# Apply2Volunteer

> Preview or grade a volunteer form. No API key. Free sign-up to publish.

- name: com.applytovolunteer/apply2volunteer
- version: 1.0.0
- connection class: unknown (unknown)
- trust: 61/100 flags: no-repository
- quality: 69/100 (needs work)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.applytovolunteer%2Fapply2volunteer
- tools: https://api.protogrid.dev/v1/servers/com.applytovolunteer%2Fapply2volunteer/tools

**Not classified yet.** The remote endpoints have not been probed successfully, or the listing has nothing to connect to.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "apply2volunteer": {
      "type": "http",
      "url": "https://applytovolunteer.com/mcp",
      "headers": {
        "Authorization": "Bearer ${APPLY2VOLUNTEER_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${APPLY2VOLUNTEER_TOKEN}`.

## Trust

- hygiene: 80
- liveness: 28
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website -unreachable(1 failures) +updated-9d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 69/100 (needs work)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- warn `tools.description_length`: 1 tools have descriptions over 1,024 characters, which crowds the context
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 15 of 15 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 6 of 15 tools declare all four hints; missing: preview_volunteer_form (idempotentHint); create_form (idempotentHint); grade_form (idempotentHint); …
- pass `tools.token_cost`: about 4,108 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 64 tool changes in 30 days
- fail `stability.rug_pull`: 1 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 15, about 4,108 tokens to load them all
- tool set hash: 722c1de56c799cad114768951c1596b2
- tools last changed: 2026-10-19T18:33:42.313Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.applytovolunteer/apply2volunteer.svg)](https://protogrid.dev/servers/com.applytovolunteer/apply2volunteer)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-19 `claim_preview` changed (annotations)
- 2026-10-19 `publish_form` changed (outputSchema, annotations)
- 2026-10-19 `discard_form` changed (annotations)
- 2026-10-19 `update_form` changed (annotations)
- 2026-10-19 `create_form` changed (annotations)
- 2026-10-19 `update_application_status` changed (annotations)
- 2026-10-19 `get_application` changed (annotations)
- 2026-10-19 `list_applications` changed (annotations)
- 2026-10-19 `get_form` changed (description, outputSchema, annotations)
  - before: Get one form by id when it belongs to the authenticated organization. Requires an org API key with the forms:read scope.
  - after: Get one form by id when it belongs to the authenticated organization. Requires an org API key with the forms:read scope. When the form is published and not soft-deleted, also returns publicUrl, publicFormUrl, embedUrl, and embedSnippet, and a draft that was never published omits those fields. A soft-deleted form omits those fields too.
- 2026-10-19 `list_forms` changed (description, outputSchema, annotations) **meaning changed**
  - before: List forms that belong to the authenticated organization. Requires an org API key with the forms:read scope.
  - after: List forms that belong to the authenticated organization. Requires an org API key with the forms:read scope. When a form is published and not soft-deleted, that item also includes publicUrl, publicFormUrl, embedUrl, and embedSnippet, and a draft that was never published omits those fields. A soft-deleted form omits those fields too.

Full history: https://api.protogrid.dev/v1/servers/com.applytovolunteer%2Fapply2volunteer/changes

## Remotes

- https://applytovolunteer.com/mcp (streamable-http, auth none, reachable false, uptime30d 0.9444444)

