# CiviCRM MCP by usefulapi (remote · civicrm.usefulapi.io)

Work with your own CiviCRM: contacts, contributions, memberships, events; log activities.

- Trust score: 62/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-25

## Components

- remote · `civicrm.usefulapi.io`: 62/100 (this document), [markdown](https://verifymcp.io/servers/io-usefulapi-civicrm/civicrm.md), [page](https://verifymcp.io/servers/io-usefulapi-civicrm/civicrm)

## Channel facts

- Endpoint: `https://civicrm.usefulapi.io/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.1.3`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-25.

- **Endpoint Security**: 78/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly.
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3978 tokens (~165/item across 24 items; 24 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 3/100
  - Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 90% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 24 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the CiviCRM MCP by usefulapi server?

CiviCRM MCP by usefulapi is a hosted endpoint at https://civicrm.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http io-usefulapi-civicrm 'https://civicrm.usefulapi.io/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "io-usefulapi-civicrm": {
      "url": "https://civicrm.usefulapi.io/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "io-usefulapi-civicrm": {
      "type": "http",
      "url": "https://civicrm.usefulapi.io/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.io-usefulapi-civicrm]
url = "https://civicrm.usefulapi.io/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-usefulapi-civicrm": {
      "type": "remote",
      "url": "https://civicrm.usefulapi.io/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add io-usefulapi-civicrm --url 'https://civicrm.usefulapi.io/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  io-usefulapi-civicrm:
    url: "https://civicrm.usefulapi.io/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "io-usefulapi-civicrm": {
      "Transport": "http",
      "Url": "https://civicrm.usefulapi.io/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add io-usefulapi-civicrm -t streamable-http -u 'https://civicrm.usefulapi.io/mcp'
```

### Other

```json
{
  "mcpServers": {
    "io-usefulapi-civicrm": {
      "type": "http",
      "url": "https://civicrm.usefulapi.io/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-25 (score 62, 0)

- [functional improvement] Stability: unverified → 0.03
- [functional] Server version: 1.1.0 → 1.1.3

### 2026-10-24 (score 62)

First indexed and scored.

## MCP tools (24)

### `civicrm_whoami` (~65 tokens)

Get current contact

The CiviCRM contact this API key belongs to (contact id, display name, contact type) and how it authenticated. Everything the other tools do is limited to that contact's permissions. GET /civicrm/authx/id, then APIv4 Contact.get.

### `civicrm_search_contacts` (~154 tokens)

Search contacts

Find contacts (people, organizations, households) by a word in their name, e-mail address or phone number, optionally of one contact type. Trashed contacts are left out. Returns id, display name, type, primary e-mail and phone. APIv4 Contact.get.

Input parameters:

- `contact_type` (string): Only this contact type.
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `query` (string): Text to look for in the display name, primary e-mail or primary phone (partial match). Leave empty to list contacts by name.

### `civicrm_get_contact` (~88 tokens)

Get contact

One contact by id: name, type, job title, source, communication preferences (do not e-mail, opted out, ...), dates, plus all their e-mail addresses, phone numbers and postal addresses. APIv4 Contact.get, Email.get, Phone.get, Address.get.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id (the cid in the contact's URL).

### `civicrm_list_contact_notes` (~93 tokens)

List contact notes

The notes recorded on one contact (subject, text, who wrote it, when), newest first. APIv4 Note.get.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id.
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.

### `civicrm_list_relationships` (~118 tokens)

List contact relationships

The relationships of one contact (employee of, spouse of, volunteer for, ...) with the other contact, start and end date and whether it is active. APIv4 Relationship.get.

Input parameters:

- `active_only` (boolean): Only active relationships (default true).
- `contact_id` (integer, required): CiviCRM contact id.
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.

### `civicrm_list_contributions` (~231 tokens)

List contributions

Contributions (donations, membership dues, event fees) with contact, amount, currency, financial type, status, payment method, date and source, newest first. Filter by contact, status, financial type, date range and minimum amount. Test contributions are left out. APIv4 Contribution.get.

