Skip to content
anlyon.devby Anlyon

Hiveage MCP by usefulapi

io.usefulapi/hiveageusefulapi.iostreamable-httpv1.0.0Scanned

Manage Hiveage clients, invoices, estimates and payments; send invoices and record payments.

28 tools: 6 can delete or cancel things, 5 change things and 17 only read.

Tools: 6 delete, 0 irreversible, 5 write, 17 read.
  • Reads private data · 2
  • Reads text others write · 1
  • Can send data out · 5
  • No findings

Anlyon alternative

11 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

28 tools

Deletes or cancels 6Claude Code: deny
  • hiveage_mark_payment_realizedWRITE: mark an offline (unrealized) payment as realized, so it counts as received.No findings

    Why it is in this group

    • The name "hiveage_mark_payment_realized" says "mark": a word for a change.
    • The name "hiveage_mark_payment_realized" also says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    WRITE: mark an offline (unrealized) payment as realized, so it counts as received. Hiveage: POST /invs/{hash_key}/payments/{id}/mark_as_realized.

    Annotations the server declares

    • title: Mark payment realized
    • idempotentHint: true
    • destructiveHint: true
  • hiveage_record_paymentWRITE: enter a payment received on an invoice (changes its paid and due totals).No findings

    Why it is in this group

    • The name "hiveage_record_payment" says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    WRITE: enter a payment received on an invoice (changes its paid and due totals). Offline payments (cash, check, bank_transfer) are saved as unrealized until marked realized. Hiveage: POST /invs/{hash_key}/payments.

    Annotations the server declares

    • title: Record invoice payment
    • destructiveHint: true
  • hiveage_send_estimateWRITE, SENDS EMAIL: email an estimate to the client (default template, or custom).Can send data outNo findings

    Why it is in this group

    • The name "hiveage_send_estimate" says "send": a word for sending, and what is sent cannot be taken back.
    • The description says "Cannot be undone".
    • The input addresses people (input.recipients): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "hiveage_send_estimate" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    WRITE, SENDS EMAIL: email an estimate to the client (default template, or custom). Cannot be undone. Hiveage: POST /estm/{hash_key}/deliver.

    Annotations the server declares

    • title: Send estimate by email
    • destructiveHint: true
  • hiveage_send_invoiceWRITE, SENDS EMAIL: email an invoice to the client (the default invoice template to the connection's contacts, or a custom recipient/subject/message).Can send data outNo findings

    Why it is in this group

    • The name "hiveage_send_invoice" says "send": a word for sending, and what is sent cannot be taken back.
    • The description says "Cannot be undone".
    • The input addresses people (input.recipients): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "hiveage_send_invoice" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    WRITE, SENDS EMAIL: email an invoice to the client (the default invoice template to the connection's contacts, or a custom recipient/subject/message). Cannot be undone. Hiveage: POST /invs/{hash_key}/deliver.

    Annotations the server declares

    • title: Send invoice by email
    • destructiveHint: true
  • hiveage_send_invoice_reminderWRITE, SENDS EMAIL: email a payment reminder for an invoice (default reminder template, or custom).Can send data outNo findings

    Why it is in this group

    • The name "hiveage_send_invoice_reminder" says "send": a word for sending, and what is sent cannot be taken back.
    • The description says "Cannot be undone".
    • The input addresses people (input.recipients): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "hiveage_send_invoice_reminder" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    WRITE, SENDS EMAIL: email a payment reminder for an invoice (default reminder template, or custom). Cannot be undone. Hiveage: POST /invs/{hash_key}/reminder.

    Annotations the server declares

    • title: Send invoice reminder by email
    • destructiveHint: true
  • hiveage_update_contactWRITE: change fields of a contact (only the fields you pass are sent).No findings

    Why it is in this group

    • The name "hiveage_update_contact" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    WRITE: change fields of a contact (only the fields you pass are sent). Hiveage: PUT /network/{hash_key}/contacts/{id}.

