Skip to content

Apply2Volunteer

by applytovolunteer.com · remote · no sign-in to list tools · v1.0.0 · published by com.applytovolunteer

Preview or grade a volunteer form. No API key. Free sign-up to publish.

Deletes · 2Changes · 8

15 tools: 2 can delete or cancel things, 8 change things and 5 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http apply2volunteer https://applytovolunteer.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info
  • The description is 2,272 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...ny new field ids, and editorUrl (/app/forms/{formId}). Does not publish the form."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

15 tools

Deletes or cancels 2Claude Code: deny
  • discard_formDiscard the open draft of a form that belongs to the authenticated organization.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Discard the open draft of a form that belongs to the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Same checks as POST /api/v1/forms/{id}/discard. An open draft is an unpublished version newer than the published snapshot. This deletes that draft and clears drafted public settings. The published form stays. Returns { ok: true }. A form with no open draft returns 404 { error: "not found", message: "No open draft to discard." }. That includes a form that was never published and a published form with nothing left to discard. If the form changed since this discard was read, it writes nothing and returns 409 'This form changed. Reload and try again.' This does not delete the form. A form that belongs to another organization is not found.

    Annotations the server declares

    • title: Discard an open draft
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
  • publish_formPublish a draft form that belongs to the authenticated organization.No findings

    Why it is in this group

    • The name "publish_form" says "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Publish a draft form that belongs to the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Runs the same checks as POST /api/v1/forms/{id}/publish, including field identity and stage validation. A form with no fields is rejected (400 'A form must have at least one field to publish.'). Publish returns 409 'Publish would remove a field that already has answers or consents.' when the draft would drop a field key that already has answers or consents on any version of the form. Returns formId, status published, publicUrl (the public form URL, the same value as publicFormUrl), the embed URL, and the embed snippet. Does not publish a form that belongs to another organization.

    Annotations the server declares

    • title: Publish a form
    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
Changes things 8Claude Code: ask
  • claim_previewSave an unexpired anonymous preview into the authenticated organization as a draft.No findings

    Why it is in this group

    • The name "claim_preview" says "preview": a word for reading.
    • The description's first verb is "save": a word for a change.
    Description, as the server wrote it
    Save an unexpired anonymous preview into the authenticated organization as a draft. Requires an org API key or OAuth sign-in with the forms:write scope. Same save as POST /api/v1/tools/previews/{id}/claim. previewId is the token in previewUrl (/tools/p/{previewId}). Returns formId and editorUrl (/app/forms/{formId}). An unknown or expired preview is an error. A preview already saved by another organization is refused. Claiming the same preview again for this organization returns the same draft.

    Annotations the server declares

    • title: Save a preview as a draft
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • convert_pdf_previewConvert a PDF URL into a stored preview for the authenticated organization.No findings

    Why it is in this group

    • The name "convert_pdf_preview" says "convert": a word for a change.
    Description, as the server wrote it
    Convert a PDF URL into a stored preview for the authenticated organization. Requires an org API key with the forms:read scope. Returns the preview id and expiry. For a preview without a key, use preview_volunteer_form.

    Annotations the server declares

    • title: Convert a PDF for the organization
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • create_formCreate a blank draft form in the authenticated organization.No findings

    Why it is in this group

    • The name "create_form" says "create": a word for a change.
    Description, as the server wrote it
    Create a blank draft form in the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Same blank form as POST /api/v1/forms when no conversion, report, or preview is sent: title Volunteer application unless title is set, with First name and Email. Optional template volunteer-application-form or volunteer-interest-form seeds that template's fields instead, using the on-server parser. Workers AI stays off. An unknown template is an error and does not create a form. Title is at most 200 characters. MCP, an org API key, and OAuth share a limit of 60 creates per organization per hour. A website session is not counted. Returns formId and editorUrl (/app/forms/{formId}). Does not publish the form.

