Skip to content

Rewardful MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.4 · published by io.usefulapi

Browse affiliates, referrals, commissions and payouts, and set up campaigns and affiliates.

Deletes · 7
CompareRegistry entry

20 tools: 7 can delete or cancel things and 13 only read.

Scanned Oct 22, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http rewardful https://rewardful.usefulapi.io/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

20 tools

Deletes or cancels 7Claude Code: deny
  • rewardful_create_affiliateAdd an affiliate (or a customer referrer, by passing stripe_customer_id).No findings

    Why it is in this group

    • The name "rewardful_create_affiliate" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Add an affiliate (or a customer referrer, by passing stripe_customer_id). Rewardful sends NO welcome email for API-created affiliates. Rewardful: POST /v1/affiliates.

    Annotations the server declares

    • title: Create an affiliate
    • destructiveHint: true
  • rewardful_create_affiliate_couponAssign a coupon / promotion code to an affiliate so sales using it are credited to them.No findings

    Why it is in this group

    • The name "rewardful_create_affiliate_coupon" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Assign a coupon / promotion code to an affiliate so sales using it are credited to them. The code must match one defined in Stripe, and the affiliate's campaign must have a campaign coupon set in the dashboard. Rewardful: POST /v1/affiliate_coupons.

    Annotations the server declares

    • title: Create an affiliate coupon
    • destructiveHint: true
  • rewardful_create_campaignCreate a new affiliate campaign with its reward rule.No findings

    Why it is in this group

    • The name "rewardful_create_campaign" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a new affiliate campaign with its reward rule. For reward_type percent pass commission_percent; for amount pass commission_amount_cents and commission_amount_currency. Rewardful: POST /v1/campaigns.

    Annotations the server declares

    • title: Create a campaign
    • destructiveHint: true
  • rewardful_update_affiliateChange an affiliate's name, email, payout emails, notifications, campaign (moves them) or state.No findings

    Why it is in this group

    • The name "rewardful_update_affiliate" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change an affiliate's name, email, payout emails, notifications, campaign (moves them) or state. Setting state to disabled stops tracking and earning; set it back to active to undo. Rewardful: PUT /v1/affiliates/:id.

    Annotations the server declares

    • title: Update an affiliate
    • destructiveHint: true
  • rewardful_update_campaignChange a campaign's name, URL, visibility, reward rule, payout minimum or coupon.No findings

    Why it is in this group

    • The name "rewardful_update_campaign" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change a campaign's name, URL, visibility, reward rule, payout minimum or coupon. Only the fields you pass change. Rewardful: PUT /v1/campaigns/:id.

    Annotations the server declares

    • title: Update a campaign
    • destructiveHint: true
Only reads 13Claude Code: allow
  • rewardful_get_affiliateFetch a single affiliate by id, including their campaign, links, coupon and visitor/lead/conversion counts.No findings

    Why it is in this group

    • The name "rewardful_get_affiliate" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single affiliate by id, including their campaign, links, coupon and visitor/lead/conversion counts. Rewardful: GET /v1/affiliates/:id.

    Annotations the server declares

    • title: Get one affiliate
    • readOnlyHint: true
  • rewardful_get_affiliate_couponFetch a single affiliate coupon by id.No findings

    Why it is in this group

    • The name "rewardful_get_affiliate_coupon" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single affiliate coupon by id. Rewardful: GET /v1/affiliate_coupons/:id.

    Annotations the server declares

    • title: Get one affiliate coupon
    • readOnlyHint: true
  • rewardful_get_campaignFetch a single campaign by id.No findings

    Why it is in this group

    • The name "rewardful_get_campaign" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single campaign by id. Rewardful: GET /v1/campaigns/:id.

    Annotations the server declares

    • title: Get one campaign
    • readOnlyHint: true
  • rewardful_get_commissionFetch a single commission by id, with its campaign and the sale (charge, refund and tax amounts, referral, customer, affiliate) that earned it.No findings

    Why it is in this group

    • The name "rewardful_get_commission" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single commission by id, with its campaign and the sale (charge, refund and tax amounts, referral, customer, affiliate) that earned it. Rewardful: GET /v1/commissions/:id.

    Annotations the server declares

    • title: Get one commission
    • readOnlyHint: true
  • rewardful_get_payoutFetch a single payout by id, with the affiliate and the commissions it bundles.No findings

    Why it is in this group

    • The name "rewardful_get_payout" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single payout by id, with the affiliate and the commissions it bundles. Rewardful: GET /v1/payouts/:id.