Input parameters:

- `contact_id` (integer): Only this contact's contributions.
- `date_from` (string): Received on or after this date.
- `date_to` (string): Received on or before this date (a plain date includes that whole day).
- `financial_type` (string): Only this financial type by name, e.g. Donation, Member Dues, Event Fee.
- `limit` (integer): Records per call, 1-100 (default 25).
- `min_amount` (number): Only contributions of at least this amount.
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `status` (string): Only this status by name, e.g. Completed, Pending, Failed, Cancelled, Refunded.

### `civicrm_list_memberships` (~205 tokens)

List memberships

Memberships with contact, membership type, status (New, Current, Grace, Expired, ...), join, start and end date. Filter by contact, status, type, or those ending before a date (renewal follow-up). Test memberships are left out. APIv4 Membership.get.

Input parameters:

- `contact_id` (integer): Only this contact's memberships.
- `ends_after` (string): Only memberships that end on or after this date.
- `ends_before` (string): Only memberships that end on or before this date.
- `limit` (integer): Records per call, 1-100 (default 25).
- `membership_type` (string): Only this membership type by name, e.g. General.
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `status` (string): Only this status by name, e.g. Current, Grace, Expired, Cancelled.

### `civicrm_list_events` (~144 tokens)

List events

Events with title, type, start and end date, whether active and public, maximum participants and summary. Upcoming events first when upcoming_only is set. Template events are left out. APIv4 Event.get.

Input parameters:

- `active_only` (boolean): Only active events (default true).
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `title` (string): Only events whose title contains this text.
- `upcoming_only` (boolean): Only events that have not ended yet (start date today or later).

### `civicrm_list_participants` (~150 tokens)

List event participants

Event registrations with event, contact, status (Registered, Attended, Cancelled, ...), role, registration date and fee. Filter by event, contact or status. Test registrations are left out. APIv4 Participant.get.

Input parameters:

- `contact_id` (integer): Only this contact's registrations.
- `event_id` (integer): Only this event's participants.
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `status` (string): Only this participant status by name, e.g. Registered, Attended, Cancelled.

### `civicrm_list_activities` (~225 tokens)

List activities

Activities (meetings, phone calls, e-mails, follow-ups, ...) with type, subject, status, date and details, newest first. With contact_id: the activities that contact took part in, with their role (source, target or assignee). Otherwise all activities, optionally of one type or status. APIv4 ActivityContact.get / Activity.get.

Input parameters:

- `activity_type` (string): Only this activity type by name, e.g. Meeting, Phone Call, Email, Follow up.
- `contact_id` (integer): Only activities this contact is involved in.
- `date_from` (string): On or after this date.
- `date_to` (string): On or before this date (a plain date includes that whole day).
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `status` (string): Only this status by name, e.g. Scheduled, Completed, Cancelled.

### `civicrm_list_cases` (~145 tokens)

List cases

Cases (CiviCase) with subject, case type, status and dates. With contact_id: the cases that contact is a client of. Needs the CiviCase component to be enabled. APIv4 CaseContact.get / Case.get.

Input parameters:

- `contact_id` (integer): Only cases of this client contact.
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `status` (string): Only this case status by name, e.g. Open, Resolved. Applied when no contact_id is given.

### `civicrm_list_groups` (~109 tokens)

List groups

Contact groups (mailing lists, static groups, smart groups) with title, description, visibility and type. APIv4 Group.get.

Input parameters:

- `active_only` (boolean): Only active groups (default true).
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `title` (string): Only groups whose title contains this text.

### `civicrm_list_group_contacts` (~145 tokens)

List group members

The members of one static group (or the groups one contact belongs to): contact, group and membership status (Added, Removed, Pending). Smart groups are computed by CiviCRM and not listed here. APIv4 GroupContact.get.

Input parameters:

- `contact_id` (integer): The groups of this contact.
- `group_id` (integer): Members of this group (from civicrm_list_groups).
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `status` (string): Membership status (default Added).

### `civicrm_get_fields` (~137 tokens)

Describe an entity's fields

The fields of one CiviCRM entity (Contact, Contribution, Event, ...) including custom fields: name, label, data type, whether required, and the allowed options for a pick-list field. Use it to find the right field names for civicrm_query and the right option names for the filters and write tools. APIv4 <Entity>.getFields.

Input parameters:

- `action` (string): The action the fields are for (default get).
- `entity` (string, required): APIv4 entity name, e.g. Contact.
- `field` (string): Only this field, with its options (e.g. contribution_status_id).

