Mycase Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mycase Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for MyCase — gives Claude full access to your law firm's MyCase account.
112 tools. One setup command.
The OAuth flow uses http://127.0.0.1:8766/callback as the redirect URI. You must register this URI in your MyCase developer app settings before running setup. Without it, authorization will fail.
If you don't have a MyCase developer app yet, contact MyCase support or your account manager to request API access.
pip install mycase-mcphttp://127.0.0.1:8766/callback mycase-mcp-setupEnter your Client ID and Client Secret when prompted. Your browser will open for MyCase authorization.
mycase-mcp-verifyAdd to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"mycase": {
"command": "mycase-mcp"
}
}
}Restart Claude Desktop after saving the config.
"No code received" after authorizing in browser → The redirect URI http://127.0.0.1:8766/callback is not registered in your MyCase app. Add it and try again.
Token exchange failed (401) → Double-check your Client ID and Client Secret. Re-run mycase-mcp-setup.
"Missing credentials" on verify → Run mycase-mcp-setup first. Credentials are saved to ~/.mycase-mcp/.
Claude doesn't see the mycase tools → Make sure you restarted Claude Desktop after editing claude_desktop_config.json.
429 Too Many Requests → The server retries automatically (up to 3 times). If it persists, wait a moment and retry.
By default credentials are stored in your operating system's native secret store via the cross-platform keyring library:
| OS | Backend |
|---|---|
| macOS | Keychain |
| Windows | Credential Manager |
| Linux | Secret Service (GNOME Keyring / KWallet) |
Secrets are saved under the service name mycase-mcp. Nothing is written to disk in clear text.
File fallback. On a host with no keyring backend (e.g. a headless Linux box without Secret Service), or if you set MYCASE_MCP_USE_KEYRING=0, credentials fall back to a ~/.mycase-mcp/.env file with 0600 permissions.
Read order. Credentials resolve in the order OS keyring → process environment → .env file. So a rotated secret in the keyring always wins, and a MYCASE_CLIENT_ID / MYCASE_CLIENT_SECRET exported in your shell overrides the file fallback without touching the keyring.
OAuth tokens are stored separately at ~/.mycase-mcp/tokens.json (mode 600) and refreshed automatically on expiry.
| Category | Tools |
|---|---|
| Identity | who_am_i, get_firm, list_staff, get_staff_member |
| Cases | list_cases, get_case, create_case, update_case, delete_case, list_cases_for_client, add_client_to_case, add_company_to_case, add_staff_to_case |
| Clients | list_clients, get_client, create_client, update_client, delete_client, list_client_notes, list_client_message_threads |
| Companies | list_companies, get_company, create_company, update_company, delete_company, add_client_to_company |
| Tasks | list_tasks, create_task, update_task, delete_task, assign_task_to_staff |
| Events | list_events, create_event, update_event, delete_event, add_staff_to_event |
| Time Entries | list_time_entries, get_time_entry, create_time_entry, delete_time_entry |
| Invoices | list_invoices, delete_invoice, record_invoice_payment, list_invoice_payments |
| Expenses | list_expenses, get_expense, create_expense, delete_expense |
| Notes | get_note, update_note, delete_note, list_case_notes, create_case_note, create_client_note, create_company_note |
| Documents | list_documents, get_document, update_document, delete_document, list_case_documents, list_document_versions, list_all_document_versions, get_case_folder, upload_document, upload_case_document, upload_document_version, get_document_data, get_document_version_data, delete_document_version |
| Folders | list_folder_documents, list_folder_subfolders, create_case_subfolder |
| Leads | list_leads, get_lead, create_lead, update_lead |
| Calls | list_calls, create_call, update_call, delete_call |
| Messaging | create_message_thread, create_case_message_thread, post_message |
| Custom Fields | list_custom_fields, get_custom_field, create_custom_field, delete_custom_field, list_custom_field_options, create_custom_field_option, update_custom_field_option, delete_custom_field_option |
| Case Reference | list_case_stages, create_case_stage, update_case_stage, delete_case_stage, list_case_roles |
| Locations | list_locations, create_location, update_location, delete_location |
| Referral Sources | list_referral_sources, create_referral_source |
| People Groups | list_people_groups, create_people_group, update_people_group, delete_people_group |
| Practice Areas | list_practice_areas, create_practice_area, update_practice_area, delete_practice_area |
| Webhooks | list_webhook_subscriptions, create_webhook_subscription, delete_webhook_subscription |
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.