Funraise MCP by usefulapi
io.usefulapi/funraiseusefulapi.iostreamable-httpv1.0.0Scanned
Read Funraise supporters, donations, recurring gifts and forms; add notes, tasks and supporters.
28 tools: 1 can delete or cancel things, 5 change things and 22 only read.
- Reads private data · 6
- Reads text others write · 28
- Can send data out · 1
- No findings
Anlyon alternative
6 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
28 tools
Deletes or cancels 1Claude Code: deny
funraise_complete_taskWRITE: mark a task complete (sets the completed date to now; Funraise may also log an interaction if the task automation says so).Reads text others writeNo findings
Why it is in this group
- The description's first verb is "write": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: mark a task complete (sets the completed date to now; Funraise may also log an interaction if the task automation says so). PUT /api/v1/task/{id}/complete.
Annotations the server declares
- title: Complete a task
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
Changes things 5Claude Code: ask
funraise_create_household_noteWRITE: add a note to a household's record in Funraise.Reads text others writeNo findings
Why it is in this group
- The name "funraise_create_household_note" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: add a note to a household's record in Funraise. Creates a new note each call. POST /api/v2/household/{id}/note.
Annotations the server declares
- title: Add a note to a household
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
funraise_create_interactionWRITE: log an interaction (call, email, meeting) on a supporter's record.Reads text others writeNo findings
Why it is in this group
- The name "funraise_create_interaction" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: log an interaction (call, email, meeting) on a supporter's record. Creates a new interaction each call. POST /api/v1/interaction.
Annotations the server declares
- title: Log an interaction
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
funraise_create_supporterWRITE: create a supporter (donor) record in Funraise.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "funraise_create_supporter" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it WRITE: create a supporter (donor) record in Funraise. Creates a new record each call, so search with funraise_list_supporters (email) first to avoid duplicates. POST /api/v1/crm/supporter.
Annotations the server declares
- title: Create a supporter
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
funraise_create_supporter_noteWRITE: add a note to a supporter's record in Funraise.Reads text others writeNo findings
Why it is in this group
- The name "funraise_create_supporter_note" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: add a note to a supporter's record in Funraise. Creates a new note each call. POST /api/v2/supporter/{id}/note.
Annotations the server declares
- title: Add a note to a supporter
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
funraise_create_taskWRITE: create a task in Funraise, linked to a supporter or to a donation (give at least one).Reads text others writeNo findings
Why it is in this group
- The name "funraise_create_task" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: create a task in Funraise, linked to a supporter or to a donation (give at least one). Title is 40 characters at most. Creates a new task each call. POST /api/v2/task.
Annotations the server declares
- title: Create a task
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Only reads 22Show 22 read-only tools
funraise_get_addressOne address by id (street, city, state, postal code, country, primary flag, household and supporter).Reads text others writeNo findings
Why it is in this group
- The name "funraise_get_address" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One address by id (street, city, state, postal code, country, primary flag, household and supporter). GET /api/v1/address/{addressId}.
Annotations the server declares
- title: Get address
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_campaign_siteOne campaign site by UUID: configuration preview (payment options, goals, form, homepage, fundraiser settings).Reads text others writeNo findings
Why it is in this group
- The name "funraise_get_campaign_site" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One campaign site by UUID: configuration preview (payment options, goals, form, homepage, fundraiser settings). GET /api/v1/campaignSite/{uuid}.
Annotations the server declares
- title: Get campaign site
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_donationOne donation by its Funraise id: amount, date, supporter, household, form, allocation, dedication, fees, UTM, subscription.Reads text others writeNo findings
Why it is in this group
- The name "funraise_get_donation" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One donation by its Funraise id: amount, date, supporter, household, form, allocation, dedication, fees, UTM, subscription. GET /api/v1/crm/donation/{id}.
Annotations the server declares
- title: Get donation
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_householdOne household: name, salutation, member count, primary contact, preferred address, total giving.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "funraise_get_household" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One household: name, salutation, member count, primary contact, preferred address, total giving. GET /api/v1/household/{householdId}.
Annotations the server declares
- title: Get household
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_household_memberThe household membership of a supporter (household and supporter details).Reads text others writeNo findings
Why it is in this group
- The name "funraise_get_household_member" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The household membership of a supporter (household and supporter details). GET /api/v1/household/member/{supporterId}.
Annotations the server declares
- title: Get household of a supporter
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_interactionOne interaction by id.Reads text others writeNo findings
Why it is in this group
- The name "funraise_get_interaction" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One interaction by id. GET /api/v1/interaction/{id}.
Annotations the server declares
- title: Get interaction
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_noteOne note by id, with title, body, importance and author.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "funraise_get_note" says "get": a word for reading.
What it can reach
- private-dataThe name "funraise_get_note" says "get" and "note": it reads notes.
