Skip to content
anlyon.devby Anlyon

Awtomic MCP by usefulapi

io.usefulapi/awtomicusefulapi.iostreamable-httpv1.0.0Scanned

Read Awtomic subscriptions, customers and billing attempts; pause, skip, reschedule, cancel.

21 tools: 9 can delete or cancel things and 12 only read.

Tools: 9 delete, 0 irreversible, 0 write, 12 read.
  • Reads private data · 3
  • Reads text others write · 21
  • Can send data out · 1
  • No findings

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

21 tools

Deletes or cancels 9Claude Code: deny
  • awtomic_cancel_customer_subscriptionWRITE: cancel one shopper's subscription contract in Awtomic.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_cancel_customer_subscription" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: cancel one shopper's subscription contract in Awtomic. Billing and shipping stop; a cancelled non-prepaid subscription can be brought back with awtomic_reactivate_subscription. This cancels the shop's customer subscription, not your usefulapi plan. Awtomic runs the shop's own automations for this event, so the customer may get an email or SMS and webhooks may fire. Awtomic cancels it on its side even if Shopify rejects the cancel. Only use it when the user explicitly asks to cancel this subscription, and confirm_cancel must be true. A cancelled prepaid subscription cannot be reactivated. POST /customers/{customerId}/subscriptions/{subscriptionId}/cancel.

    Annotations the server declares

    • title: Cancel a customer's subscription
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • awtomic_order_nowWRITE: bill the customer's saved payment method and create the subscription's next order immediately, instead of waiting for the billing date.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: bill the customer's saved payment method and create the subscription's next order immediately, instead of waiting for the billing date. THIS CHARGES THE CUSTOMER. Awtomic refuses (409 ORDER_RECENTLY_PLACED) if the latest billing attempt is pending or succeeded under 10 minutes ago. Set manual_retry only to retry a failed billing attempt. Only use it when the user explicitly asks to place this order now, and confirm_charge must be true. Awtomic runs the shop's own automations for this event, so the customer may get an email or SMS and webhooks may fire. POST /customers/{customerId}/subscriptions/{subscriptionId}/order-now.

    Annotations the server declares

    • title: Charge and order now
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • awtomic_pause_subscriptionWRITE: pause a subscription so it is not billed or shipped until it is reactivated (awtomic_reactivate_subscription).Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: pause a subscription so it is not billed or shipped until it is reactivated (awtomic_reactivate_subscription). A subscription in dunning is taken out of dunning. Awtomic runs the shop's own automations for this event, so the customer may get an email or SMS and webhooks may fire. Awtomic pauses it on its side even if Shopify rejects the pause. POST /customers/{customerId}/subscriptions/{subscriptionId}/pause.

    Annotations the server declares

    • title: Pause subscription
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • awtomic_reactivate_subscriptionWRITE: reactivate a paused or cancelled subscription, so billing resumes.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: reactivate a paused or cancelled subscription, so billing resumes. A cancelled prepaid subscription cannot be reactivated. Without next_billing_date Awtomic works it out from the subscription's interval; the customer is charged on that date. Awtomic runs the shop's own automations for this event, so the customer may get an email or SMS and webhooks may fire. POST /customers/{customerId}/subscriptions/{subscriptionId}/reactivate.

    Annotations the server declares

    • title: Reactivate subscription
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • awtomic_send_payment_update_emailWRITE: make Shopify email the customer a link to update their payment method for this subscription.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "awtomic_send_payment_update_email" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "awtomic_send_payment_update_email" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    WRITE: make Shopify email the customer a link to update their payment method for this subscription. This SENDS AN EMAIL TO THE CUSTOMER each time it is called. Use it for failed payments or expired cards, only when the user asks, and confirm_send must be true. POST /customers/{customerId}/subscriptions/{subscriptionId}/send-customer-payment-email.

    Annotations the server declares

    • title: Email customer to update payment method
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • awtomic_set_next_billing_dateWRITE: change when a subscription is next billed.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_set_next_billing_date" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change when a subscription is next billed. The date must be later than the end of today. A paused subscription is reactivated by this call, and one in dunning is taken out of dunning. The customer is charged on the new date. POST /customers/{customerId}/subscriptions/{subscriptionId}/next-billing-date.

    Annotations the server declares

    • title: Set next billing date
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • awtomic_skip_next_orderWRITE: skip a subscription's next order.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: skip a subscription's next order. The subscription must be active; Awtomic moves the next billing date by one interval (each call skips one more order, so do not repeat it). The reply has skipEventId: pass it to awtomic_undo_skip to undo. Awtomic runs the shop's own automations for this event, so the customer may get an email or SMS and webhooks may fire. POST /customers/{customerId}/subscriptions/{subscriptionId}/skip.

