# io.usefulapi/autumn (remote · autumn.usefulapi.io)

MCP server for Autumn — read customers, plans, balances & invoices; track usage and attach plans.

- Trust score: 72/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `autumn.usefulapi.io`: 72/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-autumn/autumn.md), [page](https://verifymcp.io/servers/io-usefulapi-autumn/autumn)

## Channel facts

- Endpoint: `https://autumn.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS not yet verified: we couldn't determine whether a plaintext access path exists.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2301 tokens (~127/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http io-usefulapi-autumn https://autumn.usefulapi.io/mcp
```

### Codex

```toml
[mcp_servers.io-usefulapi-autumn]
url = "https://autumn.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-autumn": {
      "type": "remote",
      "url": "https://autumn.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-autumn --url https://autumn.usefulapi.io/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-autumn:
    url: "https://autumn.usefulapi.io/mcp"
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-autumn": {
      "type": "http",
      "url": "https://autumn.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 71, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 68, −1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 69, +1)

- [functional improvement] Stability: unverified → 0.03

### 2026-07-27 (score 68, +56)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 12)

First indexed and scored.

## MCP tools (18)

### `get_customer` (~82 tokens)

Get a customer

Fetch a single Autumn customer by id, optionally expanding related data (invoices, entities, subscriptions, balances). Autumn API: POST /v1/customers.get.

Input parameters:

- `customer_id` (string, required): Your unique identifier for the customer.
- `expand` (array): Related data to expand, e.g. invoices, entities, subscriptions.plan, purchases.plan, balances.feature.

### `list_customers` (~157 tokens)

List customers

List/filter customers with cursor pagination. Autumn API: POST /v1/customers.list. Returns { list, next_cursor }.

Input parameters:

- `limit` (integer): Page size, 1-5000. Default 50.
- `plans` (array): Filter by plan: array of { id, versions? } objects.
- `processors` (array): Filter by processor type: stripe, revenuecat, vercel.
- `search` (string): Search customers by id, name, or email.
- `start_cursor` (string): Pagination cursor from a prior response's `next_cursor` (omit / empty for first page).
- `subscription_status` (string): Filter by status: "active" or "scheduled". Defaults to both.

### `check` (~154 tokens)

Check feature access / balance

READ-ONLY entitlement check: does a customer have access to (or enough balance of) a feature? Autumn API: POST /v1/balances.check. This tool never records usage — it does not expose send_event or lock.

Input parameters:

- `customer_id` (string, required): The ID of the customer.
- `entity_id` (string): Entity id for entity-scoped balances (e.g. per-seat limits).
- `feature_id` (string, required): The ID of the feature to check.
- `required_balance` (number): Minimum balance required for access. Returns allowed:false if below. Defaults to 1.
- `with_preview` (boolean): Include upgrade/upsell (paywall) info in the response when access is denied.

### `list_invoices` (~158 tokens)

List invoices

List invoices with cursor pagination and optional filters. Autumn API: POST /v1/invoices.list. Returns { list, next_cursor }.

Input parameters:

- `customer_id` (string): Filter to a single customer by id.
- `entity_id` (string): Filter to a single entity by id (must be paired with customer_id).
- `limit` (integer): Page size, 1-5000. Default 50.
- `processor_types` (array): Filter by processor: stripe, revenuecat.
- `start_cursor` (string): Pagination cursor from a prior response's `next_cursor` (omit / empty for first page).
- `status` (array): Filter by invoice status: draft, open, paid, void, uncollectible.

### `get_entity` (~91 tokens)

Get an entity

Fetch a single entity (e.g. a seat) belonging to a customer. Autumn API: POST /v1/entities.get.

Input parameters:

- `customer_id` (string, required): The ID of the customer that owns the entity.
- `entity_id` (string, required): The ID of the entity.
- `expand` (array): Related data to expand, e.g. invoices, entities, subscriptions.plan, purchases.plan, balances.feature.

