Gumroad MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.4 · published by io.usefulapi

Read products, sales, subscribers and offer codes; verify, enable and disable product licenses.

Deletes · 6Changes · 1

Compare Registry entry

20 tools: 6 can delete or cancel things, 1 change things and 13 only read.

Scanned Oct 22, 2026

Deletes or cancels6Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things1Claude Code: ask: see these tools
Only reads13Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http gumroad https://gumroad.usefulapi.io/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

20 tools

Deletes or cancels 6Removes, cancels or revokes something.Claude Code: deny

gumroad_create_offer_codeCreate a new offer code (discount code) on a product.No findings
Why it is in this group
- The name "gumroad_create_offer_code" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Create a new offer code (discount code) on a product. Gumroad REST: POST /v2/products/{product_id}/offer_codes.
Annotations the server declares
- title: Create offer code
- destructiveHint: true
gumroad_disable_licenseDisable a product's license key.No findings
Why it is in this group
- The name "gumroad_disable_license" says "disable": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Disable a product's license key. Gumroad REST: PUT /v2/licenses/disable.
Annotations the server declares
- title: Disable license
- destructiveHint: true
gumroad_disable_productDisable (unpublish) a product so it can no longer be sold.No findings
Why it is in this group
- The name "gumroad_disable_product" says "disable": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Disable (unpublish) a product so it can no longer be sold. Gumroad REST: PUT /v2/products/{id}/disable.
Annotations the server declares
- title: Disable product
- destructiveHint: true
gumroad_enable_licenseEnable a product's license key.No findings
Why it is in this group
- The name "gumroad_enable_license" says "enable": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Enable a product's license key. Gumroad REST: PUT /v2/licenses/enable.
Annotations the server declares
- title: Enable license
- destructiveHint: true
gumroad_enable_productEnable (publish) a product so it can be sold.No findings
Why it is in this group
- The name "gumroad_enable_product" says "enable": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Enable (publish) a product so it can be sold. Gumroad REST: PUT /v2/products/{id}/enable.
Annotations the server declares
- title: Enable product
- destructiveHint: true
gumroad_update_offer_codeUpdate an existing offer code on a product (its code text and/or its max purchase count).No findings
Why it is in this group
- The name "gumroad_update_offer_code" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Update an existing offer code on a product (its code text and/or its max purchase count). Gumroad REST: PUT /v2/products/{product_id}/offer_codes/{id}.
Annotations the server declares
- title: Update offer code
- destructiveHint: true

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

gumroad_verify_licenseVerify a license key for a product (checks validity and returns purchase details).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Verify a license key for a product (checks validity and returns purchase details). By default this does NOT increment the uses count; with increment_uses_count: true it records a use (a write). Gumroad REST: POST /v2/licenses/verify.
Annotations the server declares
- title: Verify license
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false