    Annotations the server declares

    • title: Create a blank draft form
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
  • create_form_from_pdfFetch a PDF or page URL and save a draft form in the authenticated organization, the same way claiming a preview does.No findings

    Why it is in this group

    • The name "create_form_from_pdf" says "create": a word for a change.
    Description, as the server wrote it
    Fetch a PDF or page URL and save a draft form in the authenticated organization, the same way claiming a preview does. Requires an org API key with the forms:write scope. Uses the on-server parser only: Workers AI and other models stay off. Returns formId and editorUrl (/app/forms/{formId}). Does not publish the form. File contents are not logged.

    Annotations the server declares

    • title: Save a draft from a PDF
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • grade_formGrade a blank volunteer form from pasted text or a document URL.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Grade a blank volunteer form from pasted text or a document URL. No API key. Send a url or text, not both. Uses the on-server grader only: Workers AI and other models stay off. Returns score, letter grade, fixes (the top recommendations), and reportUrl (/tools/r/{id}) for the public share page when one is stored. Restricted fields such as Social Security numbers are left out of parsed; the score still counts them. Anonymous use shares the Form Grader limit of 5 per network per day and counts toward the daily anonymous MCP cap. An organization hourly limit applies when an org API key with the forms:read scope is sent. Does not grade a saved form.

    Annotations the server declares

    • title: Grade a volunteer form
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • preview_volunteer_formConvert a blank volunteer application into an online form preview.No findings

    Why it is in this group

    • The name "preview_volunteer_form" says "preview": a word for reading.
    • The description's first verb is "convert": a word for a change.
    Description, as the server wrote it
    Convert a blank volunteer application into an online form preview. No account and no API key. Send exactly one of a PDF or page url, pasted form text, or template (volunteer-application-form or volunteer-interest-form). Uses the on-server parser only: Workers AI and other models stay off, so this call has no model charge. Returns previewUrl (/tools/p/{token}), claimUrl, and signUpUrl. claimUrl and signUpUrl are the same sign-up link (/login?next=/tools/p/{token}&utm_source=mcp) labeled sign up free to publish. The parsed form is stored for 24 hours and the daily cleanup deletes it. The URL is fetched once. File contents are not logged. Restricted fields such as Social Security numbers are left out. Anonymous use is limited per network and by a daily cap; over the cap, sign up free.

    Annotations the server declares

    • title: Preview a volunteer form
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • update_application_statusSet an application's status for the authenticated organization.No findings

    Why it is in this group

    • The name "update_application_status" says "update": a word for a change.
    Description, as the server wrote it
    Set an application's status for the authenticated organization. Requires an org API key with the applications:write scope. A decline requires a decline reason. This writes the status; it does not delete the application.

    Annotations the server declares

    • title: Update an application status
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
  • update_formUpdate a form that belongs to the authenticated organization.1 finding

    Why it is in this group

    • The name "update_form" says "update": a word for a change.

    Findings

    • Info

      The description is 2,272 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...ny new field ids, and editorUrl (/app/forms/{formId}). Does not publish the form."

      What this check looks for
    Description, as the server wrote it
    Update a form that belongs to the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Same checks as PATCH /api/v1/forms/{id}: title, settings, and fields. A field entry with an id updates that field. A field entry with no id inserts a field. op add also inserts a field, and that row must not include an id. The server assigns the id. Required on an insert: label and type (an existing field type). Optional on an insert: helpText (at most 2000 characters), required, options, and stageId. stageId defaults to the Interest stage, or the first stage. New fields are appended. order on an insert is ignored. On an existing field, optional order is an integer greater than or equal to 0 and sets that field's position. An order already used by another field on this version is refused (409 'A field already occupies this order on the form version.'). op remove, or removeFieldIds, deletes fields on the current draft. Answers and consents are matched by field key on every version of the form, not by the draft field id. A field that has answers or consents cannot be removed (409 'This field has answers or consents and cannot be removed.'). Changing a field key is refused when that field's current key, or the new key, already has answers or consents on this form (409 'A field key that already has answers or consents cannot be changed.'). At most 20 fields can be added and 20 removed in one call. A form can hold at most 140 fields. Title is at most 200 characters, a field label at most 500, and stored settings JSON at most 32 KB. A field id that is not on the current draft returns 409 'This field id is not on the current draft.' Re-read the form with get_form and retry with the current field ids. A malformed field id is rejected. Top-level settings keys whose names start with __ are ignored, and the stored editor stamp is kept. A lower editorSeq does not overwrite a newer save. A form that belongs to another organization is not found. MCP, an org API key, and OAuth share a limit of 60 updates per organization per hour. Adding or removing fields uses that same limit. A website session is not counted. Returns the updated draft, any new field ids, and editorUrl (/app/forms/{formId}). Does not publish the form.

