Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

CiviCRM MCP by usefulapi

REMOTE · CIVICRM.USEFULAPI.IO

Work with your own CiviCRM: contacts, contributions, memberships, events; log activities.

62 Trust /100

Last scanned (1 hour ago)

Scores higher than 46% of remote servers

Reachable. Last reached 25 Oct 2026.

Category CRM and Sales

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security78
Transport & Reachability0
Schema Quality & AI Usability79
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3978 tokens (~165/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
  • Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 90% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 24 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 25 Oct 26 0
    • Stability: unverified → 0.03 ▲ functional
    • Server version: 1.1.0 → 1.1.3 functional
  • 24 Oct 26 62

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 25 Oct 2026 · Probed https://civicrm.usefulapi.io/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=usefulapi.io CN=WE1,O=Google Trust Services,C=US 13 Sept 2026 12 Dec 2026 ECDSA 256 ECDSA-SHA256 d9be3287b0fde9630e825ba1f79bff3f
SANs: usefulapi.io, *.usefulapi.io
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of civicrm.usefulapi.io. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
io. present 38690, 57355 8, 8 Verified
usefulapi.io. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 302

WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://civicrm.usefulapi.io/.well-known/oauth-protected-resource/mcp"

Bearer realm="OAuth", resource_metadata="https://civicrm.usefulapi.io/.well-known/oauth-protected-resource/mcp"

Protected resource metadata

Document https://civicrm.usefulapi.io/.well-known/oauth-protected-resource/mcp
Retrieved Yes
Resource https://civicrm.usefulapi.io/mcp
Authorisation server https://civicrm.usefulapi.io

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://civicrm.usefulapi.io/mcp Redirected 302 https://usefulapi.io/civicrm/
http (plaintext) http://civicrm.usefulapi.io/mcp Inconclusive 302 http://civicrm.usefulapi.io/mcp
MCP tools · 24 exposed · ~3,718 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
civicrm_add_contact_note ~78

WRITE: adds ONE note to a contact's record, written by the contact this API key belongs to. Sends nothing. APIv4 Note.create.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id the note is about.
notestringyesThe note text.
subjectstring–Optional subject line.

No output schema declared.

No examples provided.

civicrm_add_contact_to_group ~126

WRITE: adds ONE contact to ONE static group. If the group is used as a mailing list, the contact will receive future mailings sent to it, so only add people who agreed. Sends nothing by itself. Adding a contact who is already in the group changes nothing; a contact who was removed from it (or is pending) is set back to Added. APIv4 GroupContact.save matched on group and contact.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id.
group_idintegeryesGroup id (from civicrm_list_groups).

No output schema declared.

No examples provided.

civicrm_create_contact ~181

WRITE: creates ONE new contact (an individual, organization or household) and optionally its first e-mail address and phone number. Does not check for duplicates: search first with civicrm_search_contacts. Sends nothing. APIv4 Contact.create, Email.create, Phone.create.

NameTypeReqDescription
contact_typestringyesIndividual, Organization or Household.
emailstring–First e-mail address (stored as the primary one).
first_namestring–Individual: first name.
household_namestring–Household: its name.
job_titlestring––
last_namestring–Individual: last name.
organization_namestring–Organization: its name.
phonestring–First phone number (stored as the primary one).
sourcestring–Where this contact came from (free text).

No output schema declared.

No examples provided.

civicrm_create_membership ~168

WRITE: gives ONE contact a membership of a type. CiviCRM works out the dates and status from the type unless you give dates. It does NOT record a payment (use civicrm_record_contribution for that) and sends nothing. APIv4 Membership.create.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id.
end_datestring–End date (default: calculated by the type).
join_datestring–Join date (default today).
membership_typestringyesMembership type by name, e.g. General (see civicrm_get_fields Membership, field membership_type_id).
sourcestring–Where it came from (free text).
start_datestring–Start date (default: calculated by the type).

No output schema declared.

