Skip to content
anlyon.devby Anlyon

WaiverFile MCP by usefulapi

io.usefulapi/waiverfileusefulapi.iostreamable-httpv1.0.0Scanned

Read WaiverFile waivers, events, forms and SMS opt-ins; create and update events, invite managers.

17 tools: 2 can delete or cancel things, 3 change things and 12 only read.

Tools: 2 delete, 0 irreversible, 3 write, 12 read.
  • Reads private data · 4
  • Reads text others write · 17
  • Can send data out · 1
  • No findings

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

17 tools

Deletes or cancels 2Claude Code: deny
  • waiverfile_invite_event_managersSENDS EMAIL: invites people (by email address) to manage one event; they can log in to WaiverFile and see its signers and participants, with the fields set in the account settings.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "waiverfile_invite_event_managers" says "invite": a word for sending, and what is sent cannot be taken back.
    • The description says "Cannot be undone".
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "waiverfile_invite_event_managers" says "invite": it sends or publishes something to other people.
    Description, as the server wrote it
    SENDS EMAIL: invites people (by email address) to manage one event; they can log in to WaiverFile and see its signers and participants, with the fields set in the account settings. WaiverFile emails each address, with your optional message in the body (skip_email_if_account_exists suppresses the email for people who already have an account). Cannot be undone by this server except with the vendor's own remove-managers action. Requires confirm=true after the user approved it. POST /InviteEventManagers.

    Annotations the server declares

    • title: Invite event managers (sends email)
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • waiverfile_update_eventUpdate an existing event.Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_update_event" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Update an existing event. WaiverFile replaces the whole event, so name, start, end and all_day are required and anything left out is reset: category_id empty = no category, waiver_form_ids empty = ALL active forms are attached. Read the event first (waiverfile_list_events) and send its current values for the fields you do not change. Same input twice gives the same result. POST /UpdateEvent.

    Annotations the server declares

    • title: Update an event
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 3Claude Code: ask
  • waiverfile_create_eventCreate a waiver event (a class, tour or session that collects waivers) with a name and a start/end time (UTC).Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_create_event" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a waiver event (a class, tour or session that collects waivers) with a name and a start/end time (UTC). Optionally an all-day flag, category, location, signing cut-off, participant limit and which waiver forms to attach (default: WaiverFile's own choice, see list_waiver_forms). Not idempotent: calling twice creates two events. Sends no email. POST /InsertEvent.

    Annotations the server declares

    • title: Create an event
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • waiverfile_create_event_categoryCreate an event category (a label to group events).Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_create_event_category" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create an event category (a label to group events). Not idempotent: calling twice with the same name creates two categories. POST /InsertEventCategory.

    Annotations the server declares

    • title: Create an event category
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • waiverfile_export_waiver_dataA page of flat waiver rows for a date range (the data behind the WaiverFile export): standard fields, optionally every custom form field as a column, and participants either as one…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    A page of flat waiver rows for a date range (the data behind the WaiverFile export): standard fields, optionally every custom form field as a column, and participants either as one comma-separated column or one row each. Personal data of signers. GET /GetWaiverData.

    Annotations the server declares

    • title: Export waiver data
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Only reads 12Show 12 read-only tools
  • waiverfile_count_waiversHow many waivers a date range holds: record_count (GetWaiverDataCount, the rows waiverfile_export_waiver_data pages through) and waiver_count (GetAllWaiversByDateRangePageCount, wh…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_count_waivers" says "count": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    How many waivers a date range holds: record_count (GetWaiverDataCount, the rows waiverfile_export_waiver_data pages through) and waiver_count (GetAllWaiversByDateRangePageCount, which WaiverFile documents as the number of waivers in the range, used to work out the pages of waiverfile_list_waivers). pages_at_page_size is waiver_count divided by page_size (default 25), rounded up. GET /GetWaiverDataCount and /GetAllWaiversByDateRangePageCount.

    Annotations the server declares

    • title: Count waivers in a date range
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_find_waivers_by_referenceFind waivers by the reference ids an outside booking or reservation system attached to them (referenceID1, 2, 3).Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_find_waivers_by_reference" says "find": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find waivers by the reference ids an outside booking or reservation system attached to them (referenceID1, 2, 3). Give at least one of reference_id_1/2/3, or reference_id_any to match all three fields. GET /GetWaiversByReferenceID.

    Annotations the server declares

    • title: Find waivers by reference id
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_get_event_waiversThe waivers collected for one event: who signed, when, and the participants.Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_get_event_waivers" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The waivers collected for one event: who signed, when, and the participants. Personal data of signers. GET /GetWaiversForEvent.

    Annotations the server declares

    • title: Get waivers for an event
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_get_siteDetails of the WaiverFile site (WaiverSite) this API key belongs to: name, settings and plan information as WaiverFile reports them.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_get_site" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Details of the WaiverFile site (WaiverSite) this API key belongs to: name, settings and plan information as WaiverFile reports them. GET /GetSiteDetails.

    Annotations the server declares

    • title: Get site details
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_get_waiverOne signed waiver by id: signer, date signed, participants, collected form data, event and the agreement text.Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_get_waiver" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One signed waiver by id: signer, date signed, participants, collected form data, event and the agreement text. Set lite for only the collected form data (no agreement text or event info). Signature and image bytes are never returned. GET /GetWaiver or /GetWaiverLite.

    Annotations the server declares

    • title: Get a waiver
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_list_event_categoriesList the event categories of the site (id and name).Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_list_event_categories" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the event categories of the site (id and name). Use the ids to filter events or to put a new event in a category. GET /GetEventCategories.