### `list_entities` (~176 tokens)

List entities

List a customer's entities with cursor pagination and optional filters. Autumn API: POST /v1/entities.list. Returns { list, next_cursor }.

Input parameters:

- `customer_id` (string, required): Restrict the response to entities owned by this customer id.
- `limit` (integer): Page size, 1-5000. Default 50.
- `plans` (array): Filter by plan: array of { id, versions? } objects.
- `processors` (array): Filter by parent customer processor: stripe, revenuecat, vercel.
- `search` (string): Search entities by id or name.
- `start_cursor` (string): Pagination cursor from a prior response's `next_cursor` (omit / empty for first page).
- `subscription_status` (string): Filter by status: "active" or "scheduled". Defaults to both.

### `list_features` (~31 tokens)

List features

List all features in the current environment. Autumn API: POST /v1/features.list. Returns { list }.

### `get_feature` (~38 tokens)

Get a feature

Fetch a single feature by id. Autumn API: POST /v1/features.get.

Input parameters:

- `feature_id` (string, required): The ID of the feature.

### `list_plans` (~102 tokens)

List plans

List all plans (products) in the current environment. Autumn API: POST /v1/plans.list. Returns { list }.

Input parameters:

- `all_versions` (boolean): If true, include all plan versions.
- `customer_id` (string): Include eligibility info (trial availability, attach scenario) for this customer.
- `entity_id` (string): Entity id for entity-scoped plans.
- `include_archived` (boolean): If true, include archived plans.

### `get_plan` (~64 tokens)

Get a plan

Fetch a single plan by id (optionally a specific version). Autumn API: POST /v1/plans.get.

Input parameters:

- `plan_id` (string, required): The ID of the plan to retrieve.
- `version` (integer): The plan version to get. Defaults to the latest.

### `preview_attach` (~148 tokens)

Preview attaching a plan

Preview the cost/effect of attaching a plan to a customer WITHOUT charging or changing anything. Read-only. Autumn API: POST /v1/billing.preview_attach.

Input parameters:

- `customer_id` (string, required): The ID of the customer to attach the plan to.
- `customize` (object): Optional plan overrides (price, items, licenses, free trial).
- `entity_id` (string): The ID of the entity to attach the plan to.
- `feature_quantities` (array): Prepaid feature quantities: array of { feature_id, quantity?, adjustable? }.
- `plan_id` (string, required): The ID of the plan.
- `version` (integer): The version of the plan to attach.

### `autumn_request` (~111 tokens)

Raw read request

Power-user escape hatch: POST to any Autumn read/preview endpoint not wrapped by a dedicated tool. READ-ONLY — the path is validated to only allow .get / .list / .check / .preview_* actions; write actions are rejected. Autumn API: POST {path}.

Input parameters:

- `body` (object): JSON body object to POST (the endpoint's params).
- `path` (string, required): Full API path, e.g. "/v1/customers.get". Only read/preview suffixes are allowed.

### `get_or_create_customer` (~197 tokens)

Get or create a customer

MUTATES Autumn billing data — fetches a customer by id, creating them if they do not exist. Autumn API: POST /v1/customers.get_or_create.

Input parameters:

- `create_in_stripe` (boolean): Whether to create the customer in Stripe.
- `currency` (string): Currency to bill this customer in (e.g. usd, eur).
- `customer_id` (required): Your unique identifier for the customer (null to create an anonymous customer).
- `email` (string): Customer's email address.
- `expand` (array): Related data to expand, e.g. invoices, entities, subscriptions.plan, purchases.plan, balances.feature.
- `fingerprint` (string): Unique identifier to detect duplicate customers / prevent free-trial abuse.
- `metadata` (object): Arbitrary key/value metadata for the customer.
- `name` (string): Customer's name.
- `stripe_id` (string): Existing Stripe customer id, if any.

