How do I install Tempo Api?

Tempo Api is a local plugin. Install it using npm package: tempo-api-mcp and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Tempo Api safe to use?

Yes. Tempo Api passed MCP Marketplace's automated security scan with a score of 7.4/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What credentials does Tempo Api need?

Tempo Api requires the following credentials or environment variables: TEMPO_API_TOKEN. You can find setup instructions on the server detail page.

What AI apps work with Tempo Api?

Tempo Api uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Tempo Api MCP Server

by Chris Hall

Developer ToolsModerate7.4Local

Free

Tempo time-tracking for Claude — worklogs, plans, and timesheet approvals

About

Tempo time-tracking for Claude — worklogs, plans, and timesheet approvals

Security Report

7.4

Moderate7.4Low Risk

The tempo-api-mcp server is a well-structured Tempo API wrapper with path-parameter validation, a two-step confirmation flow for all write operations, and permissions that match its purpose of querying and managing Tempo worklogs, timesheets, and accounts. No data exfiltration, shell execution, or hardcoded credentials were observed in the provided code; the main caveat is that the plans.ts file is truncated, so its remaining logic could not be fully verified. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

6 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Your Tempo API token (Settings → API integration in your Tempo workspace)Required

Environment variable: TEMPO_API_TOKEN

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-chrischall-tempo-api-mcp": {
      "env": {
        "TEMPO_API_TOKEN": "your-tempo-api-token-here"
      },
      "args": [
        "-y",
        "tempo-api-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

tempo-api-mcp

Tempo API MCP server for Claude — developed and maintained by AI (Claude Code)

Confirmations

Every write (create/update/delete, and the timesheet submit/approve/reject/reopen/recall actions) asks the user to confirm before it changes anything: a confirmation prompt where the client supports one; otherwise the first call returns a preview of exactly what would be sent plus a confirmToken, and only a repeat call with that token proceeds.

variable	default
`MCP_CONFIRM_MODE`	`ask-user`	What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) gets the real prompt unless `MCP_CONFIRM_ELICITATION=off`. An unrecognised value is treated as `refuse`.
`MCP_CONFIRM_ELICITATION`	`on`	`off` never shows a confirmation prompt, so every client gets the `MCP_CONFIRM_MODE` two-step flow. Set it for opencode v2: it claims to support prompts but never displays them, so writes (including timesheet approvals) hang. Any other value stays `on`.
`MCP_CONFIRM_TTL_SECONDS`	`600`	How long a token stays valid.
`MCP_CONFIRM_SECRET`	random per process	Signing key; set it only if tokens must survive a server restart.

In opencode, set it in the server's environment block:

{
  "mcp": {
    "servers": {
      "tempo": {
        "type": "local",
        "command": ["npx", "-y", "tempo-api-mcp"],
        "environment": { "TEMPO_API_TOKEN": "…", "MCP_CONFIRM_ELICITATION": "off" }
      }
    }
  }
}