EpochBLOCK
Time estimation MCP server for AI agents: PERT, COCOMO II, Monte Carlo, sprint forecasting, token-to-time mapping, cost estimation, and schedule risk tools.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Epoch is a time estimation MCP server that helps engineering leads, agents, and planners who need calibrated duration estimates produce PERT/reference-class estimates and record actuals.
TL;DR: Epoch — time estimation MCP server. Best for engineering leads, agents, and planners who need calibrated duration estimates.
[](https://github.com/KyaniteLabs/Epoch/actions/workflows/ci.yml) [](https://github.com/KyaniteLabs/Epoch/blob/main/LICENSE) [](https://modelcontextprotocol.io) [](https://www.npmjs.com/package/@kyanitelabs/epoch) [](https://registry.modelcontextprotocol.io/v0/servers/io.github.KyaniteLabs%2FEpoch/versions/latest)
Epoch helps AI agents understand time.
AI can write code, analyze data, and build apps -- but it can't tell you how long something will take, what it'll cost, or whether a deadline is realistic. Epoch fixes that.
Show Me
You: "How long will a 15,000 line project take with a small team?" Claude (using Epoch): COCOMO II nominal: 100 person-months (traditional team) AI-adjusted: 9 person-months (LLM-assisted workflow) Schedule risk: medium (MAPE 15%, based on 28 historical features) Cost estimate (Claude Sonnet): ~$340 in API tokens
You: "How many working days between now and launch?" Claude (using Epoch): Start: May 1, 2026 End: July 15, 2026 Business days: 54 Weekend days: 16 Holidays: 1 (Independence Day) Total calendar days: 75
89dbbfd887c2OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add epoch -- npx -y @kyanitelabs/[email protected]
Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_current_time | read | Get current time in a timezone |
pert_estimate | read | PERT three-point estimation |
reference_class_estimate | read | Reference class estimation with correction factors |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (22)
{"schema_version":1,"collector_version":2,"collected_at":"2026-09-25T16:18:37.497Z","issue":{"repo":"vuejs/core","number":14382,"state":"closed","title":"[Vapor] :style={...} attributes on SVG elementllm_time.agent.final.base.docx
llm_time.agent.final.footnote.docx
console.log(` Token calibrations: ${Object.keys(db.tokenTimeCalibration).length}`);API="http://127.0.0.1:3000/v1/tools"
API="http://127.0.0.1:3000/v1/tools"
.coderabbit.yaml
.fl4write.yaml
const docsLlms = readRepoFile("../../docs/llms.txt");const rootLlms = readRepoFile("../../llms.txt");const REPO_ROOT = fileURLToPath(new URL("../../", import.meta.url));import type { ToolError } from "../../types/index.js";import type { ToolResult } from "../../types/index.js";curl -fsS http://127.0.0.1:8420 >/dev/null && echo "Factory dashboard local OK" || echo "Factory dashboard local not reachable"
https://${EPOCH_RECEIVER_TAILNET_HOST}:3099 -> http://127.0.0.1:3099curl -fsS http://127.0.0.1:3099/health
'{"jsonrpc":"2.0","id":2,"method":"tools/list"}',@hono/node-server, @modelcontextprotocol/sdk, commander, date-fns, date-fns-tz, hono, zod, @eslint/js
@cloudflare/workers-types, typescript, vitest, wrangler
Layer 2 extends Layer 1 with calendar-aware calculations that are absent from existing time MCP servers: business-day arithmetic, holiday detection, and working-hours validation. ^73^The `workalendar`
Excerpt: "When stateless_http=True: No SSE connections, No session IDs, No sampling, No progress, No subscriptions, Plain HTTP POST -> JSON Response... Horizontal scaling works perfectly (any server i
data/eval-corpus/corpus-20260925.jsonl
Gates applied: no_behavioural_pass.
89dbbfd887c2full audit observations/trust-audit/mcp-server/kyanitelabs__epoch.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 89dbbfd887c2 | BLOCK | D | 69 | first audit |
Questions
What is the Epoch MCP server?
Time estimation MCP server for AI agents: PERT, COCOMO II, Monte Carlo, sprint forecasting, token-to-time mapping, cost estimation, and schedule risk tools.
What tools does Epoch expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Epoch safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Epoch need?
It reads GLM_AUTH_TOKEN and MINIMAX_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Epoch run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as epoch-telemetry-receiver at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (89dbbfd887c2), read on 2026-10-10. The repository is watched and re-audited when it changes.