    Annotations the server declares

    • title: Skip next order
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • awtomic_undo_skipWRITE: undo a skipped order, restoring the billing date from before the skip.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: undo a skipped order, restoring the billing date from before the skip. Needs the skipEventId returned by awtomic_skip_next_order; Awtomic refuses (409) when the skip can no longer be undone. POST /customers/{customerId}/subscriptions/{subscriptionId}/next-billing-date with eventType UNDO_SKIP.

    Annotations the server declares

    • title: Undo skip
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • awtomic_update_frequencyWRITE: change how often a subscription is billed and delivered, for example every 2 WEEK or every 1 MONTH.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_update_frequency" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change how often a subscription is billed and delivered, for example every 2 WEEK or every 1 MONTH. Changes every future order of that subscription. POST /customers/{customerId}/subscriptions/{subscriptionId}/frequency.

    Annotations the server declares

    • title: Update subscription frequency
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Only reads 12Show 12 read-only tools
  • awtomic_get_customerA customer: name, email, phone, orders count, amount spent, customer-since date, Awtomic overrides and the ids of their subscription contracts.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_customer" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    A customer: name, email, phone, orders count, amount spent, customer-since date, Awtomic overrides and the ids of their subscription contracts. GET /customers/{customerId}.

    Annotations the server declares

    • title: Get customer
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_get_customer_addressesA customer's saved addresses and which one is the default.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_customer_addresses" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    A customer's saved addresses and which one is the default. GET /customers/{customerId}/address.

    Annotations the server declares

    • title: Get customer addresses
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_get_customer_payment_methodsA customer's payment methods on file: type (card, Shop Pay, PayPal), card brand, last digits, expiry and whether it was revoked.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_customer_payment_methods" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    A customer's payment methods on file: type (card, Shop Pay, PayPal), card brand, last digits, expiry and whether it was revoked. Never the full card number. Use it to spot expired cards before a renewal. GET /customers/{customerId}/payment-methods.

    Annotations the server declares

    • title: Get customer payment methods
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_get_origin_orderThe Shopify order that started a subscription (id, name, creation date).Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_origin_order" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The Shopify order that started a subscription (id, name, creation date). GET /customers/{customerId}/subscriptions/{subscriptionId}/origin-order.

    Annotations the server declares

    • title: Get subscription origin order
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_get_origin_order_fulfillmentsFulfillment status and the fulfillment orders (status, fulfill-at date) of a subscription's origin order.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_origin_order_fulfillments" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fulfillment status and the fulfillment orders (status, fulfill-at date) of a subscription's origin order. GET /customers/{customerId}/subscriptions/{subscriptionId}/origin-order/fulfillments.

    Annotations the server declares

    • title: Get origin order fulfillments
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_get_selling_plan_groupOne selling plan group with its selling plans (name, prepaid orders, gift support) and the products it applies to.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_selling_plan_group" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One selling plan group with its selling plans (name, prepaid orders, gift support) and the products it applies to. GET /shops/selling-plan-groups/{sellingPlanGroupId}.

    Annotations the server declares

    • title: Get selling plan group
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_get_subscriptionOne subscription contract with its lines (products, quantities, prices).Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_subscription" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One subscription contract with its lines (products, quantities, prices). Needs the customer id and the subscription id. GET /customers/{customerId}/subscriptions/{subscriptionId}.

    Annotations the server declares

    • title: Get subscription
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_get_successful_billing_countHow many billing attempts of a subscription succeeded, including those made before a migration from another subscription app.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_get_successful_billing_count" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    How many billing attempts of a subscription succeeded, including those made before a migration from another subscription app. GET /subscriptions/{subscriptionId}/total-successful-billing-count.

    Annotations the server declares

    • title: Get successful billing count
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_list_billing_attemptsA subscription's billing attempts: status (SUCCESS or FAILURE), error code and message, amount, currency and dates.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "awtomic_list_billing_attempts" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "message": it reads messages.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
    Description, as the server wrote it
    A subscription's billing attempts: status (SUCCESS or FAILURE), error code and message, amount, currency and dates. Use it to see why a renewal failed. GET /customers/{customerId}/subscriptions/{subscriptionId}/billing-attempts.

    Annotations the server declares

    • title: List billing attempts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_list_customer_subscriptionsList one customer's subscriptions (id, status, next billing date).Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_list_customer_subscriptions" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List one customer's subscriptions (id, status, next billing date). Set expand_lines to include each subscription's lines; that makes the reply much larger. GET /customers/{customerId}/subscriptions.

