Cyberimpact MCP by usefulapi
io.usefulapi/cyberimpactusefulapi.iostreamable-httpv1.0.0Scanned
Read Cyberimpact members, groups and mailing results; add members, send opt-ins, create mailings.
25 tools: 3 can delete or cancel things, 4 change things and 18 only read.
- Reads private data · 5
- Reads text others write · 25
- Can send data out · 1
- No findings
Anlyon alternative
7 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
25 tools
Deletes or cancels 3Claude Code: deny
cyberimpact_create_mailingWRITE, SENDS EMAIL TO CUSTOMERS: create a mailing scheduled to be sent at send_at to every member of the chosen groups.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_create_mailing" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE, SENDS EMAIL TO CUSTOMERS: create a mailing scheduled to be sent at send_at to every member of the chosen groups. It goes out for real unless it is cancelled in the Cyberimpact app before send_at. Only call it after the user has approved the subject, body, sender and groups, and set confirm_send to true. mail_from must be a validated sender address of the account. A mailing cannot be deleted through this server. POST /mailings.
Annotations the server declares
- title: Schedule mailing
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
cyberimpact_send_optinWRITE, SENDS AN EMAIL to the given address: an opt-in confirmation request.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "cyberimpact_send_optin" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "cyberimpact_send_optin" says "send": it sends or publishes something to other people.
Description, as the server wrote it WRITE, SENDS AN EMAIL to the given address: an opt-in confirmation request. The person is added to the groups only after they confirm (the member is created if it does not exist). Use this instead of cyberimpact_add_member when you do not have the person's consent yet. Only call it after the user has approved sending to this address, and set confirm_send to true. Throttled by Cyberimpact. POST /members/optins.
Annotations the server declares
- title: Send opt-in email
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
cyberimpact_update_memberWRITE: change only the given attributes of a member (other attributes stay as they are).Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_update_member" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: change only the given attributes of a member (other attributes stay as they are). The old values of the changed fields are overwritten and not recoverable through the API. Set new_email to change the address. PATCH /members/{key}.
Annotations the server declares
- title: Update member
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
Changes things 4Claude Code: ask
cyberimpact_add_memberWRITE: add a contact as a subscribed member WITHOUT a confirmation email (implied consent) and put it in the given groups; the contact can then be mailed.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_add_member" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: add a contact as a subscribed member WITHOUT a confirmation email (implied consent) and put it in the given groups; the contact can then be mailed. Only use it for people who really gave their consent (CASL); to ask the person to confirm first use cyberimpact_send_optin. A member that already exists is rejected by the API. Throttled by Cyberimpact; for many contacts use the app's import. POST /members.
Annotations the server declares
- title: Add member
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
cyberimpact_add_member_to_groupsWRITE: add an existing member to more groups (existing group memberships are kept).Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_add_member_to_groups" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: add an existing member to more groups (existing group memberships are kept). Being in a group makes the member a recipient of mailings sent to it. Returns the member's groups after the update. POST /members/{key}/groups.
Annotations the server declares
- title: Add member to groups
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
cyberimpact_create_groupWRITE: create a new, empty group (mailing list).Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_create_group" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: create a new, empty group (mailing list). A public group can be offered on subscription forms; a private one is internal. Groups cannot be deleted through this server. POST /groups.
Annotations the server declares
- title: Create group
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
cyberimpact_create_templateWRITE: create a new email template from HTML and/or text.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_create_template" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: create a new email template from HTML and/or text. It is only saved in the account; nothing is sent. POST /templates.
Annotations the server declares
- title: Create template
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Only reads 18Show 18 read-only tools
cyberimpact_get_accountCheck the connection and show which Cyberimpact account the API token belongs to (username, email, account name).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_account" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it Check the connection and show which Cyberimpact account the API token belongs to (username, email, account name). GET /ping.
Annotations the server declares
- title: Get account
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_batchStatus of a bulk batch job (NEW, PROCESSING or COMPLETED) and its result.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_batch" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Status of a bulk batch job (NEW, PROCESSING or COMPLETED) and its result. Set show_error_details to list the per-member errors. GET /batches/{id}.
Annotations the server declares
- title: Get batch
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_groupOne group by id with its member count, mailing count and flags.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_group" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One group by id with its member count, mailing count and flags. GET /groups/{id}.
Annotations the server declares
- title: Get group
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_mailingOne mailing by id with its results: sent/delivered/stopped counts, views, clicks, delivery/click/view rates, per-link clicks, recipient groups, sender and body (HTML/text, cut at 2…Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_mailing" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "html": it reads web pages, which anyone can write.
