MCP servers?
safety score 71/100 (higher than 37% of 48,273 servers); tools 13 (the typical server has 7); tools that change things 15% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.