Skip to content
anlyon.devby Anlyon

Bilflo MCP by usefulapi

io.usefulapi/bilflousefulapi.iostreamable-httpv1.0.0Scanned

Read Bilflo clients, contract jobs, contractors and reports; update jobs, terminate or reopen them.

26 tools: 4 can delete or cancel things, 2 do something that can't be undone, 3 change things and 17 only read.

Tools: 4 delete, 2 irreversible, 3 write, 17 read.
  • Reads private data · 5
  • Reads text others write · 26
  • Can send data out · 0
  • 3 findings

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

26 tools

Deletes or cancels 4Claude Code: deny
  • bilflo_terminate_contract_jobWRITE: ends a contract job on the given date (the contractor stops being placed with the client; no more timecards are expected after it).Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_terminate_contract_job" says "terminate": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: ends a contract job on the given date (the contractor stops being placed with the client; no more timecards are expected after it). Affects payroll and invoicing. A terminated job can be brought back with bilflo_reopen_contract_job. POST /v1/ContractJobs/terminate.

    Annotations the server declares

    • title: Terminate contract job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • bilflo_update_clientWRITE: changes only the client fields you pass (business name, client code, phone, fax, active flag); the rest stay as they are.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_update_client" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: changes only the client fields you pass (business name, client code, phone, fax, active flag); the rest stay as they are. Setting is_active=false deactivates the client. PATCH /v1/Clients/{clientId}.

    Annotations the server declares

    • title: Update client
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • bilflo_update_contract_jobWRITE: changes only the contract job fields you pass (title, overtime rule, workers' comp code, burden, per-diem/expenses/sick-time/meal-period flags); the rest stay as they are.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_update_contract_job" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: changes only the contract job fields you pass (title, overtime rule, workers' comp code, burden, per-diem/expenses/sick-time/meal-period flags); the rest stay as they are. Pay and bill rates change payroll and invoices, so confirm values with the user. Client, contractor, dates and status cannot be changed here. PATCH /v1/ContractJobs/{jobId}.

    Annotations the server declares

    • title: Update contract job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • bilflo_update_contractorWRITE: changes only the contractor contact fields you pass (name, title, email, phone, address, company); the rest stay as they are.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_update_contractor" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: changes only the contractor contact fields you pass (name, title, email, phone, address, company); the rest stay as they are. Tax, bank, social security number and activation are not changeable here. PATCH /v1/Users/contractors/{contractorId}.

    Annotations the server declares

    • title: Update contractor contact details
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Can't be undone 2Claude Code: ask
  • bilflo_list_job_pay_bill_itemsThe pay and bill rates (pay/bill items such as Regular, Overtime) of one contract job.Reads text others write1 finding

    Why it is in this group

    • The name "bilflo_list_job_pay_bill_items" says "list": a word for reading.
    • The description's first verb is "pay": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "bilflo_list_job_pay_bill_items" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "bilflo_list_job_pay_bill_items" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    The pay and bill rates (pay/bill items such as Regular, Overtime) of one contract job. GET /v1/ContractJobs/{jobId}/payBillItems.

    Annotations the server declares

    • title: List job pay/bill items
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_job_purchase_ordersThe purchase orders attached to one contract job.Reads text others write1 finding

    Why it is in this group

    • The name "bilflo_list_job_purchase_orders" says "list": a word for reading.
    • The description's first verb is "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "bilflo_list_job_purchase_orders" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "bilflo_list_job_purchase_orders" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    The purchase orders attached to one contract job. GET /v1/ContractJobs/{jobId}/purchaseOrders.

    Annotations the server declares

    • title: List job purchase orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Changes things 3Claude Code: ask
  • bilflo_create_clientWRITE: creates a new client (customer) in Bilflo with the given business name and returns its id.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_create_client" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: creates a new client (customer) in Bilflo with the given business name and returns its id. It is visible to the whole staffing company and used for billing, so check bilflo_list_clients first to avoid a duplicate. POST /v1/Clients.

    Annotations the server declares

    • title: Create client
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • bilflo_reopen_contract_jobWRITE: reopens a terminated contract job (like the Open Job button): the job becomes active again, the end date is cleared, the contractor is made active and the missing timecards …Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_reopen_contract_job" says "reopen": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: reopens a terminated contract job (like the Open Job button): the job becomes active again, the end date is cleared, the contractor is made active and the missing timecards from the reopen date's week are created. Fails if the job is not terminated or the company plan has no room for another active job. POST /v1/ContractJobs/{jobId}/reopen.

    Annotations the server declares

    • title: Reopen contract job
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • bilflo_run_reportRun one of the company's saved custom reports and return its rows.Reads text others write1 finding

    Why it is in this group

    • The name "bilflo_run_report" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "bilflo_run_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "bilflo_run_report" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run one of the company's saved custom reports and return its rows. Report parameters are report specific key/value pairs, for example {"Start": "2026-01-01", "End": "2026-01-31"}. Reads data only. POST /v1/Reports/{reportId}/Execute.