Description, as the server wrote it One mailing by id with its results: sent/delivered/stopped counts, views, clicks, delivery/click/view rates, per-link clicks, recipient groups, sender and body (HTML/text, cut at 20 000 characters). GET /mailings/{id}.
Annotations the server declares
- title: Get mailing
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_memberOne member by email address or id: all attributes, consent type, mailings received/opened/clicked and custom fields (keyed by custom field id; see cyberimpact_list_custom_fields).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_member" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it One member by email address or id: all attributes, consent type, mailings received/opened/clicked and custom fields (keyed by custom field id; see cyberimpact_list_custom_fields). GET /members/{key}.
Annotations the server declares
- title: Get member
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_member_consentA member's consent record: consent type, relation type, consent date, expiration and proof (for CASL compliance checks).Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_member_consent" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it A member's consent record: consent type, relation type, consent date, expiration and proof (for CASL compliance checks). GET /members/{key}/consent.
Annotations the server declares
- title: Get member consent
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_member_groupsThe groups a member belongs to (id, title, public/private, dynamic).Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_member_groups" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The groups a member belongs to (id, title, public/private, dynamic). GET /members/{key}/groups.
Annotations the server declares
- title: Get member's groups
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_member_mailingsThe mailings a member received (use it to see what a contact was sent and when).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_member_mailings" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The mailings a member received (use it to see what a contact was sent and when). GET /members/{key}/mailings.
Annotations the server declares
- title: Get member's mailings
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_get_templateOne template by id with its HTML and text body (cut at 20 000 characters).Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_get_template" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "html": it reads web pages, which anyone can write.
Description, as the server wrote it One template by id with its HTML and text body (cut at 20 000 characters). GET /templates/{id}.
Annotations the server declares
- title: Get template
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_bounced_membersMembers whose last mailing hard-bounced (invalid addresses to clean up), with the bounce date.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_bounced_members" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Members whose last mailing hard-bounced (invalid addresses to clean up), with the bounce date. GET /members/bounced.
Annotations the server declares
- title: List bounced members
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_custom_fieldsThe account's custom member fields (id, name, type text/date/integer/decimal).Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_custom_fields" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The account's custom member fields (id, name, type text/date/integer/decimal). Member customFields are keyed by these ids. GET /customfields.
Annotations the server declares
- title: List custom fields
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_group_membersThe members of one group, with the same member filters as cyberimpact_list_members.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_group_members" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The members of one group, with the same member filters as cyberimpact_list_members. GET /groups/{id}/members.
Annotations the server declares
- title: List group members
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_groupsList the account's groups (mailing lists) with member and mailing counts, public/private and dynamic flags.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_groups" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List the account's groups (mailing lists) with member and mailing counts, public/private and dynamic flags. Use the ids to target mailings and opt-ins. GET /groups.
Annotations the server declares
- title: List groups
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_mailing_recipientsWho received a mailing and what happened: kind = all, delivered, stopped, hard_bounced, soft_bounced, unsubscribed, opened or clicked.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_mailing_recipients" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Who received a mailing and what happened: kind = all, delivered, stopped, hard_bounced, soft_bounced, unsubscribed, opened or clicked. Optionally only recipients from one group. GET /mailings/{id}/recipients[/{kind}].
Annotations the server declares
- title: List mailing recipients
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_mailingsList mailings by state: sent (default, archived ones excluded), scheduled (queued to go out) or archived.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_mailings" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List mailings by state: sent (default, archived ones excluded), scheduled (queued to go out) or archived. Each has id, subject, language, send/schedule date, recipient count and sender. Optionally only mailings sent to one group. GET /mailings/{sent|scheduled|archived}.
Annotations the server declares
- title: List mailings
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_membersList subscribed contacts (members) with name, email, language, consent type, mailing counts and custom fields.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_members" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it List subscribed contacts (members) with name, email, language, consent type, mailing counts and custom fields. status: active (in at least one group, default), orphans (in no group) or all. Filter by the date a member joined or was last updated. Bounced and unsubscribed members have their own tools. GET /members.
Annotations the server declares
- title: List members
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_templatesList the account's email templates (id, title, created/updated).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_templates" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it List the account's email templates (id, title, created/updated). GET /templates.
Annotations the server declares
- title: List templates
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
cyberimpact_list_unsubscribed_membersMembers who unsubscribed, with the unsubscribe date.Reads text others writeNo findings
Why it is in this group
- The name "cyberimpact_list_unsubscribed_members" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Members who unsubscribed, with the unsubscribe date. These contacts must not be mailed again. GET /members/unsubscribed.
Annotations the server declares
- title: List unsubscribed members
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
125 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.