    Annotations the server declares

    • title: Get one payout
    • readOnlyHint: true
  • rewardful_list_affiliate_couponsList affiliate coupon / promotion codes (token, Stripe id, leads, conversions, archived), optionally for one affiliate.No findings

    Why it is in this group

    • The name "rewardful_list_affiliate_coupons" says "list": a word for reading.
    Description, as the server wrote it
    List affiliate coupon / promotion codes (token, Stripe id, leads, conversions, archived), optionally for one affiliate. Rewardful: GET /v1/affiliate_coupons.

    Annotations the server declares

    • title: List affiliate coupons
    • readOnlyHint: true
  • rewardful_list_affiliatesList affiliates, newest first, with visitors/leads/conversions.No findings

    Why it is in this group

    • The name "rewardful_list_affiliates" says "list": a word for reading.
    Description, as the server wrote it
    List affiliates, newest first, with visitors/leads/conversions. Filter by campaign, or look one up by email or Stripe customer id (returns zero or one). Expand campaign, links or commission_stats for more detail. Rewardful: GET /v1/affiliates.

    Annotations the server declares

    • title: List affiliates
    • readOnlyHint: true
  • rewardful_list_campaignsList the affiliate program's campaigns with their reward rules (percent or fixed commission, payout minimum, referral expiry) and totals (visitors, leads, conversions, affiliates).No findings

    Why it is in this group

    • The name "rewardful_list_campaigns" says "list": a word for reading.
    Description, as the server wrote it
    List the affiliate program's campaigns with their reward rules (percent or fixed commission, payout minimum, referral expiry) and totals (visitors, leads, conversions, affiliates). Rewardful: GET /v1/campaigns.

    Annotations the server declares

    • title: List campaigns
    • readOnlyHint: true
  • rewardful_list_commissionsList commissions (rewards owed for referred customers' payments) newest first, with amount in cents, currency and state (pending, due, paid, voided).No findings

    Why it is in this group

    • The name "rewardful_list_commissions" says "list": a word for reading.
    Description, as the server wrote it
    List commissions (rewards owed for referred customers' payments) newest first, with amount in cents, currency and state (pending, due, paid, voided). Filter by affiliate or state; expand the sale (with referral, customer and affiliate) or campaign. Rewardful: GET /v1/commissions.

    Annotations the server declares

    • title: List commissions
    • readOnlyHint: true
  • rewardful_list_payoutsList payouts — bundles of an affiliate's payable commissions — newest first, with amount, currency and state (pending, due, processing, paid).No findings

    Why it is in this group

    • The name "rewardful_list_payouts" says "list": a word for reading.
    Description, as the server wrote it
    List payouts — bundles of an affiliate's payable commissions — newest first, with amount, currency and state (pending, due, processing, paid). Filter by affiliate or state; expand affiliate or commissions. Rewardful: GET /v1/payouts.

    Annotations the server declares

    • title: List payouts
    • readOnlyHint: true
  • rewardful_list_referralsList referrals — visitors who arrived via an affiliate link — newest first, with their conversion state (visitor, lead, conversion), customer and link.No findings

    Why it is in this group

    • The name "rewardful_list_referrals" says "list": a word for reading.
    Description, as the server wrote it
    List referrals — visitors who arrived via an affiliate link — newest first, with their conversion state (visitor, lead, conversion), customer and link. Filter by affiliate, state, email, Stripe customer or an updated-at window. Rewardful: GET /v1/referrals.

    Annotations the server declares

    • title: List referrals
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.16.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http rewardful https://rewardful.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__rewardful__rewardful_list_campaigns",
      "mcp__rewardful__rewardful_get_campaign",
      "mcp__rewardful__rewardful_list_affiliates",
      "mcp__rewardful__rewardful_get_affiliate",
      "mcp__rewardful__rewardful_list_affiliate_links",
      "mcp__rewardful__rewardful_get_affiliate_link",
      "mcp__rewardful__rewardful_list_affiliate_coupons",
      "mcp__rewardful__rewardful_get_affiliate_coupon",
      "mcp__rewardful__rewardful_list_referrals",
      "mcp__rewardful__rewardful_list_commissions",
      "mcp__rewardful__rewardful_get_commission",
      "mcp__rewardful__rewardful_list_payouts",
      "mcp__rewardful__rewardful_get_payout"
    ],
    "ask": [],
    "deny": [
      "mcp__rewardful__rewardful_create_campaign",
      "mcp__rewardful__rewardful_update_campaign",
      "mcp__rewardful__rewardful_create_affiliate",
      "mcp__rewardful__rewardful_update_affiliate",
      "mcp__rewardful__rewardful_create_affiliate_link",
      "mcp__rewardful__rewardful_update_affiliate_link",
      "mcp__rewardful__rewardful_create_affiliate_coupon"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as rewardful. Review it before you use it.

Capability tags behind 1 rule
  • mcp__rewardful__rewardful_list_affiliate_links untrusted-input