Only reads 13Looks things up and changes nothing.Claude Code: allow

gumroad_get_offer_codeGet a single offer code on a product by id.No findings
Why it is in this group
- The name "gumroad_get_offer_code" says "get": a word for reading.
Description, as the server wrote it
Get a single offer code on a product by id. Gumroad REST: GET /v2/products/{product_id}/offer_codes/{id}.
Annotations the server declares
- title: Get offer code
- readOnlyHint: true
gumroad_get_productGet a single product by id.No findings
Why it is in this group
- The name "gumroad_get_product" says "get": a word for reading.
Description, as the server wrote it
Get a single product by id. Gumroad REST: GET /v2/products/{id}.
Annotations the server declares
- title: Get product
- readOnlyHint: true
gumroad_get_saleGet a single sale by id.No findings
Why it is in this group
- The name "gumroad_get_sale" says "get": a word for reading.
Description, as the server wrote it
Get a single sale by id. Gumroad REST: GET /v2/sales/{id}.
Annotations the server declares
- title: Get sale
- readOnlyHint: true
gumroad_get_subscriberGet a single subscriber by id.No findings
Why it is in this group
- The name "gumroad_get_subscriber" says "get": a word for reading.
Description, as the server wrote it
Get a single subscriber by id. Gumroad REST: GET /v2/subscribers/{id}.
Annotations the server declares
- title: Get subscriber
- readOnlyHint: true
gumroad_get_userGet the authenticated user associated with the current Gumroad access token.No findings
Why it is in this group
- The name "gumroad_get_user" says "get": a word for reading.
Description, as the server wrote it
Get the authenticated user associated with the current Gumroad access token. Gumroad REST: GET /v2/user.
Annotations the server declares
- title: Get user
- readOnlyHint: true
gumroad_get_variant_categoryGet a single variant category on a product by id.No findings
Why it is in this group
- The name "gumroad_get_variant_category" says "get": a word for reading.
Description, as the server wrote it
Get a single variant category on a product by id. Gumroad REST: GET /v2/products/{product_id}/variant_categories/{id}.
Annotations the server declares
- title: Get variant category
- readOnlyHint: true
gumroad_list_custom_fieldsList a product's custom fields (extra fields collected at checkout).No findings
Why it is in this group
- The name "gumroad_list_custom_fields" says "list": a word for reading.
Description, as the server wrote it
List a product's custom fields (extra fields collected at checkout). Gumroad REST: GET /v2/products/{product_id}/custom_fields.
Annotations the server declares
- title: List custom fields
- readOnlyHint: true
gumroad_list_offer_codesList a product's offer codes (discount codes).No findings
Why it is in this group
- The name "gumroad_list_offer_codes" says "list": a word for reading.
Description, as the server wrote it
List a product's offer codes (discount codes). Gumroad REST: GET /v2/products/{product_id}/offer_codes.
Annotations the server declares
- title: List offer codes
- readOnlyHint: true
gumroad_list_productsList all of the authenticated user's products.No findings
Why it is in this group
- The name "gumroad_list_products" says "list": a word for reading.
Description, as the server wrote it
List all of the authenticated user's products. Gumroad REST: GET /v2/products.
Annotations the server declares
- title: List products
- readOnlyHint: true
gumroad_list_resource_subscriptionsList the authenticated user's resource subscriptions (webhooks) for a given resource/event name.No findings
Why it is in this group
- The name "gumroad_list_resource_subscriptions" says "list": a word for reading.
Description, as the server wrote it
List the authenticated user's resource subscriptions (webhooks) for a given resource/event name. Gumroad REST: GET /v2/resource_subscriptions.
Annotations the server declares
- title: List resource subscriptions
- readOnlyHint: true
gumroad_list_salesList/filter the authenticated user's successful sales, most recent first.No findings
Why it is in this group
- The name "gumroad_list_sales" says "list": a word for reading.
Description, as the server wrote it
List/filter the authenticated user's successful sales, most recent first. Supports date, email, product/order filters and cursor pagination via page_key. Gumroad REST: GET /v2/sales.
Annotations the server declares
- title: List sales
- readOnlyHint: true
gumroad_list_subscribersList a membership/subscription product's subscribers, optionally filtered by buyer email.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "gumroad_list_subscribers" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it
List a membership/subscription product's subscribers, optionally filtered by buyer email. Gumroad REST: GET /v2/products/{product_id}/subscribers.
Annotations the server declares
- title: List subscribers
- readOnlyHint: true
gumroad_list_variant_categoriesList a product's variant categories (option groups).No findings
Why it is in this group
- The name "gumroad_list_variant_categories" says "list": a word for reading.
Description, as the server wrote it
List a product's variant categories (option groups). Gumroad REST: GET /v2/products/{product_id}/variant_categories.
Annotations the server declares
- title: List variant categories
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; gumroad_list_subscribers
Reads text others write1: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; gumroad_list_subscribers
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:29 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 7
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: https://gumroad.usefulapi.io/.well-known/oauth-protected-resource/mcp
Authorization servers: https://gumroad.usefulapi.io
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: no

HighThe whole server
The endpoint served tools/list without credentials, and the list has 7 tools that change things (6 destructive, 1 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://gumroad.usefulapi.io/mcp: tools/list returned 20 tools to an anonymous client, including gumroad_enable_product (destructive), gumroad_disable_product (destructive), gumroad_create_offer_code (destructive), gumroad_update_offer_code (destructive), gumroad_enable_license (destructive) and 2 more
What this check looks for

Install

Pinned to version 1.16.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http gumroad https://gumroad.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__gumroad__gumroad_get_user",
      "mcp__gumroad__gumroad_list_products",
      "mcp__gumroad__gumroad_get_product",
      "mcp__gumroad__gumroad_list_sales",
      "mcp__gumroad__gumroad_get_sale",
      "mcp__gumroad__gumroad_list_subscribers",
      "mcp__gumroad__gumroad_get_subscriber",
      "mcp__gumroad__gumroad_list_offer_codes",
      "mcp__gumroad__gumroad_get_offer_code",
      "mcp__gumroad__gumroad_list_variant_categories",
      "mcp__gumroad__gumroad_get_variant_category",
      "mcp__gumroad__gumroad_list_custom_fields",
      "mcp__gumroad__gumroad_list_resource_subscriptions"
    ],
    "ask": [
      "mcp__gumroad__gumroad_verify_license"
    ],
    "deny": [
      "mcp__gumroad__gumroad_enable_product",
      "mcp__gumroad__gumroad_disable_product",
      "mcp__gumroad__gumroad_create_offer_code",
      "mcp__gumroad__gumroad_update_offer_code",
      "mcp__gumroad__gumroad_enable_license",
      "mcp__gumroad__gumroad_disable_license"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as gumroad. Review it before you use it.

Capability tags behind 1 rule

mcp__gumroad__gumroad_list_subscribers private-data, untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/gumroad/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 22, 2026, 11:18 UTC.

For agents: Markdown · JSON · report this listing