    Annotations the server declares

    • title: Update a draft form
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
Only reads 5Claude Code: allow
  • get_applicationGet one application by id when it belongs to the authenticated organization.No findings

    Why it is in this group

    • The name "get_application" says "get": a word for reading.
    Description, as the server wrote it
    Get one application by id when it belongs to the authenticated organization. Requires an org API key with the applications:read scope.

    Annotations the server declares

    • title: Get an application
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_formGet one form by id when it belongs to the authenticated organization.No findings

    Why it is in this group

    • The name "get_form" says "get": a word for reading.
    Description, as the server wrote it
    Get one form by id when it belongs to the authenticated organization. Requires an org API key with the forms:read scope. When the form is published and not soft-deleted, also returns publicUrl, publicFormUrl, embedUrl, and embedSnippet, and a draft that was never published omits those fields. A soft-deleted form omits those fields too.

    Annotations the server declares

    • title: Get a form
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_previewRead an unexpired converter preview by previewId.No findings

    Why it is in this group

    • The name "get_preview" says "get": a word for reading.
    Description, as the server wrote it
    Read an unexpired converter preview by previewId. No API key. Returns the title, fields, stages, expiresAt, and previewUrl already shown on the public preview page (/tools/p/{previewId}), whether or not that preview was claimed. Unknown or expired ids are not found and include the converter URL. Does not return organization ids or saved form ids.

    Annotations the server declares

    • title: Read a form preview
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_applicationsList applications for one form in the authenticated organization.No findings

    Why it is in this group

    • The name "list_applications" says "list": a word for reading.
    Description, as the server wrote it
    List applications for one form in the authenticated organization. Requires an org API key with the applications:read scope.

    Annotations the server declares

    • title: List applications
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_formsList forms that belong to the authenticated organization.No findings

    Why it is in this group

    • The name "list_forms" says "list": a word for reading.
    Description, as the server wrote it
    List forms that belong to the authenticated organization. Requires an org API key with the forms:read scope. When a form is published and not soft-deleted, that item also includes publicUrl, publicFormUrl, embedUrl, and embedSnippet, and a draft that was never published omits those fields. A soft-deleted form omits those fields too.

    Annotations the server declares

    • title: List forms
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http apply2volunteer https://applytovolunteer.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__apply2volunteer__get_preview",
      "mcp__apply2volunteer__list_forms",
      "mcp__apply2volunteer__get_form",
      "mcp__apply2volunteer__list_applications",
      "mcp__apply2volunteer__get_application"
    ],
    "ask": [
      "mcp__apply2volunteer__preview_volunteer_form",
      "mcp__apply2volunteer__grade_form",
      "mcp__apply2volunteer__convert_pdf_preview",
      "mcp__apply2volunteer__update_application_status",
      "mcp__apply2volunteer__create_form_from_pdf",
      "mcp__apply2volunteer__create_form",
      "mcp__apply2volunteer__update_form",
      "mcp__apply2volunteer__claim_preview"
    ],
    "deny": [
      "mcp__apply2volunteer__discard_form",
      "mcp__apply2volunteer__publish_form"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as apply2volunteer. Review it before you use it.