io.usefulapi/polar-sh
REMOTE · POLAR-SH.USEFULAPI.IO · SCANNED OCT 3
Products, customers, orders, subscriptions, benefits, revenue metrics and refunds.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability82
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2525 tokens (~97/item across 26 items; 26 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 26 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the io.usefulapi/polar-sh MCP server?
io.usefulapi/polar-sh is a hosted endpoint at https://polar-sh.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · polar-sh.usefulapi.io
claude mcp add --transport http io-usefulapi-polar-sh 'https://polar-sh.usefulapi.io/mcp'
{
"mcpServers": {
"io-usefulapi-polar-sh": {
"url": "https://polar-sh.usefulapi.io/mcp"
}
}
} {
"servers": {
"io-usefulapi-polar-sh": {
"type": "http",
"url": "https://polar-sh.usefulapi.io/mcp"
}
}
} [mcp_servers.io-usefulapi-polar-sh] url = "https://polar-sh.usefulapi.io/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-usefulapi-polar-sh": {
"type": "remote",
"url": "https://polar-sh.usefulapi.io/mcp",
"enabled": true
}
}
} openclaw mcp add io-usefulapi-polar-sh --url 'https://polar-sh.usefulapi.io/mcp' --transport streamable-http
mcp_servers:
io-usefulapi-polar-sh:
url: "https://polar-sh.usefulapi.io/mcp" {
"McpServers": {
"io-usefulapi-polar-sh": {
"Transport": "http",
"Url": "https://polar-sh.usefulapi.io/mcp"
}
}
} assistant mcp add io-usefulapi-polar-sh -t streamable-http -u 'https://polar-sh.usefulapi.io/mcp'
{
"mcpServers": {
"io-usefulapi-polar-sh": {
"type": "http",
"url": "https://polar-sh.usefulapi.io/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Oct 26 +1
- Server version: 1.3.0 → 1.5.1 functional
- 1 Oct 26 +5
- HTTPS: unverified → pass ▲ security
- Stability: unverified → 0.03 ▲ functional
- Server version: 1.0.0 → 1.3.0 functional
- 30 Sept 26 +54
- Authorization: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- Transport: fail → pass ▲ security
- First check of Judged manipulation: pass security
- First check of Authorization: partial security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Schema quality: excellent functional
- First check of Destructive annotations: 100 functional
- First check of Schema quality: pass functional
- First check of Tool coverage: 100 functional
- 29 Sept 26 18
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Oct 2026 · Probed https://polar-sh.usefulapi.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=usefulapi.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | d9be3287b0fde9630e825ba1f79bff3f |
| SANs: usefulapi.io, *.usefulapi.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of polar-sh.usefulapi.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| usefulapi.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://polar-sh.usefulapi.io/.well-known/oauth-protected-resource/mcp"
Bearer realm="OAuth", resource_metadata="https://polar-sh.usefulapi.io/.well-known/oauth-protected-resource/mcp"Protected resource metadata
| Document | https://polar-sh.usefulapi.io/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://polar-sh.usefulapi.io/mcp |
| Authorisation server | https://polar-sh.usefulapi.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://polar-sh.usefulapi.io/mcp | Verified | 200 | |
| http (plaintext) | http://polar-sh.usefulapi.io/mcp | HTTPS enforced | 301 | https://polar-sh.usefulapi.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
polar_cancel_subscription Cancel a subscription ~84
Cancel a subscription at the end of its current period. The customer keeps access until then. Polar: PATCH /v1/subscriptions/{id}.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_cancellation_comment | string | – | The customer's own words. |
| customer_cancellation_reason | string | – | Why the customer is leaving, for your churn reporting. |
| subscription_id | string | yes | The subscription to cancel. |
No output schema declared.
No examples provided.
polar_create_checkout_link Create a checkout link ~114
Create a reusable checkout URL for one or more products — the link you put in a page or an email. Polar: POST /v1/checkout-links/.
| Name | Type | Req | Description |
|---|---|---|---|
| allow_discount_codes | boolean | – | Let the buyer enter a discount code. Defaults to true. |
| discount_id | string | – | Apply this discount automatically. |
| label | string | – | An internal label for the link. |
| products | array | yes | Product ids the link sells. |
| success_url | string | – | Where to send the buyer after payment. |
No output schema declared.
No examples provided.
polar_create_refund Refund an order ~122
Refund an order, in full or in part. This moves real money back to the customer. Polar: POST /v1/refunds/.
| Name | Type | Req | Description |
|---|---|---|---|
| amount | integer | – | Amount in the currency's minor unit (cents). Omit to refund the full order. |
| comment | string | – | An internal note about the refund. |
| order_id | string | yes | The order to refund. |
| reason | string | yes | Why the refund is being issued. |
| revoke_benefits | boolean | – | Also revoke the benefits the order granted. Defaults to false. |
No output schema declared.