    Annotations the server declares

    • title: Update contact
    • idempotentHint: true
    • destructiveHint: true
Changes things 5Claude Code: ask
  • hiveage_create_connectionWRITE: create a new connection (client, vendor or company) in the account.Can send data outNo findings

    Why it is in this group

    • The name "hiveage_create_connection" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    WRITE: create a new connection (client, vendor or company) in the account. For an organization give `name`; for an individual give first_name and last_name. Hiveage: POST /network.

    Annotations the server declares

    • title: Create connection
    • destructiveHint: false
  • hiveage_create_contactWRITE: add a contact (name and email, used when sending statements) to a connection.Can send data outNo findings

    Why it is in this group

    • The name "hiveage_create_contact" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    WRITE: add a contact (name and email, used when sending statements) to a connection. Hiveage: POST /network/{hash_key}/contacts.

    Annotations the server declares

    • title: Create contact
    • destructiveHint: false
  • hiveage_create_estimateWRITE: create an estimate (quote; starts as a draft, nothing is emailed) for a connection.No findings

    Why it is in this group

    • The name "hiveage_create_estimate" says "create": a word for a change.
    Description, as the server wrote it
    WRITE: create an estimate (quote; starts as a draft, nothing is emailed) for a connection. statement_no must be unique. Hiveage: POST /estm.

    Annotations the server declares

    • title: Create estimate
    • destructiveHint: false
  • hiveage_create_invoiceWRITE: create an invoice (starts as a draft; nothing is emailed) for a connection.No findings

    Why it is in this group

    • The name "hiveage_create_invoice" says "create": a word for a change.
    Description, as the server wrote it
    WRITE: create an invoice (starts as a draft; nothing is emailed) for a connection. statement_no must be unique. connection_id is the numeric `id` from hiveage_list_connections. Hiveage: POST /invs.

    Annotations the server declares

    • title: Create invoice
    • destructiveHint: false
  • hiveage_create_saved_itemWRITE: save a reusable line item (name, price, unit) for statements.No findings

    Why it is in this group

    • The name "hiveage_create_saved_item" says "create": a word for a change.
    Description, as the server wrote it
    WRITE: save a reusable line item (name, price, unit) for statements. Hiveage: POST /categories/items.

    Annotations the server declares

    • title: Create saved item
    • destructiveHint: false
Only reads 17Show 17 read-only tools
  • hiveage_get_connectionGet one connection (client, vendor or company) by hash_key.No findings

    Why it is in this group

    • The name "hiveage_get_connection" says "get": a word for reading.
    Description, as the server wrote it
    Get one connection (client, vendor or company) by hash_key. Hiveage: GET /network/{hash_key}.

    Annotations the server declares

    • title: Get connection
    • readOnlyHint: true
  • hiveage_get_contactGet one contact of a connection by its numeric id.Reads private dataNo findings

    Why it is in this group

    • The name "hiveage_get_contact" says "get": a word for reading.

    What it can reach

    • private-dataThe name "hiveage_get_contact" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    Get one contact of a connection by its numeric id. Hiveage: GET /network/{hash_key}/contacts/{id}.

    Annotations the server declares

    • title: Get contact
    • readOnlyHint: true
  • hiveage_get_estimateGet one estimate by hash_key, with its line items.No findings

    Why it is in this group

    • The name "hiveage_get_estimate" says "get": a word for reading.
    Description, as the server wrote it
    Get one estimate by hash_key, with its line items. Hiveage: GET /estm/{hash_key}.

    Annotations the server declares

    • title: Get estimate
    • readOnlyHint: true
  • hiveage_get_invoiceGet one invoice by hash_key, with its line items, taxes, discounts and shipping.No findings

    Why it is in this group

    • The name "hiveage_get_invoice" says "get": a word for reading.
    Description, as the server wrote it
    Get one invoice by hash_key, with its line items, taxes, discounts and shipping. Hiveage: GET /invs/{hash_key}.

    Annotations the server declares

    • title: Get invoice
    • readOnlyHint: true
  • hiveage_get_paymentGet one payment of an invoice by its numeric id.No findings

    Why it is in this group

    • The name "hiveage_get_payment" says "get": a word for reading.
    Description, as the server wrote it
    Get one payment of an invoice by its numeric id. Hiveage: GET /invs/{hash_key}/payments/{id}.