    Annotations the server declares

    • title: Run custom report
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Only reads 17Show 17 read-only tools
  • bilflo_get_clientOne client with its addresses and contacts.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bilflo_get_client" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One client with its addresses and contacts. GET /v1/Clients/{clientId}.

    Annotations the server declares

    • title: Get client
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_get_company_settingOne of the company's lookup lists: workers_comp_codes, payment_terms, remittances, burden_settings, benefit_rules, states or pay_bill_items.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_get_company_setting" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One of the company's lookup lists: workers_comp_codes, payment_terms, remittances, burden_settings, benefit_rules, states or pay_bill_items. GET /v1/CompanySettings/{setting}.

    Annotations the server declares

    • title: Get company setting
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_get_contract_jobOne contract job (a contractor placed with a client): client, contractor, title, start/end dates, status, overtime rule, timecard method, per-diem/expense/sick-time flags, workers'…Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_get_contract_job" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One contract job (a contractor placed with a client): client, contractor, title, start/end dates, status, overtime rule, timecard method, per-diem/expense/sick-time flags, workers' comp code and burden. GET /v1/ContractJobs/{jobId}.

    Annotations the server declares

    • title: Get contract job
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_get_contractorOne contractor: profile (name, email, phone, address, W2/1099), jobs, checks paid, work status, benefit settings and custom fields.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bilflo_get_contractor" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One contractor: profile (name, email, phone, address, W2/1099), jobs, checks paid, work status, benefit settings and custom fields. Social security number, date of birth and bank details are removed from the reply. GET /v1/Users/contractors/{contractorId}.

    Annotations the server declares

    • title: Get contractor
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_get_direct_hireOne direct hire (a permanent placement): header, fee/split data, contacts and custom fields as Bilflo returns them.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bilflo_get_direct_hire" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One direct hire (a permanent placement): header, fee/split data, contacts and custom fields as Bilflo returns them. GET /v1/DirectHires/{jobId}.

    Annotations the server declares

    • title: Get direct hire
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_get_job_custom_fieldsThe custom field values of one contract job.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_get_job_custom_fields" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The custom field values of one contract job. GET /v1/ContractJobs/{jobId}/customFields.

    Annotations the server declares

    • title: Get job custom fields
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_get_team_memberOne back-office team member (staffing company user): profile, roles and compensation settings.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_get_team_member" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One back-office team member (staffing company user): profile, roles and compensation settings. Government ids and bank details are removed. GET /v1/Users/teamMember/{id}.

    Annotations the server declares

    • title: Get team member
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_client_addressesThe addresses (work sites and billing addresses) of one client.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_client_addresses" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The addresses (work sites and billing addresses) of one client. GET /v1/Clients/addresses/{clientId}.

    Annotations the server declares

    • title: List client addresses
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_client_agreementsThe agreements (billing terms) on file for one client.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_client_agreements" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The agreements (billing terms) on file for one client. GET /v1/Clients/agreements/{clientId}.

    Annotations the server declares

    • title: List client agreements
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_client_contactsThe contacts (people at the client: name, title, phone, email, active flag) of one client.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_client_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "bilflo_list_client_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The contacts (people at the client: name, title, phone, email, active flag) of one client. GET /v1/Clients/contact/{clientId}.

    Annotations the server declares

    • title: List client contacts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_client_contract_posThe contract purchase orders of one client (PO numbers and amounts used for billing).Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_client_contract_pos" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The contract purchase orders of one client (PO numbers and amounts used for billing). GET /v1/Clients/contractPOs/{clientId}.

    Annotations the server declares

    • title: List client contract POs
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_client_invoice_groupsThe contract invoice groups of one client (which jobs are invoiced together).Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_client_invoice_groups" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The contract invoice groups of one client (which jobs are invoiced together). GET /v1/Clients/contractInvoiceGroups/{clientId}.

    Annotations the server declares

    • title: List client invoice groups
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_clientsThe staffing company's clients (the customers contractors are placed with): id, business name, client code, phone, active flag.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_clients" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The staffing company's clients (the customers contractors are placed with): id, business name, client code, phone, active flag. Each row carries the number of addresses and contacts; set include_details for the full address and contact lists. Bilflo returns every client at once, so this tool filters and pages the list itself. GET /v1/Clients.

    Annotations the server declares

    • title: List clients
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_custom_field_itemsThe selectable items of one custom list field (id from bilflo_list_custom_fields).Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_custom_field_items" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The selectable items of one custom list field (id from bilflo_list_custom_fields). Items of a field named like personal data (SSN, date of birth, bank account, password) are not shown. GET /v1/CustomFields/items.

    Annotations the server declares

    • title: List custom field items
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_custom_fieldsThe company's custom fields (active and inactive) with type, requiredness per service offering and, for list fields, the selectable items.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_custom_fields" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The company's custom fields (active and inactive) with type, requiredness per service offering and, for list fields, the selectable items. GET /v1/CustomFields.

    Annotations the server declares

    • title: List custom fields
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_job_approversWho approves the timecards of one contract job.Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_job_approvers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Who approves the timecards of one contract job. GET /v1/ContractJobs/{jobId}/approvers.