No examples provided.

civicrm_get_contact ~88

One contact by id: name, type, job title, source, communication preferences (do not e-mail, opted out, ...), dates, plus all their e-mail addresses, phone numbers and postal addresses. APIv4 Contact.get, Email.get, Phone.get, Address.get.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id (the cid in the contact's URL).

No output schema declared.

No examples provided.

civicrm_get_fields ~137

The fields of one CiviCRM entity (Contact, Contribution, Event, ...) including custom fields: name, label, data type, whether required, and the allowed options for a pick-list field. Use it to find the right field names for civicrm_query and the right option names for the filters and write tools. APIv4 <Entity>.getFields.

NameTypeReqDescription
actionstring–The action the fields are for (default get).
entitystringyesAPIv4 entity name, e.g. Contact.
fieldstring–Only this field, with its options (e.g. contribution_status_id).

No output schema declared.

No examples provided.

civicrm_list_activities ~225

Activities (meetings, phone calls, e-mails, follow-ups, ...) with type, subject, status, date and details, newest first. With contact_id: the activities that contact took part in, with their role (source, target or assignee). Otherwise all activities, optionally of one type or status. APIv4 ActivityContact.get / Activity.get.

NameTypeReqDescription
activity_typestring–Only this activity type by name, e.g. Meeting, Phone Call, Email, Follow up.
contact_idinteger–Only activities this contact is involved in.
date_fromstring–On or after this date.
date_tostring–On or before this date (a plain date includes that whole day).
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
statusstring–Only this status by name, e.g. Scheduled, Completed, Cancelled.

No output schema declared.

No examples provided.

civicrm_list_cases ~145

Cases (CiviCase) with subject, case type, status and dates. With contact_id: the cases that contact is a client of. Needs the CiviCase component to be enabled. APIv4 CaseContact.get / Case.get.

NameTypeReqDescription
contact_idinteger–Only cases of this client contact.
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
statusstring–Only this case status by name, e.g. Open, Resolved. Applied when no contact_id is given.

No output schema declared.

No examples provided.

civicrm_list_contact_notes ~93

The notes recorded on one contact (subject, text, who wrote it, when), newest first. APIv4 Note.get.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id.
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.

No output schema declared.

No examples provided.

civicrm_list_contributions ~231

Contributions (donations, membership dues, event fees) with contact, amount, currency, financial type, status, payment method, date and source, newest first. Filter by contact, status, financial type, date range and minimum amount. Test contributions are left out. APIv4 Contribution.get.

NameTypeReqDescription
contact_idinteger–Only this contact's contributions.
date_fromstring–Received on or after this date.
date_tostring–Received on or before this date (a plain date includes that whole day).
financial_typestring–Only this financial type by name, e.g. Donation, Member Dues, Event Fee.
limitinteger–Records per call, 1-100 (default 25).
min_amountnumber–Only contributions of at least this amount.
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
statusstring–Only this status by name, e.g. Completed, Pending, Failed, Cancelled, Refunded.

No output schema declared.

No examples provided.

civicrm_list_entities ~74

The APIv4 entities this CiviCRM site offers (Contact, Contribution, Event, plus those of installed extensions), with a short description. Use the names with civicrm_get_fields and civicrm_query. APIv4 Entity.get.

NameTypeReqDescription
searchstring–Only entities whose name or title contains this text.

No output schema declared.

No examples provided.

civicrm_list_events ~144

Events with title, type, start and end date, whether active and public, maximum participants and summary. Upcoming events first when upcoming_only is set. Template events are left out. APIv4 Event.get.

NameTypeReqDescription
active_onlyboolean–Only active events (default true).
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
titlestring–Only events whose title contains this text.
upcoming_onlyboolean–Only events that have not ended yet (start date today or later).

No output schema declared.

No examples provided.

civicrm_list_group_contacts ~145

The members of one static group (or the groups one contact belongs to): contact, group and membership status (Added, Removed, Pending). Smart groups are computed by CiviCRM and not listed here. APIv4 GroupContact.get.

NameTypeReqDescription
contact_idinteger–The groups of this contact.
group_idinteger–Members of this group (from civicrm_list_groups).
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
statusstring–Membership status (default Added).