- Reads private data5
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write25
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- cyberimpact_add_member
- cyberimpact_add_member_to_groups
- cyberimpact_create_group
- cyberimpact_create_mailing
- cyberimpact_create_template
- cyberimpact_get_account
- cyberimpact_get_batch
- cyberimpact_get_group
- cyberimpact_get_mailing
- cyberimpact_get_member
- cyberimpact_get_member_consent
- cyberimpact_get_member_groups
- and 13 more
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__cyberimpact__cyberimpact_send_optin"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http cyberimpact https://cyberimpact.usefulapi.io/mcpclaude mcp add --transport http cyberimpact https://cyberimpact.usefulapi.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__cyberimpact__cyberimpact_get_account",
"mcp__cyberimpact__cyberimpact_list_members",
"mcp__cyberimpact__cyberimpact_get_member",
"mcp__cyberimpact__cyberimpact_get_member_groups",
"mcp__cyberimpact__cyberimpact_get_member_mailings",
"mcp__cyberimpact__cyberimpact_get_member_consent",
"mcp__cyberimpact__cyberimpact_list_bounced_members",
"mcp__cyberimpact__cyberimpact_list_unsubscribed_members",
"mcp__cyberimpact__cyberimpact_list_custom_fields",
"mcp__cyberimpact__cyberimpact_list_groups",
"mcp__cyberimpact__cyberimpact_get_group",
"mcp__cyberimpact__cyberimpact_list_group_members",
"mcp__cyberimpact__cyberimpact_list_mailings",
"mcp__cyberimpact__cyberimpact_get_mailing",
"mcp__cyberimpact__cyberimpact_list_mailing_recipients",
"mcp__cyberimpact__cyberimpact_list_templates",
"mcp__cyberimpact__cyberimpact_get_template",
"mcp__cyberimpact__cyberimpact_get_batch"
],
"ask": [
"mcp__cyberimpact__cyberimpact_add_member",
"mcp__cyberimpact__cyberimpact_add_member_to_groups",
"mcp__cyberimpact__cyberimpact_create_group",
"mcp__cyberimpact__cyberimpact_create_template"
],
"deny": [
"mcp__cyberimpact__cyberimpact_update_member",
"mcp__cyberimpact__cyberimpact_send_optin",
"mcp__cyberimpact__cyberimpact_create_mailing"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as cyberimpact. Review it before you use it.
Capability tags behind 25 rules
- mcp__cyberimpact__cyberimpact_get_account private-data, untrusted-input
- mcp__cyberimpact__cyberimpact_list_members private-data, untrusted-input
- mcp__cyberimpact__cyberimpact_get_member private-data, untrusted-input
- mcp__cyberimpact__cyberimpact_get_member_groups untrusted-input
- mcp__cyberimpact__cyberimpact_get_member_mailings private-data, untrusted-input
- mcp__cyberimpact__cyberimpact_get_member_consent untrusted-input
- mcp__cyberimpact__cyberimpact_list_bounced_members untrusted-input
- mcp__cyberimpact__cyberimpact_list_unsubscribed_members untrusted-input
- mcp__cyberimpact__cyberimpact_list_custom_fields untrusted-input
- mcp__cyberimpact__cyberimpact_list_groups untrusted-input
- mcp__cyberimpact__cyberimpact_get_group untrusted-input
- mcp__cyberimpact__cyberimpact_list_group_members untrusted-input
- mcp__cyberimpact__cyberimpact_list_mailings untrusted-input
- mcp__cyberimpact__cyberimpact_get_mailing untrusted-input
- mcp__cyberimpact__cyberimpact_list_mailing_recipients untrusted-input
- mcp__cyberimpact__cyberimpact_list_templates private-data, untrusted-input
- mcp__cyberimpact__cyberimpact_get_template untrusted-input
- mcp__cyberimpact__cyberimpact_get_batch untrusted-input
- mcp__cyberimpact__cyberimpact_add_member untrusted-input
- mcp__cyberimpact__cyberimpact_update_member untrusted-input
- mcp__cyberimpact__cyberimpact_add_member_to_groups untrusted-input
- mcp__cyberimpact__cyberimpact_send_optin untrusted-input, outbound
- mcp__cyberimpact__cyberimpact_create_group untrusted-input
- mcp__cyberimpact__cyberimpact_create_template untrusted-input
- mcp__cyberimpact__cyberimpact_create_mailing untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/cyberimpact/verify?hash=ea8b3eeba23539112a3cf0b262333f8809b7e16b3c79139ae41ddeeb30faeacc" | jq -e '.changed == false'Pinned hash ea8b3eeba235, from Oct 24, 2026, 12:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.usefulapi/cyberimpact/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.usefulapi/cyberimpact)Source: MCP Registry · repository. Synced Oct 24, 2026, 12:17 UTC.