# @pyunto/tm-mcp Read your Pyunto Time Management schedule and log time from an AI assistant. E2EE project planning. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.3.5 - **Author:** com.pyunto - **License:** MIT - **npm:** @pyunto/tm-mcp - **Source:** https://github.com/pyunto/tm-integrations - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 4 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-08T19:54:43.917Z - **Version scanned:** 0.3.5 - **CVEs:** none found by OSV at scan time ## Tools 10 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `whoami` — Who this MCP server is connected as: account email, API key name, granted - `list_projects` — List every project the account can see, with id, name, colour and role - `list_tasks` — List Gantt tasks (and subtasks) with their id, project, name and date range. - `list_time_blocks` — The individual time blocks logged between two dates (inclusive, max 92 days), - `time_summary` — Total hours logged between two dates (inclusive, max 92 days), grouped by - `log_time` — Record a block of worked time on the calendar. Writes to the user's real - `update_time_block` — Change an already-recorded time block: its date, start/end times, memo, - `delete_time_block` — Permanently delete ONE recorded time block, along with any files attached - `list_deleted_time_blocks` — Time blocks that were deleted but can still be restored, newest first, - `restore_time_block` — Put a deleted time block back on the calendar, along with any files that ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"tm\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@pyunto/tm-mcp\"\n ],\n \"env\": {\n \"PYUNTO_TM_API_KEY\": \"\",\n \"PYUNTO_TM_PASSWORD\": \"\",\n \"PYUNTO_TM_PASSWORD_FILE\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `PYUNTO_TM_API_KEY` — Pyunto Tm API Key (required) - `PYUNTO_TM_PASSWORD` — Pyunto Tm Password (optional) - `PYUNTO_TM_PASSWORD_FILE` — Pyunto Tm Password File (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 3 credentials (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 55, ceiling 55 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40pyunto%2Ftm-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40pyunto%2Ftm-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40pyunto%2Ftm-mcp - HTML page: https://forgeregistry.com/registry/%40pyunto%2Ftm-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.