Autumn MCP by usefulapi
REMOTE · AUTUMN.USEFULAPI.IO
MCP server for Autumn — read customers, plans, balances & invoices; track usage and attach plans.
Available components
Last scanned (2 hours ago)
Scores higher than 4% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Finance and Payments
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security46
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not yet verified: we couldn't confirm whether this endpoint requires it. View diagnostics → Unverified
- HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability0
- Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Tool Safety0
- Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Capabilities0
- Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 1 Nov 26 −47
- Endpoint reachability: reachable → not serving MCP ▼ security
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: pass → unverified ▼ security
- Schema quality: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 31 Oct 26 +2
- Authorization: partial → pass ▲ security
- MCP protocol: fail → pass ▲ functional
- New prompt “check_if_a_customer_can_use_a_feature” functional
- New prompt “compare_your_plans_and_the_features_they_include” functional
- New prompt “list_customers_and_the_plan_each_one_is_on” functional
- New prompt “preview_a_plan_change_then_attach_the_plan” functional
- New prompt “review_recent_invoices_and_who_they_went_to” functional
- MCP protocol version: 2025-06-18 → 2025-11-25 functional
- Server version: 1.32.0 → 1.34.0 functional
- Server version: 1.31.0 → 1.32.0 functional
- Server version: 1.30.2 → 1.31.0 functional
- 30 Oct 26 0
- Server version: 1.30.1 → 1.30.2 functional
- Server version: 1.30.0 → 1.30.1 functional
- 29 Oct 26 0
- Server version: 1.29.0 → 1.30.0 functional
- Server version: 1.28.0 → 1.29.0 functional
- 28 Oct 26 0
- Server version: 1.26.0 → 1.28.0 functional
- 27 Oct 26 0
- Server version: 1.25.0 → 1.26.0 functional
- 25 Oct 26 0
- Server version: 1.24.0 → 1.25.0 functional
- Server version: 1.23.0 → 1.24.0 functional
- Server version: 1.22.3 → 1.23.0 functional
- Server version: 1.22.1 → 1.22.3 functional
- Server version: 1.22.0 → 1.22.1 functional
- 24 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Server version: 1.21.0 → 1.22.0 functional
- Server version: 1.20.0 → 1.21.0 functional
- Server version: 1.18.0 → 1.20.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://autumn.usefulapi.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=usefulapi.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | d9be3287b0fde9630e825ba1f79bff3f |
| SANs: usefulapi.io, *.usefulapi.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of autumn.usefulapi.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 38690 | 8 | Verified |
| usefulapi.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Inconclusive
We could not reach the endpoint well enough to judge its authorisation posture.
| Result | Inconclusive |
|---|---|
| HTTP status | 302 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://autumn.usefulapi.io/mcp | Redirected | 302 | https://usefulapi.io/autumn/ |
| http (plaintext) | http://autumn.usefulapi.io/mcp | Inconclusive | 302 | http://autumn.usefulapi.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
autumn_attach_plan Attach a plan ~243
MUTATES Autumn billing data — attaches (subscribes) a plan to a customer; may create an invoice / return a payment URL. Autumn API: POST /v1/billing.attach. Returns { customer_id, invoice, payment_url, required_action }.
| Name | Type | Req | Description |
|---|---|---|---|
| checkout_session_params | object | – | Extra Stripe checkout session params (can carry metadata). |
| customer_id | string | yes | The ID of the customer to attach the plan to. |
| customize | object | – | Optional plan overrides (price, items, licenses, free trial). |
| entity_id | string | – | The ID of the entity to attach the plan to. |
| feature_quantities | array | – | Prepaid feature quantities: array of { feature_id, quantity?, adjustable? }. |
| invoice_mode | object | – | Invoice-mode configuration object (send an invoice instead of auto-charging). |
| plan_id | string | yes | The ID of the plan. |
| redirect_mode | string | – | Checkout redirect mode: always, if_required, or never. |
| success_url | string | – | URL to redirect to after a successful checkout. |
| version | integer | – | The version of the plan to attach. |
No output schema declared.
No examples provided.
autumn_check Check feature access / balance ~155
READ-ONLY entitlement check: does a customer have access to (or enough balance of) a feature? Autumn API: POST /v1/balances.check. This tool never records usage — it does not expose send_event or lock.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | The ID of the customer. |
| entity_id | string | – | Entity id for entity-scoped balances (e.g. per-seat limits). |
| feature_id | string | yes | The ID of the feature to check. |
| required_balance | number | – | Minimum balance required for access. Returns allowed:false if below. Defaults to 1. |
| with_preview | boolean | – | Include upgrade/upsell (paywall) info in the response when access is denied. |
No output schema declared.