## Packages

_none_

## Tools (15)

- `claim_preview`: Save an unexpired anonymous preview into the authenticated organization as a draft. Requires an org API key or OAuth sign-in with the forms:write scope. Same save as POST /api/v1/tools/previews/{id}/claim. previewId is the token in previewUrl (/tools/p/{previewId}). Returns formId and editorUrl (/app/forms/{formId}). An unknown or expired preview is an error. A preview already saved by another organization is refused. Claiming the same preview again for this organization returns the same draft.
- `convert_pdf_preview`: Convert a PDF URL into a stored preview for the authenticated organization. Requires an org API key with the forms:read scope. Returns the preview id and expiry. For a preview without a key, use preview_volunteer_form.
- `create_form`: Create a blank draft form in the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Same blank form as POST /api/v1/forms when no conversion, report, or preview is sent: title Volunteer application unless title is set, with First name and Email. Optional template volunteer-application-form or volunteer-interest-form seeds that template's fields instead, using the on-server parser. Workers AI stays off. An unknown template is an error and does not create a form. Title is at most 200 characters. MCP, an org API key, and OAuth share a limit of 60 creates per organization per hour. A website session is not counted. Returns formId and editorUrl (/app/forms/{formId}). Does not publish the form.
- `create_form_from_pdf`: Fetch a PDF or page URL and save a draft form in the authenticated organization, the same way claiming a preview does. Requires an org API key with the forms:write scope. Uses the on-server parser only: Workers AI and other models stay off. Returns formId and editorUrl (/app/forms/{formId}). Does not publish the form. File contents are not logged.
- `discard_form`: Discard the open draft of a form that belongs to the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Same checks as POST /api/v1/forms/{id}/discard. An open draft is an unpublished version newer than the published snapshot. This deletes that draft and clears drafted public settings. The published form stays. Returns { ok: true }. A form with no open draft returns 404 { error: "not found", message: "No open draft to discard." }. That includes a form that was never published and a published form with nothing left to discard. If the form changed since this discard was read, it writes nothing and returns 409 'This form changed. Reload and try again.' This does not delete the form. A form that belongs to another organization is not found.
- `get_application`: Get one application by id when it belongs to the authenticated organization. Requires an org API key with the applications:read scope.
- `get_form`: Get one form by id when it belongs to the authenticated organization. Requires an org API key with the forms:read scope. When the form is published and not soft-deleted, also returns publicUrl, publicFormUrl, embedUrl, and embedSnippet, and a draft that was never published omits those fields. A soft-deleted form omits those fields too.
- `get_preview`: Read an unexpired converter preview by previewId. No API key. Returns the title, fields, stages, expiresAt, and previewUrl already shown on the public preview page (/tools/p/{previewId}), whether or not that preview was claimed. Unknown or expired ids are not found and include the converter URL. Does not return organization ids or saved form ids.
- `grade_form`: Grade a blank volunteer form from pasted text or a document URL. No API key. Send a url or text, not both. Uses the on-server grader only: Workers AI and other models stay off. Returns score, letter grade, fixes (the top recommendations), and reportUrl (/tools/r/{id}) for the public share page when one is stored. Restricted fields such as Social Security numbers are left out of parsed; the score still counts them. Anonymous use shares the Form Grader limit of 5 per network per day and counts toward the daily anonymous MCP cap. An organization hourly limit applies when an org API key with the forms:read scope is sent. Does not grade a saved form.
- `list_applications`: List applications for one form in the authenticated organization. Requires an org API key with the applications:read scope.
- `list_forms`: List forms that belong to the authenticated organization. Requires an org API key with the forms:read scope. When a form is published and not soft-deleted, that item also includes publicUrl, publicFormUrl, embedUrl, and embedSnippet, and a draft that was never published omits those fields. A soft-deleted form omits those fields too.
- `preview_volunteer_form`: Convert a blank volunteer application into an online form preview. No account and no API key. Send exactly one of a PDF or page url, pasted form text, or template (volunteer-application-form or volunteer-interest-form). Uses the on-server parser only: Workers AI and other models stay off, so this call has no model charge. Returns previewUrl (/tools/p/{token}), claimUrl, and signUpUrl. claimUrl and signUpUrl are the same sign-up link (/login?next=/tools/p/{token}&utm_source=mcp) labeled sign up free to publish. The parsed form is stored for 24 hours and the daily cleanup deletes it. The URL is fetched once. File contents are not logged. Restricted fields such as Social Security numbers are left out. Anonymous use is limited per network and by a daily cap; over the cap, sign up free.
- `publish_form`: Publish a draft form that belongs to the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Runs the same checks as POST /api/v1/forms/{id}/publish, including field identity and stage validation. A form with no fields is rejected (400 'A form must have at least one field to publish.'). Publish returns 409 'Publish would remove a field that already has answers or consents.' when the draft would drop a field key that already has answers or consents on any version of the form. Returns formId, status published, publicUrl (the public form URL, the same value as publicFormUrl), the embed URL, and the embed snippet. Does not publish a form that belongs to another organization.
- `update_application_status`: Set an application's status for the authenticated organization. Requires an org API key with the applications:write scope. A decline requires a decline reason. This writes the status; it does not delete the application.
- `update_form`: Update a form that belongs to the authenticated organization. Requires an org API key or OAuth sign-in with the forms:write scope. Same checks as PATCH /api/v1/forms/{id}: title, settings, and fields. A field entry with an id updates that field. A field entry with no id inserts a field. op add also inserts a field, and that row must not include an id. The server assigns the id. Required on an insert: label and type (an existing field type). Optional on an insert: helpText (at most 2000 characters), required, options, and stageId. stageId defaults to the Interest stage, or the first stage. New fields are appended. order on an insert is ignored. On an existing field, optional order is an integer greater than or equal to 0 and sets that field's position. An order already used by another field on this version is refused (409 'A field already occupies this order on the form version.'). op remove, or removeFieldIds, deletes fields on the current draft. Answers and consents are matched by field key on every version of the form, not by the draft field id. A field that has answers or consents cannot be removed (409 'This field has answers or consents and cannot be removed.'). Changing a field key is refused when that field's current key, or the new key, already has answers or consents on this form (409 'A field key that already has answers or consents cannot be changed.'). At most 20 fields can be added and 20 removed in one call. A form can hold at most 140 fields. Title is at most 200 characters, a field label at most 500, and stored settings JSON at most 32 KB. A field id that is not on the current draft returns 409 'This field id is not on the current draft.' Re-read the form with get_form and retry with the current field ids. A malformed field id is rejected. Top-level settings keys whose names start with __ are ignored, and the stored editor stamp is kept. A lower editorSeq does not overwrite a newer save. A form that belongs to another organization is not found. MCP, an org API key, and OAuth share a limit of 60 updates per organization per hour. Adding or removing fields uses that same limit. A website session is not counted. Returns the updated draft, any new field ids, and editorUrl (/app/forms/{formId}). Does not publish the form.