    Annotations the server declares

    • title: Get payment
    • readOnlyHint: true
  • hiveage_get_recurring_invoiceGet one recurring invoice profile by hash_key.No findings

    Why it is in this group

    • The name "hiveage_get_recurring_invoice" says "get": a word for reading.
    Description, as the server wrote it
    Get one recurring invoice profile by hash_key. Hiveage: GET /rinv/{hash_key}.

    Annotations the server declares

    • title: Get recurring invoice
    • readOnlyHint: true
  • hiveage_list_categoriesList the saved line-item templates: kind items (saved items with price and unit), expenses, tasks (with rate) or trips (with rate).No findings

    Why it is in this group

    • The name "hiveage_list_categories" says "list": a word for reading.
    Description, as the server wrote it
    List the saved line-item templates: kind items (saved items with price and unit), expenses, tasks (with rate) or trips (with rate). Hiveage: GET /categories/{kind}.

    Annotations the server declares

    • title: List saved items, expense, task or trip categories
    • readOnlyHint: true
  • hiveage_list_connection_estimatesList the estimates of one connection (client).No findings

    Why it is in this group

    • The name "hiveage_list_connection_estimates" says "list": a word for reading.
    Description, as the server wrote it
    List the estimates of one connection (client). Hiveage: GET /network/{hash_key}/estimates.

    Annotations the server declares

    • title: List a connection's estimates
    • readOnlyHint: true
  • hiveage_list_connection_invoicesList the invoices of one connection (client), by date.No findings

    Why it is in this group

    • The name "hiveage_list_connection_invoices" says "list": a word for reading.
    Description, as the server wrote it
    List the invoices of one connection (client), by date. Hiveage: GET /network/{hash_key}/invoices.

    Annotations the server declares

    • title: List a connection's invoices
    • readOnlyHint: true
  • hiveage_list_connection_recurring_invoicesList the recurring invoice profiles of one connection (client).No findings

    Why it is in this group

    • The name "hiveage_list_connection_recurring_invoices" says "list": a word for reading.
    Description, as the server wrote it
    List the recurring invoice profiles of one connection (client). Hiveage: GET /network/{hash_key}/recurring_invoices.

    Annotations the server declares

    • title: List a connection's recurring invoices
    • readOnlyHint: true
  • hiveage_list_connectionsList connections: the companies, clients and vendors in the account's network, sorted by name.No findings

    Why it is in this group

    • The name "hiveage_list_connections" says "list": a word for reading.
    Description, as the server wrote it
    List connections: the companies, clients and vendors in the account's network, sorted by name. Each has a hash_key (used by other tools) and a numeric id (used as connection_id when creating invoices). Hiveage: GET /network.

    Annotations the server declares

    • title: List connections
    • readOnlyHint: true
  • hiveage_list_contactsList the contacts (people with an email address for sending statements) of a connection.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "hiveage_list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "hiveage_list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List the contacts (people with an email address for sending statements) of a connection. Hiveage: GET /network/{hash_key}/contacts.

    Annotations the server declares

    • title: List contacts
    • readOnlyHint: true
  • hiveage_list_estimatesList estimates (quotes), sorted by date.No findings

    Why it is in this group

    • The name "hiveage_list_estimates" says "list": a word for reading.
    Description, as the server wrote it
    List estimates (quotes), sorted by date. Hiveage: GET /estm.

    Annotations the server declares

    • title: List estimates
    • readOnlyHint: true
  • hiveage_list_invoicesList invoices (state draft, viewed, sent, paid or partial) with totals, sorted by date.No findings

    Why it is in this group

    • The name "hiveage_list_invoices" says "list": a word for reading.
    Description, as the server wrote it
    List invoices (state draft, viewed, sent, paid or partial) with totals, sorted by date. Hiveage: GET /invs.