No output schema declared.

No examples provided.

civicrm_list_groups ~109

Contact groups (mailing lists, static groups, smart groups) with title, description, visibility and type. APIv4 Group.get.

NameTypeReqDescription
active_onlyboolean–Only active groups (default true).
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
titlestring–Only groups whose title contains this text.

No output schema declared.

No examples provided.

civicrm_list_memberships ~205

Memberships with contact, membership type, status (New, Current, Grace, Expired, ...), join, start and end date. Filter by contact, status, type, or those ending before a date (renewal follow-up). Test memberships are left out. APIv4 Membership.get.

NameTypeReqDescription
contact_idinteger–Only this contact's memberships.
ends_afterstring–Only memberships that end on or after this date.
ends_beforestring–Only memberships that end on or before this date.
limitinteger–Records per call, 1-100 (default 25).
membership_typestring–Only this membership type by name, e.g. General.
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
statusstring–Only this status by name, e.g. Current, Grace, Expired, Cancelled.

No output schema declared.

No examples provided.

civicrm_list_participants ~150

Event registrations with event, contact, status (Registered, Attended, Cancelled, ...), role, registration date and fee. Filter by event, contact or status. Test registrations are left out. APIv4 Participant.get.

NameTypeReqDescription
contact_idinteger–Only this contact's registrations.
event_idinteger–Only this event's participants.
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
statusstring–Only this participant status by name, e.g. Registered, Attended, Cancelled.

No output schema declared.

No examples provided.

civicrm_list_relationships ~118

The relationships of one contact (employee of, spouse of, volunteer for, ...) with the other contact, start and end date and whether it is active. APIv4 Relationship.get.

NameTypeReqDescription
active_onlyboolean–Only active relationships (default true).
contact_idintegeryesCiviCRM contact id.
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.

No output schema declared.

No examples provided.

civicrm_log_activity ~225

WRITE: records ONE activity (a meeting, phone call, e-mail, follow-up, ...) with one or more contacts. It only STORES the record: an activity of type Email does not send an e-mail. Added by the contact this API key belongs to unless source_contact_id is given. APIv4 Activity.create.

NameTypeReqDescription
activity_date_timestring–When it happened or will happen (default now).
activity_typestringyesActivity type by name, e.g. Meeting, Phone Call, Email, Follow up (see civicrm_get_fields Activity, field activity_type_id).
assignee_contact_idsarray–Contact(s) assigned to do it.
detailsstring–Description.
source_contact_idinteger–Who added it (default: the API key's own contact).
statusstring–Status by name, e.g. Completed (default), Scheduled, Cancelled.
subjectstringyesSubject line.
with_contact_idsarrayyesThe contact(s) the activity is with.

No output schema declared.

No examples provided.

civicrm_query ~242

Read records of ANY CiviCRM entity with APIv4 Entity.get: choose fields, filter, sort and page. Use civicrm_list_entities and civicrm_get_fields for the names. Field names may be joined (`contact_id.display_name`, `email_primary.email`) or ask for an option's text (`status_id:label`). Examples: entity Tag; entity Campaign with where [{field:'is_active',op:'=',value:true}]; entity Contribution with select ['id','total_amount'] and where [{field:'total_amount',op:'>=',value:1000}]. Read-only; credential fields and system entities (settings, payment processors, mailings, users) are refused.

NameTypeReqDescription
entitystringyesAPIv4 entity name, e.g. Campaign.
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
order_byarray–Sort order.
selectarrayyesFields to return.
wherearray–Filters, all of which must match.

No output schema declared.

