Review Unbilled Harvest Time Entries With VS Code Copilot

The safest first Harvest workflow in VS Code Copilot is not editing a timesheet or creating an invoice. It is a bounded review: list a small page of Harvest projects, let a person select one project, retrieve only stopped and unbilled time entries for one explicit date range, and turn that result into an exception table for approval.

That gives the operator a useful output without changing Harvest data. It also creates a clear success condition: the review covers the selected project and dates, every returned entry is accounted for once, and no time entry, project, client, invoice, or user record changes.

This guide uses Aident Loadout as the connection and Action layer between Copilot and Harvest. The exact Harvest Actions and input schemas were inspected in the live Aident staging catalog on September 11, 2026. Rediscover them before use because integration contracts can change.

The two-step review

The current catalog exposed separate project-list and time-entry-list Actions. Both had risk level 2 and both were conservatively classified as writes by the wrapper metadata even though their descriptions are retrieval-oriented. Treat the current Action and exact input as the approval boundary. Do not authorize every Harvest Action because these two requests are read-oriented.

What you need

You need:

• VS Code with Copilot agent tools enabled;

• the installed public aident CLI;

• the intended Aident account;

• one Harvest account connected in Aident Vault;

• permission to review the selected project's time data;

• an explicit start date and end date; and

• a person who can confirm the project and review exceptions.

VS Code documents that MCP servers can extend agents with external tools and that users can enable only the tools relevant to a request. It also warns against hardcoding API keys in MCP configuration. Keep the Harvest credential in Vault rather than pasting it into .vscode/mcp.json, a prompt, a shell command, or the repository.

Install or update Loadout from the canonical setup guide:

Follow https://aident.ai/SETUP.md

Then confirm identity and connection state:

aident account auth status
aident vault vault --action status

Stop if the signed-in Aident account or Harvest connection is not the intended one. A ready connection proves a credential is available. It does not prove that this operator may inspect every client, project, user, or time entry.

1. Find the current project-list Action

Search by the job instead of copying an old Action name:

aident capabilities search \
  --targetEnv staging \
  --types '["action"]' \
  --query "Harvest list projects page one for a human to select before a time review" \
  --limit 5

Copy the exact public Action name from the result and inspect its current schema:

aident capabilities get \
  --name "<current Harvest project-list Action>"

The September 11 schema accepted page, per_page, an optional client filter, and an optional updated-since timestamp. It limited per_page to 100. The first request should be smaller:

aident capabilities preflight \
  --name "<current Harvest project-list Action>" \
  --input '{"page":1,"per_page":20}'

That exact input passed schema validation and returned a free Aident quote during this review. Preflight did not contact Harvest or prove access to a real project.

After reviewing the displayed Action and input, execute the same request:

aident capabilities execute \
  --name "<current Harvest project-list Action>" \
  --input '{"page":1,"per_page":20}'

Present the returned project name, project ID, client name when available, and active or completed state. Ask the person to select one project ID. Do not choose based only on a similar display name, and do not automatically request every page.

If the correct project is not on page 1, show the pagination state and ask before fetching the next page. Bounded discovery prevents a simple review from becoming an account-wide export.

2. Inspect the current time-entry Action

Search for the second job:

aident capabilities search \
  --targetEnv staging \
  --types '["action"]' \
  --query "Harvest list stopped unbilled time entries for one project and date range" \
  --limit 5

Inspect the exact result:

aident capabilities get \
  --name "<current Harvest time-entry-list Action>"

The reviewed Aident schema supported project, user, client, and task filters; start and end dates; billed and running-state filters; pagination; and an update timestamp. Its input field for the start date was from_date, while Harvest's direct API documentation names the underlying query parameter from. Use the schema returned by your current Aident Action. Do not rename fields from provider documentation when constructing an Aident input.

Harvest documents that the direct time-entry endpoint can filter by project, user, client, task, start date, end date, billed state, running state, page, and page size. It can return up to 2,000 records per page. A technical maximum is not the right first-review size.

3. Set the exact review boundary

Record these five values before preflight:

1. the connected Harvest account;

2. the human-selected project ID;

3. the inclusive start date;

4. the inclusive end date; and

5. the maximum number of entries to retrieve.

For the first run, use seven calendar dates and at most 100 entries. Exclude running timers and billed entries so the review cannot mix unfinished work or already invoiced time into the candidate set.

This placeholder shows the shape:

{
  "project_id": 123456,
  "from_date": "2026-09-01",
  "to": "2026-09-07",
  "is_billed": false,
  "is_running": false,
  "page": 1,
  "per_page": 100
}

Replace 123456 only with the approved project ID. Change the dates to the approved review window. If any field changes after preflight, run preflight again.

4. Preflight before reading private time data

Preflight the exact input:

aident capabilities preflight \
  --name "<current Harvest time-entry-list Action>" \
  --input '{"project_id":123456,"from_date":"2026-09-01","to":"2026-09-07","is_billed":false,"is_running":false,"page":1,"per_page":100}'

This placeholder input passed schema validation and returned a free Aident quote on September 11. No Harvest Action was executed because the research account had no connected Harvest account. The article therefore verifies the current schema and safe request shape, not the contents of a real timesheet.