### `update_customer` (~129 tokens)

Update a customer

MUTATES Autumn billing data — partially updates a customer. Only provided fields change. Autumn API: POST /v1/customers.update.

Input parameters:

- `currency`: Currency to bill this customer in (e.g. usd, eur).
- `customer_id` (string, required): ID of the customer to update.
- `email`: Customer's email address.
- `fingerprint`: Duplicate-detection fingerprint.
- `metadata`: Arbitrary key/value metadata for the customer.
- `name`: Customer's name.
- `new_customer_id` (string): New id for the customer.
- `stripe_id`: Stripe customer id.

### `track_usage` (~192 tokens)

Track usage

MUTATES Autumn billing data — records a usage event (deducts/credits a feature balance). Provide EITHER feature_id OR event_name. Autumn API: POST /v1/balances.track.

Input parameters:

- `customer_id` (string, required): The ID of the customer.
- `entity_id` (string): Entity id for entity-scoped balances.
- `event_name` (string): Event name to track usage for. Provide this OR feature_id.
- `feature_id` (string): The feature to track usage for. Provide this OR event_name.
- `idempotencyKey` (string): Optional key to dedupe retried events.
- `properties` (object): Additional properties to attach to the usage event.
- `timestamp` (integer): Unix timestamp (ms) for the event. Defaults to now.
- `value` (number): Amount of usage to record. Defaults to 1. Negative values credit the balance.

### `attach_plan` (~242 tokens)

Attach a plan

MUTATES Autumn billing data — attaches (subscribes) a plan to a customer; may create an invoice / return a payment URL. Autumn API: POST /v1/billing.attach. Returns { customer_id, invoice, payment_url, required_action }.

Input parameters:

- `checkout_session_params` (object): Extra Stripe checkout session params (can carry metadata).
- `customer_id` (string, required): The ID of the customer to attach the plan to.
- `customize` (object): Optional plan overrides (price, items, licenses, free trial).
- `entity_id` (string): The ID of the entity to attach the plan to.
- `feature_quantities` (array): Prepaid feature quantities: array of { feature_id, quantity?, adjustable? }.
- `invoice_mode` (object): Invoice-mode configuration object (send an invoice instead of auto-charging).
- `plan_id` (string, required): The ID of the plan.
- `redirect_mode` (string): Checkout redirect mode: always, if_required, or never.
- `success_url` (string): URL to redirect to after a successful checkout.
- `version` (integer): The version of the plan to attach.

### `create_entity` (~122 tokens)

Create an entity

MUTATES Autumn billing data — creates an entity (e.g. a seat) under a customer, tied to a feature. Autumn API: POST /v1/entities.create.

Input parameters:

- `billing_controls` (object): Optional billing controls for the entity (spend/usage limits).
- `customer_id` (string, required): The ID of the customer to create the entity for.
- `entity_id` (string, required): The ID of the entity.
- `feature_id` (string, required): The ID of the feature this entity is associated with.
- `name`: The name of the entity.

### `open_customer_portal` (~107 tokens)

Open customer billing portal

MUTATES Autumn billing data — creates a Stripe billing-portal session for a customer to manage their subscription. Autumn API: POST /v1/billing.open_customer_portal. Returns { customer_id, url }.

Input parameters:

- `configuration_id` (string): Stripe billing-portal configuration id.
- `customer_id` (string, required): The ID of the customer to open the billing portal for.
- `return_url` (string): URL to redirect to when the back button is clicked in the portal.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-autumn/autumn#diagnostics

## Score history

- 2026-08-03: 72
- 2026-08-02: 72
- 2026-08-01: 71
- 2026-07-31: 71
- 2026-07-30: 68
- 2026-07-29: 69
- 2026-07-28: 69
- 2026-07-27: 68
- 2026-07-26: 12

## Links

- Remote endpoint: https://autumn.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-autumn/autumn/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-autumn/autumn/changelog.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-autumn/autumn