MCP server for AI agents
Timix.AI runs a remote MCP server in front of its billable-hours, budget and invoicing data. Agents connect over Streamable HTTP with OAuth 2.1 or an API key, act with the role of the person behind the key, and see cost and margin figures only if you open that per key.
90-day free trial, full access, no credit card.
Illustrative entries
01 The problem
A REST API gives you endpoints. It does not give an agent a catalog it can discover, a way to sign in without a pasted secret, or a promise about what it will never see.
Without a standard, each assistant or agent framework needs its own wrapper around the tracker's API, and someone has to keep it working when the API changes.
An agent that holds a full-access key can read cost rates and margins and change shared data. Most teams want it to read hours and budgets, write a draft entry, and nothing more.
When an agent calls tools on your behalf, you need to know which tool ran, for whom, and whether the answer was filtered, without that record becoming a second copy of your data.
02 How Timix.AI fits
The server is a thin protocol adapter over the same per-request security pipeline as the REST API: tenant isolation, role checks and rate limiting. It is open to every plan, and the plan decides which tools run, not whether you can connect.
One endpoint takes JSON-RPC over POST. The server speaks MCP protocol versions 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05. It exposes tools only, with no resources or prompts, and it does not offer the older HTTP plus SSE transport, so a client that speaks only that cannot connect.
https://api.timix.ai/api/integration/v1/mcp. No sessions, no resumable streams, no JSON-RPC batching.
OAuth clients register themselves with dynamic client registration and PKCE, so there is no key to paste. For Claude Code, Cursor and scripts, create a tmx_ key and send it as X-Api-Key or as a Bearer token. Claude Code uses claude mcp add, and Cursor takes a url in mcp.json.
claude mcp add --transport http timix https://api.timix.ai/api/integration/v1/mcp then /mcp to sign in. Cursor mcp.json: {"mcpServers":{"timix":{"url":"https://api.timix.ai/api/integration/v1/mcp"}}}
A key you create by hand defaults to the read scope. The scopes are read, write, financial, destructive and admin. On top of the scope, a key acts with its owner's organization role, and the organization is fixed by the key: there is no tool to list or switch organizations. The OAuth sign-in grants every capability the person's role allows.
Roles: Owner, Admin, Finance, Manager, Member, Viewer. tools/list shows only what the role may use, and tools/call checks again.
Cost rates, profit and margin figures, and contact details such as email, phone and VAT number are replaced with a marker before a result leaves Timix.AI. Revenue, hours, budgets and names stay visible. A key can be opted in to see everything, but only while its owner holds a role that may. Every tools/call is logged with who, which tool, the outcome and whether it was redacted, but never the arguments or the result.
allowSensitiveData is set per key at creation. The audit log lives on Timix.AI's side, there is no screen to browse it in the app.
Each tool carries an MCP title and the readOnlyHint, destructiveHint, idempotentHint and openWorldHint annotations. 35 write tools preview first and run only when the assistant calls them again with the confirmation the preview names. The full catalog can be read by an unauthenticated tools/list, so you can inspect it before you sign up.
115 tools: 29 read-only, 86 that write. Time entries are created as Drafts; most other write tools act immediately.
Calls are counted per key in a 60 second window: 120 on Free and Starter, 300 on Professional, 1000 on Business or an active trial. Past the limit you get 429 with a Retry-After header. Tools of paid features answer with an error that names the missing feature and the plan that has it. REST API and webhooks stay Professional and up.
Free plan: 5 seats. Utilization reports Professional and up; the customer health score needs AI insights, on Business.
On the reports tab
Built-in report pages ship with every workspace. These are the ones this team reaches for — each one exports to PDF or CSV, billing-ready.
By role
Owner, Admin, Finance, Manager, Member, Viewer — six roles, scoped so each person sees exactly what they should.
Read the catalog with an unauthenticated tools/list, create a key for each client, name it clearly, set an expiry and keep its scopes narrow.
Decide who creates keys, keep sensitive data off unless a key needs it, and revoke a connection on the API Keys page the moment it is exposed.
Connect an agent for unbilled time, budget health and billing reports, within the plan features your organization has.
03 Point your agent at it
Start a free trial, open API Keys under Account, generate a key and send an initialize request to the endpoint. Then list the tools your role may use and call one against your own organization. Only Owners and Admins can create keys.
90-day free trial, full access, no credit card.
04 FAQ
https://api.timix.ai/api/integration/v1/mcp, using the Streamable HTTP transport. It is stateless: no sessions are issued, and every JSON-RPC message is a POST. The older HTTP plus SSE transport is not offered, and the server exposes tools only, not resources or prompts.
Two ways. Chat clients use OAuth 2.1 with PKCE and dynamic client registration, and no key is copied. IDEs, CLIs and scripts send a tmx_ API key as X-Api-Key or as an Authorization Bearer token. The key behind an OAuth sign-in has no expiry and there is no refresh token. It works until you revoke it, or until its owner is removed or disabled.
In Claude Code run: claude mcp add --transport http timix https://api.timix.ai/api/integration/v1/mcp, then run /mcp inside Claude Code to sign in. Note that if you set an Authorization header, Claude Code uses it and does not fall back to OAuth. In Cursor, add a server with the url https://api.timix.ai/api/integration/v1/mcp to mcp.json, and use a headers entry with your tmx_ key if you prefer a key to OAuth. Treat that file as a secret.
It acts with its owner's role inside one organization. A key created by hand starts with the read scope, and write, financial, destructive and admin are opted in per key. Cost, profit, margin and contact data are redacted unless the key is opted in. Revoking a key takes effect immediately.
The server, OAuth and API keys are open on every plan, Free included, and the Free plan has 5 seats. The plan limits which tools run and how many calls per minute: 120 on Free and Starter, 300 on Professional and 1000 on Business or an active trial. Tools of invoicing, time approvals, bulk import, scheduled reports, cost rates, custom fields, work schedules and holidays, utilization reports and AI insights need the matching paid feature. The REST API and webhooks need Professional or above.
Time entries are created as Drafts. Generated invoices are drafts too. Most other write tools, for example creating a customer or a project, take effect at once. Tools that delete, close a period or issue or void an invoice return a preview and run only when called again with the confirmation the preview names. That second call is made by the assistant, not by Timix.AI.
Several do. What Timix.AI offers is depth behind the tools: billable hours, budgets, margins and invoices in one catalog, redaction per key, six organization roles and an interface in English and Hebrew with right to left support. Compare the tool lists and the auth model against your own requirements.
No. Timix.AI is independent and is not affiliated with, endorsed or sponsored by Anthropic or OpenAI. Claude is a trademark of Anthropic. ChatGPT is a trademark of OpenAI.
Ready when you are
90-day free trial on every new workspace — full access to everything, no credit card.
Ask about Timix
Answers about features, pricing & fit
AI answers can be imperfect — double-check anything important. · Privacy Policy
Reach a human
Sales, support, or a bug report — goes straight to our team.