No examples provided.

civicrm_record_contribution ~255

WRITE: records ONE contribution (a donation, a payment received elsewhere) for a contact. It only STORES the financial record: no card is charged, no receipt is e-mailed, and the amount shows up in CiviCRM's reports and the contact's giving history. Check civicrm_list_contributions first to avoid a duplicate. APIv4 Contribution.create.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id of the donor.
currencystring–ISO currency code (default: the site's default).
financial_typestringyesFinancial type by name, e.g. Donation, Member Dues, Event Fee, Campaign Contribution.
payment_methodstring–Payment method by name, e.g. Check, Cash, Credit Card, EFT.
receive_datestring–When it was received (default now).
sourcestring–Where it came from (free text).
statusstring–Contribution status by name: Completed (default), Pending, ...
total_amountnumberyesAmount, in the site's currency unless currency is given.
trxn_idstring–Your own reference, e.g. a check number or bank reference.

No output schema declared.

No examples provided.

civicrm_register_participant ~140

WRITE: registers ONE contact for ONE event (a participant record). It does not check the event's capacity or fee, does not take payment and sends no confirmation e-mail. APIv4 Participant.create.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id.
event_idintegeryesEvent id (from civicrm_list_events).
rolestring–Role by name: Attendee (default), Volunteer, Host, Speaker.
sourcestring–Where it came from (free text).
statusstring–Participant status by name: Registered (default), Attended, Pending from pay later, ...

No output schema declared.

No examples provided.

civicrm_search_contacts ~154

Find contacts (people, organizations, households) by a word in their name, e-mail address or phone number, optionally of one contact type. Trashed contacts are left out. Returns id, display name, type, primary e-mail and phone. APIv4 Contact.get.

NameTypeReqDescription
contact_typestring–Only this contact type.
limitinteger–Records per call, 1-100 (default 25).
offsetinteger–How many records to skip (default 0). Pass the previous reply's next_offset.
querystring–Text to look for in the display name, primary e-mail or primary phone (partial match). Leave empty to list contacts by name.

No output schema declared.

No examples provided.

civicrm_update_contact ~220

WRITE: changes basic fields of ONE existing contact (name, job title, source, preferred language) and/or its communication preferences (do not e-mail, do not phone, do not mail, do not SMS, opted out of bulk mail). Only the fields you give are changed. Setting a do-not flag to false re-enables contact the person may have declined, so only do that on the person's request. APIv4 Contact.update.

NameTypeReqDescription
contact_idintegeryesCiviCRM contact id.
do_not_emailboolean––
do_not_mailboolean––
do_not_phoneboolean––
do_not_smsboolean––
first_namestring––
household_namestring––
is_opt_outboolean–Opted out of ALL bulk mailings.
job_titlestring––
last_namestring––
organization_namestring––
preferred_languagestring––
sourcestring––

No output schema declared.

No examples provided.

civicrm_whoami ~65

The CiviCRM contact this API key belongs to (contact id, display name, contact type) and how it authenticated. Everything the other tools do is limited to that contact's permissions. GET /civicrm/authx/id, then APIv4 Contact.get.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Install

How do I install the CiviCRM MCP by usefulapi server?

CiviCRM MCP by usefulapi is a hosted endpoint at https://civicrm.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · civicrm.usefulapi.io

# add to Claude Code
claude mcp add --transport http io-usefulapi-civicrm 'https://civicrm.usefulapi.io/mcp'
Common questions

What is the CiviCRM MCP by usefulapi server?

CiviCRM MCP by usefulapi is listed in the public MCP registry as io.usefulapi/civicrm. Work with your own CiviCRM: contacts, contributions, memberships, events; log activities. This page covers its hosted endpoint (https://civicrm.usefulapi.io/mcp).

Is the CiviCRM MCP by usefulapi server safe to use?

CiviCRM MCP by usefulapi scores 62 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the CiviCRM MCP by usefulapi server expose?

CiviCRM MCP by usefulapi exposes 24 tools: civicrm_whoami, civicrm_search_contacts, civicrm_get_contact, civicrm_list_contact_notes, civicrm_list_relationships, and 19 more. Their descriptions and schemas cost roughly 3,718 tokens of context every time the server is loaded.

Does the CiviCRM MCP by usefulapi server require authentication?

Yes. CiviCRM MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the CiviCRM MCP by usefulapi server still maintained?

CiviCRM MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.