No examples provided.
autumn_create_entity Create an entity ~126
MUTATES Autumn billing data — creates an entity (e.g. a seat) under a customer, tied to a feature. Autumn API: POST /v1/entities.create.
| Name | Type | Req | Description |
|---|---|---|---|
| billing_controls | object | – | Optional billing controls for the entity (spend/usage limits). |
| customer_id | string | yes | The ID of the customer to create the entity for. |
| entity_id | string | yes | The ID of the entity. |
| feature_id | string | yes | The ID of the feature this entity is associated with. |
| name | string|null | – | The name of the entity. |
No output schema declared.
No examples provided.
autumn_get_customer Get a customer ~83
Fetch a single Autumn customer by id, optionally expanding related data (invoices, entities, subscriptions, balances). Autumn API: POST /v1/customers.get.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Your unique identifier for the customer. |
| expand | array | – | Related data to expand, e.g. invoices, entities, subscriptions.plan, purchases.plan, balances.feature. |
No output schema declared.
No examples provided.
autumn_get_entity Get an entity ~92
Fetch a single entity (e.g. a seat) belonging to a customer. Autumn API: POST /v1/entities.get.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | The ID of the customer that owns the entity. |
| entity_id | string | yes | The ID of the entity. |
| expand | array | – | Related data to expand, e.g. invoices, entities, subscriptions.plan, purchases.plan, balances.feature. |
No output schema declared.
No examples provided.
autumn_get_feature Get a feature ~39
Fetch a single feature by id. Autumn API: POST /v1/features.get.
| Name | Type | Req | Description |
|---|---|---|---|
| feature_id | string | yes | The ID of the feature. |
No output schema declared.
No examples provided.
autumn_get_or_create_customer Get or create a customer ~201
MUTATES Autumn billing data — fetches a customer by id, creating them if they do not exist. Autumn API: POST /v1/customers.get_or_create.
| Name | Type | Req | Description |
|---|---|---|---|
| create_in_stripe | boolean | – | Whether to create the customer in Stripe. |
| currency | string | – | Currency to bill this customer in (e.g. usd, eur). |
| customer_id | string|null | yes | Your unique identifier for the customer (null to create an anonymous customer). |
| string | – | Customer's email address. | |
| expand | array | – | Related data to expand, e.g. invoices, entities, subscriptions.plan, purchases.plan, balances.feature. |
| fingerprint | string | – | Unique identifier to detect duplicate customers / prevent free-trial abuse. |
| metadata | object | – | Arbitrary key/value metadata for the customer. |
| name | string | – | Customer's name. |
| stripe_id | string | – | Existing Stripe customer id, if any. |
No output schema declared.
No examples provided.
autumn_get_plan Get a plan ~65
Fetch a single plan by id (optionally a specific version). Autumn API: POST /v1/plans.get.
| Name | Type | Req | Description |
|---|---|---|---|
| plan_id | string | yes | The ID of the plan to retrieve. |
| version | integer | – | The plan version to get. Defaults to the latest. |
No output schema declared.
No examples provided.
autumn_list_customers List customers ~158
List/filter customers with cursor pagination. Autumn API: POST /v1/customers.list. Returns { list, next_cursor }.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size, 1-5000. Default 50. |
| plans | array | – | Filter by plan: array of { id, versions? } objects. |
| processors | array | – | Filter by processor type: stripe, revenuecat, vercel. |
| search | string | – | Search customers by id, name, or email. |
| start_cursor | string | – | Pagination cursor from a prior response's `next_cursor` (omit / empty for first page). |
| subscription_status | string | – | Filter by status: "active" or "scheduled". Defaults to both. |
No output schema declared.
No examples provided.
autumn_list_entities List entities ~177
List a customer's entities with cursor pagination and optional filters. Autumn API: POST /v1/entities.list. Returns { list, next_cursor }.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | Restrict the response to entities owned by this customer id. |
| limit | integer | – | Page size, 1-5000. Default 50. |
| plans | array | – | Filter by plan: array of { id, versions? } objects. |
| processors | array | – | Filter by parent customer processor: stripe, revenuecat, vercel. |
| search | string | – | Search entities by id or name. |
| start_cursor | string | – | Pagination cursor from a prior response's `next_cursor` (omit / empty for first page). |
| subscription_status | string | – | Filter by status: "active" or "scheduled". Defaults to both. |
No output schema declared.
No examples provided.
autumn_list_features List features ~32
List all features in the current environment. Autumn API: POST /v1/features.list. Returns { list }.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
autumn_list_invoices List invoices ~159
List invoices with cursor pagination and optional filters. Autumn API: POST /v1/invoices.list. Returns { list, next_cursor }.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Filter to a single customer by id. |
| entity_id | string | – | Filter to a single entity by id (must be paired with customer_id). |
| limit | integer | – | Page size, 1-5000. Default 50. |
| processor_types | array | – | Filter by processor: stripe, revenuecat. |
| start_cursor | string | – | Pagination cursor from a prior response's `next_cursor` (omit / empty for first page). |
| status | array | – | Filter by invoice status: draft, open, paid, void, uncollectible. |
No output schema declared.