No examples provided.
polar_get_customer Get one customer ~40
Fetch a single customer by Polar id. Polar: GET /v1/customers/{id}.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | The customer's Polar id. |
No output schema declared.
No examples provided.
polar_get_customer_state Get a customer's full state ~67
Fetch everything about one customer in a single call — active subscriptions, granted benefits and entitlements. The best answer to 'what does this customer currently have?'. Polar: GET /v1/customers/{id}/state.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | yes | The customer's Polar id. |
No output schema declared.
No examples provided.
polar_get_customer_state_by_external_id Get a customer's state by your own id ~73
Same as polar_get_customer_state, but looked up by YOUR external id rather than Polar's — the usual path when you hold your own user id. Polar: GET /v1/customers/external/{external_id}/state.
| Name | Type | Req | Description |
|---|---|---|---|
| external_id | string | yes | Your own id for this customer. |
No output schema declared.
No examples provided.
polar_get_meter_quantities Get a meter's quantities ~113
Fetch the aggregated quantities a meter has recorded over a window — what usage-based billing will charge for. Polar: GET /v1/meters/{id}/quantities.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Only this customer's usage. |
| end_timestamp | string | yes | ISO-8601 end of the window. |
| interval | string | yes | Bucket size for the series. |
| meter_id | string | yes | The meter's id. |
| start_timestamp | string | yes | ISO-8601 start of the window. |
No output schema declared.
No examples provided.
polar_get_metrics Get revenue metrics ~134
Fetch revenue and subscription metrics over a date range, bucketed by interval — orders, revenue, MRR, active subscriptions. Polar: GET /v1/metrics/.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Only this customer's metrics. |
| end_date | string | yes | End of the window, YYYY-MM-DD. |
| interval | string | yes | Bucket size for the series. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| product_id | string | – | Only this product's metrics. |
| start_date | string | yes | Start of the window, YYYY-MM-DD. |
No output schema declared.
No examples provided.
polar_get_order Get one order ~44
Fetch a single order with its line items, discount and tax. Polar: GET /v1/orders/{id}.
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | string | yes | The order's id. |
No output schema declared.
No examples provided.
polar_get_product Get one product ~42
Fetch a single product with its prices and attached benefits. Polar: GET /v1/products/{id}.
| Name | Type | Req | Description |
|---|---|---|---|
| product_id | string | yes | The product's id. |
No output schema declared.
No examples provided.
polar_get_subscription Get one subscription ~44
Fetch a single subscription with its product, price and period. Polar: GET /v1/subscriptions/{id}.
| Name | Type | Req | Description |
|---|---|---|---|
| subscription_id | string | yes | The subscription's id. |
No output schema declared.
No examples provided.
polar_list_benefit_grants List grants of a benefit ~82
List who has been granted one benefit, and whether the grant is still active. Polar: GET /v1/benefits/{id}/grants.
| Name | Type | Req | Description |
|---|---|---|---|
| benefit_id | string | yes | The benefit's id. |
| limit | integer | – | Page size, 1-100. |
| page | integer | – | 1-based page number. |
No output schema declared.
No examples provided.
polar_list_benefits List benefits ~111
List benefits — the things a product grants, such as licence keys, file downloads or Discord roles. Polar: GET /v1/benefits/.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| query | string | – | Free-text search. |
| type | string | – | Only benefits of this type. |
No output schema declared.
No examples provided.
polar_list_customers List customers ~105
List customers, optionally by email or a text query. Polar: GET /v1/customers/.
| Name | Type | Req | Description |
|---|---|---|---|
| string | – | Only the customer with this email. | |
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| query | string | – | Free-text search over name and email. |
No output schema declared.
No examples provided.
polar_list_discounts List discounts ~91
List discount codes and their redemption limits. Polar: GET /v1/discounts/.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| query | string | – | Free-text search over discount names and codes. |
No output schema declared.
No examples provided.
polar_list_events List usage events ~151
List the raw usage events ingested for metering, filtered by customer, meter, name or time. Polar: GET /v1/events/.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Only this customer's events. |
| end_timestamp | string | – | ISO-8601 upper bound. |
| limit | integer | – | Page size, 1-100. |
| meter_id | string | – | Only events matching this meter. |
| name | string | – | Only events with this name. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| start_timestamp | string | – | ISO-8601 lower bound. |
No output schema declared.
No examples provided.
polar_list_license_keys List licence keys ~110
List issued licence keys and their status. Polar: GET /v1/license-keys/.
| Name | Type | Req | Description |
|---|---|---|---|
| benefit_id | string | – | Only keys from this benefit. |
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| status | string | – | Only keys in this state, e.g. granted, revoked, disabled. |
No output schema declared.