- private-dataThe description's first sentence says "note": it reads notes.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One note by id, with title, body, importance and author. GET /api/v2/note/{id}.
Annotations the server declares
- title: Get note
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_subscriptionOne recurring gift by id: status, frequency, amount, last and next payment date, cancel date, supporter.Reads text others writeNo findings
Why it is in this group
- The name "funraise_get_subscription" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One recurring gift by id: status, frequency, amount, last and next payment date, cancel date, supporter. GET /api/v1/crm/subscription/{id}.
Annotations the server declares
- title: Get recurring subscription
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_supporterOne supporter: name, email, phone, tags, opt-ins, household, primary address, institution.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "funraise_get_supporter" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it One supporter: name, email, phone, tags, opt-ins, household, primary address, institution. GET /api/v1/crm/supporter/{id}.
Annotations the server declares
- title: Get supporter
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_get_taskOne task by id: title, description, due date, status, assigned user, supporter, linked donation.Reads text others writeNo findings
Why it is in this group
- The name "funraise_get_task" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One task by id: title, description, due date, status, assigned user, supporter, linked donation. GET /api/v2/task/{id}.
Annotations the server declares
- title: Get task
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_campaign_sitesList campaign sites (fundraising pages), active by default or archived.Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_campaign_sites" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List campaign sites (fundraising pages), active by default or archived. Returns campaignSites with totalPageCount and totalRowCount. GET /api/v1/campaignSite/active or /archived.
Annotations the server declares
- title: List campaign sites
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_donationsList donations (transactions) with amount, date, supporter, form, campaign page, allocation, fees and tags.Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_donations" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List donations (transactions) with amount, date, supporter, form, campaign page, allocation, fees and tags. Filter by an exact transactionId, by last N hours, or by a lastUpdated timestamp; use last_id to continue from the last donation id of the previous page. GET /api/v1/crm/donation.
Annotations the server declares
- title: List donations
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_form_custom_questionsThe custom questions attached to a form.Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_form_custom_questions" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The custom questions attached to a form. GET /api/v2/form/{formId}/custom-question.
Annotations the server declares
- title: List form custom questions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_formsList donation and event forms, filtered by type, status and version.Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_forms" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List donation and event forms, filtered by type, status and version. Needs the CREATOR role on the key. GET /api/v1/form.
Annotations the server declares
- title: List forms
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_household_addressesAddresses of a household (paginated: list, page, pageSize, totalPageCount, totalRowCount).Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_household_addresses" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Addresses of a household (paginated: list, page, pageSize, totalPageCount, totalRowCount). GET /api/v1/household/{householdId}/address.
Annotations the server declares
- title: List household addresses
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_household_notesNotes on a household's record (paginated).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "funraise_list_household_notes" says "list": a word for reading.
What it can reach
- private-dataThe name "funraise_list_household_notes" says "list" and "note": it reads notes.
- private-dataThe description's first sentence says "note": it reads notes.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Notes on a household's record (paginated). GET /api/v2/household/{id}/note.
Annotations the server declares
- title: List household notes
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_subscriptionsList recurring gifts (subscriptions) with status, frequency, amount, next payment date and supporter.Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_subscriptions" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List recurring gifts (subscriptions) with status, frequency, amount, next payment date and supporter. The q filter is a Funraise expression (Funraise requires it; default: id > 0 order by id asc), for example: id > 10 and status = "Cancelled" order by id asc. GET /api/v1/crm/subscription.
Annotations the server declares
- title: List recurring subscriptions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_supporter_addressesAddresses of a supporter (paginated).Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_supporter_addresses" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Addresses of a supporter (paginated). GET /api/v1/supporter/{supporterId}/address.
Annotations the server declares
- title: List supporter addresses
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_supporter_interactionsThe interaction log of a supporter (calls, emails, meetings): subject, description, action, assigned user, dates.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "funraise_list_supporter_interactions" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it The interaction log of a supporter (calls, emails, meetings): subject, description, action, assigned user, dates. GET /api/v1/interaction/donor/{donorId}.
Annotations the server declares
- title: List supporter interactions
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_supporter_notesNotes on a supporter's record (paginated).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "funraise_list_supporter_notes" says "list": a word for reading.
What it can reach
- private-dataThe name "funraise_list_supporter_notes" says "list" and "note": it reads notes.
- private-dataThe description's first sentence says "note": it reads notes.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Notes on a supporter's record (paginated). GET /api/v2/supporter/{id}/note.
Annotations the server declares
- title: List supporter notes
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_supportersList supporters (donors) in the Funraise CRM, newest first as Funraise returns them.Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_supporters" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List supporters (donors) in the Funraise CRM, newest first as Funraise returns them. Filter by exact email or by records changed in the last N hours. GET /api/v1/crm/supporter.