### `civicrm_list_entities` (~74 tokens)

List API entities

The APIv4 entities this CiviCRM site offers (Contact, Contribution, Event, plus those of installed extensions), with a short description. Use the names with civicrm_get_fields and civicrm_query. APIv4 Entity.get.

Input parameters:

- `search` (string): Only entities whose name or title contains this text.

### `civicrm_query` (~242 tokens)

Query any entity

Read records of ANY CiviCRM entity with APIv4 Entity.get: choose fields, filter, sort and page. Use civicrm_list_entities and civicrm_get_fields for the names. Field names may be joined (`contact_id.display_name`, `email_primary.email`) or ask for an option's text (`status_id:label`). Examples: entity Tag; entity Campaign with where [{field:'is_active',op:'=',value:true}]; entity Contribution with select ['id','total_amount'] and where [{field:'total_amount',op:'>=',value:1000}]. Read-only; credential fields and system entities (settings, payment processors, mailings, users) are refused.

Input parameters:

- `entity` (string, required): APIv4 entity name, e.g. Campaign.
- `limit` (integer): Records per call, 1-100 (default 25).
- `offset` (integer): How many records to skip (default 0). Pass the previous reply's next_offset.
- `order_by` (array): Sort order.
- `select` (array, required): Fields to return.
- `where` (array): Filters, all of which must match.

### `civicrm_create_contact` (~181 tokens)

Create contact

WRITE: creates ONE new contact (an individual, organization or household) and optionally its first e-mail address and phone number. Does not check for duplicates: search first with civicrm_search_contacts. Sends nothing. APIv4 Contact.create, Email.create, Phone.create.

Input parameters:

- `contact_type` (string, required): Individual, Organization or Household.
- `email` (string): First e-mail address (stored as the primary one).
- `first_name` (string): Individual: first name.
- `household_name` (string): Household: its name.
- `job_title` (string)
- `last_name` (string): Individual: last name.
- `organization_name` (string): Organization: its name.
- `phone` (string): First phone number (stored as the primary one).
- `source` (string): Where this contact came from (free text).

### `civicrm_update_contact` (~220 tokens)

Update contact

WRITE: changes basic fields of ONE existing contact (name, job title, source, preferred language) and/or its communication preferences (do not e-mail, do not phone, do not mail, do not SMS, opted out of bulk mail). Only the fields you give are changed. Setting a do-not flag to false re-enables contact the person may have declined, so only do that on the person's request. APIv4 Contact.update.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id.
- `do_not_email` (boolean)
- `do_not_mail` (boolean)
- `do_not_phone` (boolean)
- `do_not_sms` (boolean)
- `first_name` (string)
- `household_name` (string)
- `is_opt_out` (boolean): Opted out of ALL bulk mailings.
- `job_title` (string)
- `last_name` (string)
- `organization_name` (string)
- `preferred_language` (string)
- `source` (string)

### `civicrm_add_contact_note` (~78 tokens)

Add contact note

WRITE: adds ONE note to a contact's record, written by the contact this API key belongs to. Sends nothing. APIv4 Note.create.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id the note is about.
- `note` (string, required): The note text.
- `subject` (string): Optional subject line.

### `civicrm_log_activity` (~225 tokens)

Log activity

WRITE: records ONE activity (a meeting, phone call, e-mail, follow-up, ...) with one or more contacts. It only STORES the record: an activity of type Email does not send an e-mail. Added by the contact this API key belongs to unless source_contact_id is given. APIv4 Activity.create.

Input parameters:

- `activity_date_time` (string): When it happened or will happen (default now).
- `activity_type` (string, required): Activity type by name, e.g. Meeting, Phone Call, Email, Follow up (see civicrm_get_fields Activity, field activity_type_id).
- `assignee_contact_ids` (array): Contact(s) assigned to do it.
- `details` (string): Description.
- `source_contact_id` (integer): Who added it (default: the API key's own contact).
- `status` (string): Status by name, e.g. Completed (default), Scheduled, Cancelled.
- `subject` (string, required): Subject line.
- `with_contact_ids` (array, required): The contact(s) the activity is with.