    Annotations the server declares

    • title: List a customer's subscriptions
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_list_selling_plan_groupsThe shop's selling plan groups (subscription plans): name, summary, options, position and whether it is a prepaid plan.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_list_selling_plan_groups" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The shop's selling plan groups (subscription plans): name, summary, options, position and whether it is a prepaid plan. Use the ids with awtomic_get_selling_plan_group. GET /shops/selling-plan-groups.

    Annotations the server declares

    • title: List selling plan groups
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • awtomic_list_subscriptionsList the shop's subscription contracts (id, status, next billing date and more), 100 per page by default.Reads text others writeNo findings

    Why it is in this group

    • The name "awtomic_list_subscriptions" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the shop's subscription contracts (id, status, next billing date and more), 100 per page by default. Use reverse to read the newest first. Pass next_cursor back as cursor for the next page. GET /subscriptions.

    Annotations the server declares

    • title: List shop subscriptions
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

63 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write21
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__awtomic__awtomic_send_payment_update_email"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http awtomic https://awtomic.usefulapi.io/mcp
claude mcp add --transport http awtomic https://awtomic.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__awtomic__awtomic_list_subscriptions",
      "mcp__awtomic__awtomic_get_subscription",
      "mcp__awtomic__awtomic_list_customer_subscriptions",
      "mcp__awtomic__awtomic_list_billing_attempts",
      "mcp__awtomic__awtomic_get_successful_billing_count",
      "mcp__awtomic__awtomic_get_origin_order",
      "mcp__awtomic__awtomic_get_origin_order_fulfillments",
      "mcp__awtomic__awtomic_get_customer",
      "mcp__awtomic__awtomic_get_customer_addresses",
      "mcp__awtomic__awtomic_get_customer_payment_methods",
      "mcp__awtomic__awtomic_list_selling_plan_groups",
      "mcp__awtomic__awtomic_get_selling_plan_group"
    ],
    "ask": [],
    "deny": [
      "mcp__awtomic__awtomic_pause_subscription",
      "mcp__awtomic__awtomic_reactivate_subscription",
      "mcp__awtomic__awtomic_skip_next_order",
      "mcp__awtomic__awtomic_undo_skip",
      "mcp__awtomic__awtomic_set_next_billing_date",
      "mcp__awtomic__awtomic_update_frequency",
      "mcp__awtomic__awtomic_cancel_customer_subscription",
      "mcp__awtomic__awtomic_order_now",
      "mcp__awtomic__awtomic_send_payment_update_email"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as awtomic. Review it before you use it.

Capability tags behind 21 rules
  • mcp__awtomic__awtomic_list_subscriptions untrusted-input
  • mcp__awtomic__awtomic_get_subscription untrusted-input
  • mcp__awtomic__awtomic_list_customer_subscriptions untrusted-input
  • mcp__awtomic__awtomic_list_billing_attempts private-data, untrusted-input
  • mcp__awtomic__awtomic_get_successful_billing_count untrusted-input
  • mcp__awtomic__awtomic_get_origin_order untrusted-input
  • mcp__awtomic__awtomic_get_origin_order_fulfillments untrusted-input
  • mcp__awtomic__awtomic_get_customer private-data, untrusted-input
  • mcp__awtomic__awtomic_get_customer_addresses untrusted-input
  • mcp__awtomic__awtomic_get_customer_payment_methods private-data, untrusted-input
  • mcp__awtomic__awtomic_list_selling_plan_groups untrusted-input
  • mcp__awtomic__awtomic_get_selling_plan_group untrusted-input
  • mcp__awtomic__awtomic_pause_subscription untrusted-input
  • mcp__awtomic__awtomic_reactivate_subscription untrusted-input
  • mcp__awtomic__awtomic_skip_next_order untrusted-input
  • mcp__awtomic__awtomic_undo_skip untrusted-input
  • mcp__awtomic__awtomic_set_next_billing_date untrusted-input
  • mcp__awtomic__awtomic_update_frequency untrusted-input
  • mcp__awtomic__awtomic_cancel_customer_subscription untrusted-input
  • mcp__awtomic__awtomic_order_now untrusted-input
  • mcp__awtomic__awtomic_send_payment_update_email untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/awtomic/verify?hash=0a168bc50ef0325329dbce076892a33f1af8e3d6fb596b709f76b824413c4d54" | jq -e '.changed == false'

Pinned hash 0a168bc50ef0, from Oct 24, 2026, 16:19 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/awtomic/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/awtomic
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/awtomic.svg)](https://anlyon.dev/servers/io.usefulapi/awtomic)

Source: MCP Registry · repository. Synced Oct 24, 2026, 17:17 UTC.