Annotations the server declares
- title: List supporters
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
funraise_list_user_interactionsInteractions assigned to a Funraise user (staff member).Reads text others writeNo findings
Why it is in this group
- The name "funraise_list_user_interactions" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Interactions assigned to a Funraise user (staff member). GET /api/v1/interaction/user/{userId}.
Annotations the server declares
- title: List interactions assigned to a user
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
168 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.
- Reads private data6
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write28
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- funraise_complete_task
- funraise_create_household_note
- funraise_create_interaction
- funraise_create_supporter
- funraise_create_supporter_note
- funraise_create_task
- funraise_get_address
- funraise_get_campaign_site
- funraise_get_donation
- funraise_get_household
- funraise_get_household_member
- funraise_get_interaction
- and 16 more
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__funraise__funraise_create_supporter"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http funraise https://funraise.usefulapi.io/mcpclaude mcp add --transport http funraise https://funraise.usefulapi.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__funraise__funraise_list_supporters",
"mcp__funraise__funraise_get_supporter",
"mcp__funraise__funraise_list_donations",
"mcp__funraise__funraise_get_donation",
"mcp__funraise__funraise_list_subscriptions",
"mcp__funraise__funraise_get_subscription",
"mcp__funraise__funraise_list_forms",
"mcp__funraise__funraise_list_campaign_sites",
"mcp__funraise__funraise_get_campaign_site",
"mcp__funraise__funraise_list_form_custom_questions",
"mcp__funraise__funraise_get_household",
"mcp__funraise__funraise_get_household_member",
"mcp__funraise__funraise_list_household_addresses",
"mcp__funraise__funraise_list_supporter_addresses",
"mcp__funraise__funraise_get_address",
"mcp__funraise__funraise_list_supporter_notes",
"mcp__funraise__funraise_list_household_notes",
"mcp__funraise__funraise_get_note",
"mcp__funraise__funraise_list_supporter_interactions",
"mcp__funraise__funraise_list_user_interactions",
"mcp__funraise__funraise_get_interaction",
"mcp__funraise__funraise_get_task"
],
"ask": [
"mcp__funraise__funraise_create_supporter_note",
"mcp__funraise__funraise_create_household_note",
"mcp__funraise__funraise_create_interaction",
"mcp__funraise__funraise_create_task",
"mcp__funraise__funraise_create_supporter"
],
"deny": [
"mcp__funraise__funraise_complete_task"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as funraise. Review it before you use it.
Capability tags behind 28 rules
- mcp__funraise__funraise_list_supporters untrusted-input
- mcp__funraise__funraise_get_supporter private-data, untrusted-input
- mcp__funraise__funraise_list_donations untrusted-input
- mcp__funraise__funraise_get_donation untrusted-input
- mcp__funraise__funraise_list_subscriptions untrusted-input
- mcp__funraise__funraise_get_subscription untrusted-input
- mcp__funraise__funraise_list_forms untrusted-input
- mcp__funraise__funraise_list_campaign_sites untrusted-input
- mcp__funraise__funraise_get_campaign_site untrusted-input
- mcp__funraise__funraise_list_form_custom_questions untrusted-input
- mcp__funraise__funraise_get_household private-data, untrusted-input
- mcp__funraise__funraise_get_household_member untrusted-input
- mcp__funraise__funraise_list_household_addresses untrusted-input
- mcp__funraise__funraise_list_supporter_addresses untrusted-input
- mcp__funraise__funraise_get_address untrusted-input
- mcp__funraise__funraise_list_supporter_notes private-data, untrusted-input
- mcp__funraise__funraise_list_household_notes private-data, untrusted-input
- mcp__funraise__funraise_get_note private-data, untrusted-input
- mcp__funraise__funraise_list_supporter_interactions private-data, untrusted-input
- mcp__funraise__funraise_list_user_interactions untrusted-input
- mcp__funraise__funraise_get_interaction untrusted-input
- mcp__funraise__funraise_get_task untrusted-input
- mcp__funraise__funraise_create_supporter_note untrusted-input
- mcp__funraise__funraise_create_household_note untrusted-input
- mcp__funraise__funraise_create_interaction untrusted-input
- mcp__funraise__funraise_create_task untrusted-input
- mcp__funraise__funraise_complete_task untrusted-input
- mcp__funraise__funraise_create_supporter untrusted-input, outbound
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/funraise/verify?hash=7d71e6c604612518e2c0ba105a4318a0c18c1bc2dcb9cc0595b34a16a8d1d173" | jq -e '.changed == false'Pinned hash 7d71e6c60461, from Oct 25, 2026, 13:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.usefulapi/funraise/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.usefulapi/funraise)Source: MCP Registry · repository. Synced Oct 25, 2026, 13:17 UTC.