No examples provided.
autumn_list_plans List plans ~103
List all plans (products) in the current environment. Autumn API: POST /v1/plans.list. Returns { list }.
| Name | Type | Req | Description |
|---|---|---|---|
| all_versions | boolean | – | If true, include all plan versions. |
| customer_id | string | – | Include eligibility info (trial availability, attach scenario) for this customer. |
| entity_id | string | – | Entity id for entity-scoped plans. |
| include_archived | boolean | – | If true, include archived plans. |
No output schema declared.
No examples provided.
autumn_open_customer_portal Open customer billing portal ~108
MUTATES Autumn billing data — creates a Stripe billing-portal session for a customer to manage their subscription. Autumn API: POST /v1/billing.open_customer_portal. Returns { customer_id, url }.
| Name | Type | Req | Description |
|---|---|---|---|
| configuration_id | string | – | Stripe billing-portal configuration id. |
| customer_id | string | yes | The ID of the customer to open the billing portal for. |
| return_url | string | – | URL to redirect to when the back button is clicked in the portal. |
No output schema declared.
No examples provided.
autumn_preview_attach Preview attaching a plan ~149
Preview the cost/effect of attaching a plan to a customer WITHOUT charging or changing anything. Read-only. Autumn API: POST /v1/billing.preview_attach.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | The ID of the customer to attach the plan to. |
| customize | object | – | Optional plan overrides (price, items, licenses, free trial). |
| entity_id | string | – | The ID of the entity to attach the plan to. |
| feature_quantities | array | – | Prepaid feature quantities: array of { feature_id, quantity?, adjustable? }. |
| plan_id | string | yes | The ID of the plan. |
| version | integer | – | The version of the plan to attach. |
No output schema declared.
No examples provided.
autumn_request Raw read request ~111
Power-user escape hatch: POST to any Autumn read/preview endpoint not wrapped by a dedicated tool. READ-ONLY — the path is validated to only allow .get / .list / .check / .preview_* actions; write actions are rejected. Autumn API: POST {path}.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | – | JSON body object to POST (the endpoint's params). |
| path | string | yes | Full API path, e.g. "/v1/customers.get". Only read/preview suffixes are allowed. |
No output schema declared.
No examples provided.
autumn_track_usage Track usage ~193
MUTATES Autumn billing data — records a usage event (deducts/credits a feature balance). Provide EITHER feature_id OR event_name. Autumn API: POST /v1/balances.track.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | The ID of the customer. |
| entity_id | string | – | Entity id for entity-scoped balances. |
| event_name | string | – | Event name to track usage for. Provide this OR feature_id. |
| feature_id | string | – | The feature to track usage for. Provide this OR event_name. |
| idempotencyKey | string | – | Optional key to dedupe retried events. |
| properties | object | – | Additional properties to attach to the usage event. |
| timestamp | integer | – | Unix timestamp (ms) for the event. Defaults to now. |
| value | number | – | Amount of usage to record. Defaults to 1. Negative values credit the balance. |
No output schema declared.
No examples provided.
autumn_update_customer Update a customer ~145
MUTATES Autumn billing data — partially updates a customer. Only provided fields change. Autumn API: POST /v1/customers.update.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string|null | – | Currency to bill this customer in (e.g. usd, eur). |
| customer_id | string | yes | ID of the customer to update. |
| string|null | – | Customer's email address. | |
| fingerprint | string|null | – | Duplicate-detection fingerprint. |
| metadata | – | – | Arbitrary key/value metadata for the customer. |
| name | string|null | – | Customer's name. |
| new_customer_id | string | – | New id for the customer. |
| stripe_id | string|null | – | Stripe customer id. |
No output schema declared.
No examples provided.
How do I install the Autumn MCP by usefulapi server?
Autumn MCP by usefulapi is a hosted endpoint at https://autumn.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · autumn.usefulapi.io
claude mcp add --transport http io-usefulapi-autumn 'https://autumn.usefulapi.io/mcp'
What is the Autumn MCP by usefulapi server?
Autumn MCP by usefulapi is listed in the public MCP registry as io.usefulapi/autumn. MCP server for Autumn, read customers, plans, balances & invoices; track usage and attach plans. This page covers its hosted endpoint (https://autumn.usefulapi.io/mcp).
Is the Autumn MCP by usefulapi server safe to use?
Autumn MCP by usefulapi scores 18 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Autumn MCP by usefulapi server expose?
Autumn MCP by usefulapi exposes 18 tools: autumn_get_customer, autumn_list_customers, autumn_check, autumn_list_invoices, autumn_get_entity, and 13 more. Their descriptions and schemas cost roughly 2,339 tokens of context every time the server is loaded.
Does the Autumn MCP by usefulapi server require authentication?
Its publisher declares no required credentials for Autumn MCP by usefulapi. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.
Is the Autumn MCP by usefulapi server still maintained?
Autumn MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.