No examples provided.
polar_list_meters List usage meters ~79
List the usage meters that aggregate events into billable quantities. Polar: GET /v1/meters/.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
No output schema declared.
No examples provided.
polar_list_orders List orders ~175
List orders, filtered by customer, product, subscription, status or a date window. Polar: GET /v1/orders/.
| Name | Type | Req | Description |
|---|---|---|---|
| created_after | string | – | ISO-8601 lower bound on creation time. |
| created_before | string | – | ISO-8601 upper bound on creation time. |
| customer_id | string | – | Only this customer's orders. |
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| product_id | string | – | Only orders for this product. |
| status | string | – | Only orders in this state, e.g. paid, pending, refunded. |
| subscription_id | string | – | Only orders from this subscription. |
No output schema declared.
No examples provided.
polar_list_organizations List organisations ~65
List the organisations the token can act for. Start here — most other tools take an organization_id. Polar: GET /v1/organizations/.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size, 1-100. |
| page | integer | – | 1-based page number. |
No output schema declared.
No examples provided.
polar_list_products List products ~127
List products, optionally filtered by archived state, recurrence or a text query. Polar: GET /v1/products/.
| Name | Type | Req | Description |
|---|---|---|---|
| is_archived | boolean | – | Only archived, or only live, products. |
| is_recurring | boolean | – | Only subscriptions, or only one-off products. |
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| query | string | – | Free-text search over product names. |
No output schema declared.
No examples provided.
polar_list_refunds List refunds ~120
List refunds, filtered by order, subscription, customer or success. Polar: GET /v1/refunds/.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_id | string | – | Only this customer's refunds. |
| limit | integer | – | Page size, 1-100. |
| order_id | string | – | Only refunds against this order. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| succeeded | boolean | – | Only successful, or only failed, refunds. |
No output schema declared.
No examples provided.
polar_list_subscriptions List subscriptions ~156
List subscriptions, filtered by customer, product, status, active state or cancellation window. Polar: GET /v1/subscriptions/.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | Only active, or only inactive, subscriptions. |
| cancel_at_period_end | boolean | – | Only those already set to cancel — your churn pipeline. |
| customer_id | string | – | Only this customer's subscriptions. |
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
| product_id | string | – | Only subscriptions to this product. |
| status | string | – | Only subscriptions in this state. |
No output schema declared.
No examples provided.
polar_list_webhook_deliveries List webhook deliveries ~141
List webhook delivery attempts with their HTTP results — the tool for 'why did my webhook not arrive?'. Polar: GET /v1/webhooks/deliveries.
| Name | Type | Req | Description |
|---|---|---|---|
| end_timestamp | string | – | ISO-8601 upper bound. |
| endpoint_id | string | – | Only deliveries to this endpoint. |
| event_type | string | – | Only deliveries of this event type. |
| limit | integer | – | Page size, 1-100. |
| page | integer | – | 1-based page number. |
| start_timestamp | string | – | ISO-8601 lower bound. |
| succeeded | boolean | – | Only failures, or only successes. |
No output schema declared.
No examples provided.
polar_list_webhook_endpoints List webhook endpoints ~81
List the configured webhook endpoints and their subscribed events. Polar: GET /v1/webhooks/endpoints.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Page size, 1-100. |
| organization_id | string | – | Restrict to this organisation id. Needed when the token spans several organisations. |
| page | integer | – | 1-based page number. |
No output schema declared.
No examples provided.
polar_redeliver_webhook_event Redeliver a webhook event ~54
Queue one webhook event for redelivery after your endpoint recovered. Polar: POST /v1/webhooks/events/{id}/redeliver.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | The webhook event to resend. |
No output schema declared.
No examples provided.
What is the io.usefulapi/polar-sh MCP server?
io.usefulapi/polar-sh is an MCP server listed in the public MCP registry as io.usefulapi/polar-sh. Products, customers, orders, subscriptions, benefits, revenue metrics and refunds. This page covers its hosted endpoint (https://polar-sh.usefulapi.io/mcp).
Is the io.usefulapi/polar-sh MCP server safe to use?
io.usefulapi/polar-sh scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.usefulapi/polar-sh MCP server expose?
io.usefulapi/polar-sh exposes 26 tools: polar_list_organizations, polar_list_products, polar_get_product, polar_list_customers, polar_get_customer, and 21 more. Their descriptions and schemas cost roughly 2,525 tokens of context every time the server is loaded.
Does the io.usefulapi/polar-sh MCP server require authentication?
Yes. io.usefulapi/polar-sh asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the io.usefulapi/polar-sh MCP server still maintained?
io.usefulapi/polar-sh is still listed as active in the MCP registry. We last reached this channel on 3 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.