    Annotations the server declares

    • title: List invoices
    • readOnlyHint: true
  • hiveage_list_paymentsList the payments entered on an invoice.No findings

    Why it is in this group

    • The name "hiveage_list_payments" says "list": a word for reading.
    Description, as the server wrote it
    List the payments entered on an invoice. Hiveage: GET /invs/{hash_key}/payments.

    Annotations the server declares

    • title: List invoice payments
    • readOnlyHint: true
  • hiveage_list_recurring_invoice_invoicesList the invoices a recurring invoice profile has generated.No findings

    Why it is in this group

    • The name "hiveage_list_recurring_invoice_invoices" says "list": a word for reading.
    Description, as the server wrote it
    List the invoices a recurring invoice profile has generated. Hiveage: GET /rinv/{hash_key}/invoices.

    Annotations the server declares

    • title: List invoices generated by a recurring invoice
    • readOnlyHint: true
  • hiveage_list_recurring_invoicesList recurring invoice profiles (interval, next billing date, occurrences).No findings

    Why it is in this group

    • The name "hiveage_list_recurring_invoices" says "list": a word for reading.
    Description, as the server wrote it
    List recurring invoice profiles (interval, next billing date, occurrences). Hiveage: GET /rinv.

    Annotations the server declares

    • title: List recurring invoices
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

10 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 untrusted-input tool breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out5
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__hiveage__hiveage_list_contacts"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http hiveage https://hiveage.usefulapi.io/mcp
claude mcp add --transport http hiveage https://hiveage.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__hiveage__hiveage_list_connections",
      "mcp__hiveage__hiveage_get_connection",
      "mcp__hiveage__hiveage_list_connection_invoices",
      "mcp__hiveage__hiveage_list_connection_estimates",
      "mcp__hiveage__hiveage_list_connection_recurring_invoices",
      "mcp__hiveage__hiveage_list_contacts",
      "mcp__hiveage__hiveage_get_contact",
      "mcp__hiveage__hiveage_list_invoices",
      "mcp__hiveage__hiveage_get_invoice",
      "mcp__hiveage__hiveage_list_estimates",
      "mcp__hiveage__hiveage_get_estimate",
      "mcp__hiveage__hiveage_list_recurring_invoices",
      "mcp__hiveage__hiveage_get_recurring_invoice",
      "mcp__hiveage__hiveage_list_recurring_invoice_invoices",
      "mcp__hiveage__hiveage_list_payments",
      "mcp__hiveage__hiveage_get_payment",
      "mcp__hiveage__hiveage_list_categories"
    ],
    "ask": [
      "mcp__hiveage__hiveage_create_connection",
      "mcp__hiveage__hiveage_create_contact",
      "mcp__hiveage__hiveage_create_invoice",
      "mcp__hiveage__hiveage_create_estimate",
      "mcp__hiveage__hiveage_create_saved_item"
    ],
    "deny": [
      "mcp__hiveage__hiveage_update_contact",
      "mcp__hiveage__hiveage_record_payment",
      "mcp__hiveage__hiveage_mark_payment_realized",
      "mcp__hiveage__hiveage_send_invoice",
      "mcp__hiveage__hiveage_send_invoice_reminder",
      "mcp__hiveage__hiveage_send_estimate"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as hiveage. Review it before you use it.

Capability tags behind 7 rules
  • mcp__hiveage__hiveage_list_contacts private-data, untrusted-input
  • mcp__hiveage__hiveage_get_contact private-data
  • mcp__hiveage__hiveage_create_connection outbound
  • mcp__hiveage__hiveage_create_contact outbound
  • mcp__hiveage__hiveage_send_invoice outbound
  • mcp__hiveage__hiveage_send_invoice_reminder outbound
  • mcp__hiveage__hiveage_send_estimate outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/hiveage/verify?hash=da0e7c00636e3eafcc3b1c0d64169ba92f3a25478762d13fe8ea91bef58a60a6" | jq -e '.changed == false'

Pinned hash da0e7c00636e, from Oct 25, 2026, 13:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/hiveage/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/hiveage
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/hiveage.svg)](https://anlyon.dev/servers/io.usefulapi/hiveage)

Source: MCP Registry · repository. Synced Oct 25, 2026, 13:18 UTC.