Skip to content
anlyon.devby Anlyon

Evenium MCP by usefulapi

io.usefulapi/eveniumusefulapi.iostreamable-httpv1.0.0Scanned

Read Evenium events, guests, contacts and hotels; register guests and update contacts and statuses.

19 tools: 3 can delete or cancel things, 2 change things and 14 only read.

Tools: 3 delete, 0 irreversible, 2 write, 14 read.
  • Reads private data · 7
  • Reads text others write · 19
  • Can send data out · 1
  • No findings

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

19 tools

Deletes or cancels 3Claude Code: deny
  • evenium_update_contactWRITE: change a contact's email, company or fields (only what you pass is sent).Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_update_contact" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change a contact's email, company or fields (only what you pass is sent). The change applies to the contact everywhere, including its guest records. PUT /contacts/{contactId}.

    Annotations the server declares

    • title: Update contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • evenium_update_guest_post_statusWRITE: set the attendance (post) status of a guest: PRESENT, NO_SHOW or UNKNOWN (for example after check-in).Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "evenium_update_guest_post_status" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "evenium_update_guest_post_status" says "update" and "post": it writes something other people read.
    Description, as the server wrote it
    WRITE: set the attendance (post) status of a guest: PRESENT, NO_SHOW or UNKNOWN (for example after check-in). PUT /events/{eventId}/guests/{contactId}/postStatus.

    Annotations the server declares

    • title: Update guest attendance
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • evenium_update_guest_statusWRITE: set the registration status of a guest at an event (e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_update_guest_status" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: set the registration status of a guest at an event (e.g. CONFIRMED, DECLINED, CANCELED). Can trigger Evenium's own workflows for that status. Read the current value first with evenium_get_guest_status. PUT /events/{eventId}/guests/{contactId}/status.

    Annotations the server declares

    • title: Update guest status
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 2Claude Code: ask
  • evenium_create_contactWRITE: add a contact to the address book (name, email, company, optional custom id and fields).Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_create_contact" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: add a contact to the address book (name, email, company, optional custom id and fields). Does not invite them to an event (use evenium_create_guest). May create a duplicate of an existing person: search with evenium_list_contacts first. POST /contacts.

    Annotations the server declares

    • title: Create contact
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • evenium_create_guestWRITE: invite a person to an event.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_create_guest" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: invite a person to an event. Either invite an existing contact (contact_id) or create a guest from scratch (first_name, last_name, email, ...), which may also create a new contact. The optional status sets the registration status (the invitation emails of the event may follow Evenium's own rules). POST /events/{eventId}/guests.

    Annotations the server declares

    • title: Create guest
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 14Show 14 read-only tools
  • evenium_get_contactOne contact by Evenium id or `ext:<customId>`: name, gender, email, company and fields.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_contact" says "get": a word for reading.

    What it can reach

    • private-dataThe name "evenium_get_contact" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One contact by Evenium id or `ext:<customId>`: name, gender, email, company and fields. GET /contacts/{contactId}.

    Annotations the server declares

    • title: Get contact
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_get_contact_eventsThe events a contact is invited to, with the contact's registration (status, post status, category) in each.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_contact_events" says "get": a word for reading.

    What it can reach

    • private-dataThe name "evenium_get_contact_events" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    The events a contact is invited to, with the contact's registration (status, post status, category) in each. Filter by event start, end or creation date. GET /contacts/{contactId}/events.

    Annotations the server declares

    • title: Get contact events
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_get_eventOne event by id: title, description, dates, status, site path and its fields (type, your external id, ...).Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_event" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One event by id: title, description, dates, status, site path and its fields (type, your external id, ...). GET /events/{eventId}.

    Annotations the server declares

    • title: Get event
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_get_event_partOne event part (session) by id: title, dates, nature, code, location and fields.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_event_part" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One event part (session) by id: title, dates, nature, code, location and fields. GET /events/{eventId}/eventParts/{eventPartId}.

    Annotations the server declares

    • title: Get event session
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_get_guestOne guest of an event, by contact id or by guest code: name, email, status, category and fields (event-only fields flagged).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_guest" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One guest of an event, by contact id or by guest code: name, email, status, category and fields (event-only fields flagged). Optionally include REGISTRATION (registrations to sessions), PRESENCE and SIGNATURE data. GET /events/{eventId}/guests/{contactId} or /guests/guestCode/{guestCode}.

    Annotations the server declares

    • title: Get guest
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_get_guest_accommodationsThe hotel room bookings of one guest at an event: room id, check-in and check-out dates, status.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_guest_accommodations" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The hotel room bookings of one guest at an event: room id, check-in and check-out dates, status. Not available on the evenium.net platform. GET /events/{eventId}/guests/{contactId}/accommodations.

    Annotations the server declares

    • title: Get guest accommodations
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_get_guest_post_statusThe attendance (post) status of one guest after the event: UNKNOWN, NO_SHOW or PRESENT.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_guest_post_status" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "evenium_get_guest_post_status" says "get" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    The attendance (post) status of one guest after the event: UNKNOWN, NO_SHOW or PRESENT. GET /events/{eventId}/guests/{contactId}/postStatus.

    Annotations the server declares

    • title: Get guest attendance
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_get_guest_statusThe registration status of one guest at an event (e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_get_guest_status" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The registration status of one guest at an event (e.g. CONFIRMED, DECLINED, CANCELED). GET /events/{eventId}/guests/{contactId}/status.