### `civicrm_record_contribution` (~255 tokens)

Record contribution

WRITE: records ONE contribution (a donation, a payment received elsewhere) for a contact. It only STORES the financial record: no card is charged, no receipt is e-mailed, and the amount shows up in CiviCRM's reports and the contact's giving history. Check civicrm_list_contributions first to avoid a duplicate. APIv4 Contribution.create.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id of the donor.
- `currency` (string): ISO currency code (default: the site's default).
- `financial_type` (string, required): Financial type by name, e.g. Donation, Member Dues, Event Fee, Campaign Contribution.
- `payment_method` (string): Payment method by name, e.g. Check, Cash, Credit Card, EFT.
- `receive_date` (string): When it was received (default now).
- `source` (string): Where it came from (free text).
- `status` (string): Contribution status by name: Completed (default), Pending, ...
- `total_amount` (number, required): Amount, in the site's currency unless currency is given.
- `trxn_id` (string): Your own reference, e.g. a check number or bank reference.

### `civicrm_create_membership` (~168 tokens)

Create membership

WRITE: gives ONE contact a membership of a type. CiviCRM works out the dates and status from the type unless you give dates. It does NOT record a payment (use civicrm_record_contribution for that) and sends nothing. APIv4 Membership.create.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id.
- `end_date` (string): End date (default: calculated by the type).
- `join_date` (string): Join date (default today).
- `membership_type` (string, required): Membership type by name, e.g. General (see civicrm_get_fields Membership, field membership_type_id).
- `source` (string): Where it came from (free text).
- `start_date` (string): Start date (default: calculated by the type).

### `civicrm_add_contact_to_group` (~126 tokens)

Add contact to group

WRITE: adds ONE contact to ONE static group. If the group is used as a mailing list, the contact will receive future mailings sent to it, so only add people who agreed. Sends nothing by itself. Adding a contact who is already in the group changes nothing; a contact who was removed from it (or is pending) is set back to Added. APIv4 GroupContact.save matched on group and contact.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id.
- `group_id` (integer, required): Group id (from civicrm_list_groups).

### `civicrm_register_participant` (~140 tokens)

Register participant

WRITE: registers ONE contact for ONE event (a participant record). It does not check the event's capacity or fee, does not take payment and sends no confirmation e-mail. APIv4 Participant.create.

Input parameters:

- `contact_id` (integer, required): CiviCRM contact id.
- `event_id` (integer, required): Event id (from civicrm_list_events).
- `role` (string): Role by name: Attendee (default), Volunteer, Host, Speaker.
- `source` (string): Where it came from (free text).
- `status` (string): Participant status by name: Registered (default), Attended, Pending from pay later, ...

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/io-usefulapi-civicrm/civicrm#diagnostics

## Score history

- 2026-10-25: 62
- 2026-10-24: 62

## Common questions

### What is the CiviCRM MCP by usefulapi server?

CiviCRM MCP by usefulapi is listed in the public MCP registry as io.usefulapi/civicrm. Work with your own CiviCRM: contacts, contributions, memberships, events; log activities. This page covers its hosted endpoint (https://civicrm.usefulapi.io/mcp).

### Is the CiviCRM MCP by usefulapi server safe to use?

CiviCRM MCP by usefulapi scores 62 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the CiviCRM MCP by usefulapi server expose?

CiviCRM MCP by usefulapi exposes 24 tools: civicrm_whoami, civicrm_search_contacts, civicrm_get_contact, civicrm_list_contact_notes, civicrm_list_relationships, and 19 more. Their descriptions and schemas cost roughly 3,718 tokens of context every time the server is loaded.

### Does the CiviCRM MCP by usefulapi server require authentication?

Yes. CiviCRM MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the CiviCRM MCP by usefulapi server still maintained?

CiviCRM MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 25 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://civicrm.usefulapi.io/mcp
- Repository: https://github.com/m190/usefulapi-mcp
- Website: https://usefulapi.io/civicrm/
- Changelog RSS feed: https://verifymcp.io/servers/io-usefulapi-civicrm/civicrm.xml
- Changelog JSON feed: https://verifymcp.io/servers/io-usefulapi-civicrm/civicrm.json
- HTML version of this page: https://verifymcp.io/servers/io-usefulapi-civicrm/civicrm