    Annotations the server declares

    • title: List job approvers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • bilflo_list_overtime_rulesThe company's overtime rules (id, name, state).Reads text others writeNo findings

    Why it is in this group

    • The name "bilflo_list_overtime_rules" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The company's overtime rules (id, name, state). Use the ids with bilflo_update_contract_job. GET /v1/OvertimeRules.

    Annotations the server declares

    • title: List overtime rules
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write26
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

3 warn
  • Warnbilflo_list_job_pay_bill_items

    The server marks "bilflo_list_job_pay_bill_items" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "bilflo_list_job_pay_bill_items" says "list": a word for reading.

    What this check looks for
  • Warnbilflo_list_job_purchase_orders

    The server marks "bilflo_list_job_purchase_orders" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "bilflo_list_job_purchase_orders" says "list": a word for reading.

    What this check looks for
  • Warnbilflo_run_report

    The server marks "bilflo_run_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "bilflo_run_report" says "run": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http bilflo https://bilflo.usefulapi.io/mcp
claude mcp add --transport http bilflo https://bilflo.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__bilflo__bilflo_list_clients",
      "mcp__bilflo__bilflo_get_client",
      "mcp__bilflo__bilflo_list_client_contacts",
      "mcp__bilflo__bilflo_list_client_addresses",
      "mcp__bilflo__bilflo_list_client_agreements",
      "mcp__bilflo__bilflo_list_client_contract_pos",
      "mcp__bilflo__bilflo_list_client_invoice_groups",
      "mcp__bilflo__bilflo_get_contract_job",
      "mcp__bilflo__bilflo_list_job_approvers",
      "mcp__bilflo__bilflo_get_job_custom_fields",
      "mcp__bilflo__bilflo_get_direct_hire",
      "mcp__bilflo__bilflo_get_contractor",
      "mcp__bilflo__bilflo_get_team_member",
      "mcp__bilflo__bilflo_list_overtime_rules",
      "mcp__bilflo__bilflo_get_company_setting",
      "mcp__bilflo__bilflo_list_custom_fields",
      "mcp__bilflo__bilflo_list_custom_field_items"
    ],
    "ask": [
      "mcp__bilflo__bilflo_list_job_pay_bill_items",
      "mcp__bilflo__bilflo_list_job_purchase_orders",
      "mcp__bilflo__bilflo_run_report",
      "mcp__bilflo__bilflo_create_client",
      "mcp__bilflo__bilflo_reopen_contract_job"
    ],
    "deny": [
      "mcp__bilflo__bilflo_update_client",
      "mcp__bilflo__bilflo_update_contract_job",
      "mcp__bilflo__bilflo_terminate_contract_job",
      "mcp__bilflo__bilflo_update_contractor"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bilflo. Review it before you use it.

Capability tags behind 26 rules
  • mcp__bilflo__bilflo_list_clients untrusted-input
  • mcp__bilflo__bilflo_get_client private-data, untrusted-input
  • mcp__bilflo__bilflo_list_client_contacts private-data, untrusted-input
  • mcp__bilflo__bilflo_list_client_addresses untrusted-input
  • mcp__bilflo__bilflo_list_client_agreements private-data, untrusted-input
  • mcp__bilflo__bilflo_list_client_contract_pos untrusted-input
  • mcp__bilflo__bilflo_list_client_invoice_groups untrusted-input
  • mcp__bilflo__bilflo_get_contract_job untrusted-input
  • mcp__bilflo__bilflo_list_job_pay_bill_items untrusted-input
  • mcp__bilflo__bilflo_list_job_approvers untrusted-input
  • mcp__bilflo__bilflo_list_job_purchase_orders untrusted-input
  • mcp__bilflo__bilflo_get_job_custom_fields untrusted-input
  • mcp__bilflo__bilflo_get_direct_hire private-data, untrusted-input
  • mcp__bilflo__bilflo_get_contractor private-data, untrusted-input
  • mcp__bilflo__bilflo_get_team_member untrusted-input
  • mcp__bilflo__bilflo_list_overtime_rules untrusted-input
  • mcp__bilflo__bilflo_get_company_setting untrusted-input
  • mcp__bilflo__bilflo_list_custom_fields untrusted-input
  • mcp__bilflo__bilflo_list_custom_field_items untrusted-input
  • mcp__bilflo__bilflo_run_report untrusted-input
  • mcp__bilflo__bilflo_create_client untrusted-input
  • mcp__bilflo__bilflo_update_client untrusted-input
  • mcp__bilflo__bilflo_update_contract_job untrusted-input
  • mcp__bilflo__bilflo_terminate_contract_job untrusted-input
  • mcp__bilflo__bilflo_reopen_contract_job untrusted-input
  • mcp__bilflo__bilflo_update_contractor untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/bilflo/verify?hash=7157595b373fcb046ed646947731c8010a3a35dcbd2e8adf56b9aea6461432aa" | jq -e '.changed == false'

Pinned hash 7157595b373f, from Oct 24, 2026, 13:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/bilflo/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/bilflo
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/bilflo.svg)](https://anlyon.dev/servers/io.usefulapi/bilflo)

Source: MCP Registry · repository. Synced Oct 24, 2026, 13:17 UTC.