    Annotations the server declares

    • title: List event categories
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_list_eventsList waiver events (a class, tour, party or session that collects waivers) whose date falls in a range, optionally only one event category.Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_list_events" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List waiver events (a class, tour, party or session that collects waivers) whose date falls in a range, optionally only one event category. Each event has an id, name, start/end, headcount and spots remaining. Dates are UTC. GET /GetEventsByDateRange or /GetEventsByCategory.

    Annotations the server declares

    • title: List events by date range
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_list_sms_subscribersSMS marketing subscribers (phone numbers) that opted in during a date range, or with opted_out set the ones that opted out.Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_list_sms_subscribers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    SMS marketing subscribers (phone numbers) that opted in during a date range, or with opted_out set the ones that opted out. Dates are UTC. Personal data. GET /GetSubscribersByDate or /GetOptedOutSubscribersByOptOutDate.

    Annotations the server declares

    • title: List SMS subscribers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_list_upcoming_eventsList upcoming waiver events between two dates (UTC), for example the next 7 days.Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_list_upcoming_events" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List upcoming waiver events between two dates (UTC), for example the next 7 days. GET /GetUpcomingEvents.

    Annotations the server declares

    • title: List upcoming events
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_list_waiver_formsList the waiver forms of the site (name, id, which fields they collect: email, address, phone, date of birth, minimum age, signature).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_list_waiver_forms" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List the waiver forms of the site (name, id, which fields they collect: email, address, phone, date of birth, minimum age, signature). Active forms by default; set include_deleted for all forms including deleted ones. Use the form ids when creating or updating events. GET /GetActiveWaiverForms or /GetAllWaiverForms.

    Annotations the server declares

    • title: List waiver forms
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_list_waiversA page of the waivers signed in a date range.Reads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_list_waivers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    A page of the waivers signed in a date range. Set lite for only the collected form data (smaller). For a flat export with custom form columns use waiverfile_export_waiver_data; for totals use waiverfile_count_waivers. Personal data of signers. GET /GetAllWaiversByDateRange or /GetAllWaiversByDateRangeLite.

    Annotations the server declares

    • title: List waivers by date range
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • waiverfile_search_waiversSearch signed waivers by free-text terms (a signer's name, email or phone).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "waiverfile_search_waivers" says "search": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "search" and "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "search" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Search signed waivers by free-text terms (a signer's name, email or phone). Personal data of signers. GET /SearchWaivers.

    Annotations the server declares

    • title: Search waivers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

68 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data4
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write17
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__waiverfile__waiverfile_invite_event_managers"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http waiverfile https://waiverfile.usefulapi.io/mcp
claude mcp add --transport http waiverfile https://waiverfile.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__waiverfile__waiverfile_get_site",
      "mcp__waiverfile__waiverfile_list_waiver_forms",
      "mcp__waiverfile__waiverfile_list_events",
      "mcp__waiverfile__waiverfile_list_upcoming_events",
      "mcp__waiverfile__waiverfile_list_event_categories",
      "mcp__waiverfile__waiverfile_get_event_waivers",
      "mcp__waiverfile__waiverfile_search_waivers",
      "mcp__waiverfile__waiverfile_get_waiver",
      "mcp__waiverfile__waiverfile_find_waivers_by_reference",
      "mcp__waiverfile__waiverfile_list_waivers",
      "mcp__waiverfile__waiverfile_count_waivers",
      "mcp__waiverfile__waiverfile_list_sms_subscribers"
    ],
    "ask": [
      "mcp__waiverfile__waiverfile_export_waiver_data",
      "mcp__waiverfile__waiverfile_create_event",
      "mcp__waiverfile__waiverfile_create_event_category"
    ],
    "deny": [
      "mcp__waiverfile__waiverfile_update_event",
      "mcp__waiverfile__waiverfile_invite_event_managers"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as waiverfile. Review it before you use it.

Capability tags behind 17 rules
  • mcp__waiverfile__waiverfile_get_site private-data, untrusted-input
  • mcp__waiverfile__waiverfile_list_waiver_forms private-data, untrusted-input
  • mcp__waiverfile__waiverfile_list_events untrusted-input
  • mcp__waiverfile__waiverfile_list_upcoming_events untrusted-input
  • mcp__waiverfile__waiverfile_list_event_categories untrusted-input
  • mcp__waiverfile__waiverfile_get_event_waivers untrusted-input
  • mcp__waiverfile__waiverfile_search_waivers private-data, untrusted-input
  • mcp__waiverfile__waiverfile_get_waiver untrusted-input
  • mcp__waiverfile__waiverfile_find_waivers_by_reference untrusted-input
  • mcp__waiverfile__waiverfile_list_waivers untrusted-input
  • mcp__waiverfile__waiverfile_export_waiver_data untrusted-input
  • mcp__waiverfile__waiverfile_count_waivers private-data, untrusted-input
  • mcp__waiverfile__waiverfile_list_sms_subscribers untrusted-input
  • mcp__waiverfile__waiverfile_create_event untrusted-input
  • mcp__waiverfile__waiverfile_update_event untrusted-input
  • mcp__waiverfile__waiverfile_invite_event_managers untrusted-input, outbound
  • mcp__waiverfile__waiverfile_create_event_category untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/waiverfile/verify?hash=b282b4fa19ed7bb5aa70563aed53654a39b5429b46c8021a645c446555e1e93e" | jq -e '.changed == false'

Pinned hash b282b4fa19ed, from Oct 24, 2026, 16:21 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/waiverfile/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/waiverfile
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/waiverfile.svg)](https://anlyon.dev/servers/io.usefulapi/waiverfile)

Source: MCP Registry · repository. Synced Oct 24, 2026, 17:18 UTC.