    Annotations the server declares

    • title: Get guest status
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_list_contactsList the contacts of the address book (id, your custom id, name, email, company and fields).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "evenium_list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "evenium_list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List the contacts of the address book (id, your custom id, name, email, company and fields). Filter by name, email, company or last update. GET /contacts.

    Annotations the server declares

    • title: List contacts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_list_event_part_registrationsThe registrations to one session: contact id, status, attendance, category and dates.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "evenium_list_event_part_registrations" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The registrations to one session: contact id, status, attendance, category and dates. With include_deleted, deleted registrations are returned too (status DELETED). GET /events/{eventId}/eventParts/{eventPartId}/registrations.

    Annotations the server declares

    • title: List session registrations
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_list_event_partsList the event parts (sessions, workshops, activities) of an event with title, dates, nature, code and location.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_list_event_parts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the event parts (sessions, workshops, activities) of an event with title, dates, nature, code and location. Filter by title and start/end/update dates. GET /events/{eventId}/eventParts.

    Annotations the server declares

    • title: List event sessions
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_list_eventsList the events of the Evenium account, with id, title, dates, status and creation date.Reads text others writeNo findings

    Why it is in this group

    • The name "evenium_list_events" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the events of the Evenium account, with id, title, dates, status and creation date. Filter by title (partial match), status and start/end/creation dates. Use an event id with the guest and session tools. GET /events.

    Annotations the server declares

    • title: List events
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_list_guestsList the guests (invited contacts) of an event with name, email, company, registration status (e.g.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "evenium_list_guests" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List the guests (invited contacts) of an event with name, email, company, registration status (e.g. CONFIRMED, DECLINED, UNANSWERED), category and fields. Filter by status, name, email, company or last update. GET /events/{eventId}/guests.

    Annotations the server declares

    • title: List guests
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • evenium_list_hotelsThe hotels of an event with name, group, stars, contact details and, if asked, full location and rooms.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "evenium_list_hotels" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The hotels of an event with name, group, stars, contact details and, if asked, full location and rooms. Not available on the evenium.net platform. GET /events/{eventId}/hotels.

    Annotations the server declares

    • title: List hotels
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

133 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data7
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write19
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__evenium__evenium_update_guest_post_status"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http evenium https://evenium.usefulapi.io/mcp
claude mcp add --transport http evenium https://evenium.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__evenium__evenium_list_events",
      "mcp__evenium__evenium_get_event",
      "mcp__evenium__evenium_list_guests",
      "mcp__evenium__evenium_get_guest",
      "mcp__evenium__evenium_get_guest_status",
      "mcp__evenium__evenium_get_guest_post_status",
      "mcp__evenium__evenium_get_guest_accommodations",
      "mcp__evenium__evenium_list_hotels",
      "mcp__evenium__evenium_list_contacts",
      "mcp__evenium__evenium_get_contact",
      "mcp__evenium__evenium_get_contact_events",
      "mcp__evenium__evenium_list_event_parts",
      "mcp__evenium__evenium_get_event_part",
      "mcp__evenium__evenium_list_event_part_registrations"
    ],
    "ask": [
      "mcp__evenium__evenium_create_guest",
      "mcp__evenium__evenium_create_contact"
    ],
    "deny": [
      "mcp__evenium__evenium_update_guest_status",
      "mcp__evenium__evenium_update_guest_post_status",
      "mcp__evenium__evenium_update_contact"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as evenium. Review it before you use it.

Capability tags behind 19 rules
  • mcp__evenium__evenium_list_events untrusted-input
  • mcp__evenium__evenium_get_event untrusted-input
  • mcp__evenium__evenium_list_guests private-data, untrusted-input
  • mcp__evenium__evenium_get_guest private-data, untrusted-input
  • mcp__evenium__evenium_get_guest_status untrusted-input
  • mcp__evenium__evenium_get_guest_post_status untrusted-input
  • mcp__evenium__evenium_get_guest_accommodations untrusted-input
  • mcp__evenium__evenium_list_hotels private-data, untrusted-input
  • mcp__evenium__evenium_create_guest untrusted-input
  • mcp__evenium__evenium_update_guest_status untrusted-input
  • mcp__evenium__evenium_update_guest_post_status untrusted-input, outbound
  • mcp__evenium__evenium_list_contacts private-data, untrusted-input
  • mcp__evenium__evenium_get_contact private-data, untrusted-input
  • mcp__evenium__evenium_get_contact_events private-data, untrusted-input
  • mcp__evenium__evenium_create_contact untrusted-input
  • mcp__evenium__evenium_update_contact untrusted-input
  • mcp__evenium__evenium_list_event_parts untrusted-input
  • mcp__evenium__evenium_get_event_part untrusted-input
  • mcp__evenium__evenium_list_event_part_registrations private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/evenium/verify?hash=6f10286634e1728b90fcf015531b2803a871f895fbf28e5297e3fac45f3f3702" | jq -e '.changed == false'

Pinned hash 6f10286634e1, from Oct 26, 2026, 00:26 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/evenium/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/evenium
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/evenium.svg)](https://anlyon.dev/servers/io.usefulapi/evenium)

Source: MCP Registry · repository. Synced Oct 26, 2026, 00:25 UTC.