Cost approval and data approval are separate. A free read can still expose names, clients, task descriptions, notes, rates, and commercially sensitive work patterns. Confirm that the reviewer may see the selected project's returned fields before execution.

5. Execute once and shape a review table

After approval, execute the identical input:

aident capabilities execute \
  --name "<current Harvest time-entry-list Action>" \
  --input '{"project_id":123456,"from_date":"2026-09-01","to":"2026-09-07","is_billed":false,"is_running":false,"page":1,"per_page":100}'

Do not paste the raw response into a public issue, pull request, or shared prompt. Reduce it to the fields needed for review:

Use the returned data to calculate the page's total hours and count. Keep the original time-entry ID in a private working record so a reviewer can identify the source entry, but do not expose IDs or notes in the public summary.

Flag an entry for review rather than modifying it when:

• its duration is zero or unexpectedly large;

• its notes are absent when the team's policy requires them;

• the same person, date, task, duration, and note appear more than once;

• the task does not match the selected project; or

• the returned billed or running state conflicts with the requested filter.

An exception is a question, not a correction. Stop after preparing the table.

6. Verify completeness without expanding scope

The first review succeeds when:

• the response identifies the approved project and date range;

• every returned entry appears exactly once in the review table;

• the table count and summed hours match the returned page;

• every entry is stopped and unbilled;

• pagination is reported explicitly; and

• no Harvest object changes.

If the response indicates another page, report that the review is partial. Ask before retrieving page 2. Do not silently increase per_page to 2,000 or remove the project and date filters.

Keep a compact acceptance record:

A prompt you can give VS Code Copilot

Follow https://aident.ai/SETUP.md

Use the installed public aident CLI. Confirm the current Aident account and
Vault status. Search the staging catalog for the current Harvest Action that
lists projects. Inspect its schema and preflight page 1 with at most 20
projects. Do not execute until I approve the exact Action and input.

After execution, show only the fields needed for me to select one project.
Then search for the current Harvest Action that lists time entries. Inspect its
schema and prepare an input for the selected project, my explicit seven-day
window, stopped timers only, unbilled entries only, page 1, and at most 100
entries. Preflight the exact input and wait for my approval before execution.

If approved, execute once and return a review table with date, person, task,
hours, whether notes are present, and a reason for any exception. Verify the
row count and total hours against the response. Report pagination. Stop before
creating, updating, deleting, billing, invoicing, starting, or stopping
anything. Never reveal Harvest credentials or unrelated private fields

Common failures

The Harvest connection is missing

Return to Vault and connect the intended account. Do not paste a Harvest access token into the prompt as a shortcut. After connection, repeat account and Vault checks before using any Action.

The search returns several similar Actions

Choose by the current description and input schema. The project-list Action should support bounded pagination. The time-entry-list Action should expose the project, date, billed-state, and running-state filters. Do not choose create, update, delete, invoice, or timer Actions because their names are nearby.

The project is not on page 1

Show the page count or next-page state and ask whether to fetch page 2. Do not remove the page limit or search the entire account without approval.

The result includes a running or billed entry

Stop and preserve the exact request and receipt. Confirm the current schema and returned field meaning before relying on the result. Do not "fix" the unexpected entry with an update Action.

The result is empty

An empty result may mean there are no matching entries, the wrong project was selected, the dates are wrong, or the account lacks access. Reconfirm those boundaries. Do not broaden the query automatically.

Copilot proposes an edit after finding an exception

Return the recommendation to the reviewer. Listing time for review does not authorize changing hours, notes, project assignment, billing state, or invoices. A correction needs a separate exact Action, payload, approval, and read-back plan.

Why this workflow is safe to expand later

The sequence separates discovery, selection, data retrieval, judgment, and mutation. Copilot can help structure the review, but a human chooses the project and approves the private-data boundary. Aident exposes the current Action schema and preflight result before execution. Harvest remains the system of record.

Once the read-only review is reliable, a team can design a separate correction workflow. That later workflow should approve one entry and one consequence at a time, prevent duplicate writes, and read the changed entry back before authorizing another change. Do not bundle it into the first connection test.

Review one Harvest project before invoicing

Connect Harvest through Aident Loadout and review one bounded project. For the general execution loop, continue with How to Use Aident Loadout. Use the risk-versus-spend approval workflow when a free Action still exposes private data, and see the Typeform-to-Copilot setup for another bounded first-connection pattern.

Sources

• Harvest API V2 time entries, reviewed September 11, 2026.

• Harvest API V2 time reports, reviewed September 11, 2026.

• Add and manage MCP servers in VS Code, reviewed September 11, 2026.

• Use tools with agents in VS Code, reviewed September 11, 2026.

• Aident Loadout setup, reviewed September 11, 2026.

• Live Aident Loadout staging capability catalog and two exact-free preflights, inspected September 11, 2026.

Refresh this guide when Harvest changes its project, time-entry, pagination, or authentication contract; when VS Code changes Copilot tool configuration; or when Aident changes the Harvest Action names, schemas, operation metadata, risk, connection flow, pricing, or approval behavior.