What makes evite-api notable?

1.5K downloads. Trust evidence available

How should evite-api be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

evite-api

Query and act on Evite (evite.com) events, guest lists, RSVPs, and messages from a shell with curl and a cookie jar — instead of running the evite-mcp server. Does a headless EVITE_EMAIL/EVITE_PASSWORD login against evite.com's internal /services/, /ajax/, and /tsunami/ APIs, no browser or extension involved. Use when you want Evite data/actions without the MCP, in a script, or on a machine where the MCP isn't installed. Triggers on "check my Evite", "Evite guest list", "RSVP on Evite from the shell", "curl Evite", "evite-api skill". Skill: evite-api Owner: chrischall Summary: Query and act on Evite (evite.com) events, guest lists, RSVPs, and messages from a shell with curl and a cookie jar — instead of running the evite-mcp server. Does a headless EVITE_EMAIL/EVITE_PASSWORD login against evite.com's internal /services/, /ajax/, and /tsunami/ APIs, no browser or extension involved. Use when you want Evite data/actions without the MCP, in a script

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

1.5k

Updated

Oct 10, 2026

Version

1.3.5

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.5K downloads reported by the source. Last updated 10/10/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 10, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 10, 2026
Adoption signal: 1.5K downloadsadoption · observed Oct 10, 2026
Latest release: 1.3.5release · observed Oct 9, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s17cjx1a349nz5apaqp02vgz4h85728z:evite-api

Setup complexity is classified as HIGH. You must provision dedicated cloud infrastructure or an isolated VM. Do not run this directly on your local workstation.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-chrischall-evite-api/snapshot"

Documentation

CLAWHUB

146,777 characters of source documentation, loaded on request.

Extracted files

4 files captured from the source.

SKILL.md

---
name: evite-api
description: >-
  Query and act on Evite (evite.com) events, guest lists, RSVPs, and
  messages from a shell with curl and a cookie jar — instead of running
  the evite-mcp server. Does a headless EVITE_EMAIL/EVITE_PASSWORD login
  against evite.com's internal /services/, /ajax/, and /tsunami/ APIs, no
  browser or extension involved. Use when you want Evite data/actions
  without the MCP, in a script, or on a machine where the MCP isn't
  installed. Triggers on "check my Evite", "Evite guest list", "RSVP on
  Evite from the shell", "curl Evite", "evite-api skill".
---

# Evite via curl (no MCP)

Evite has no public API — this hits the site's own internal `/services/`
(+ `/ajax/`, `/tsunami/`) layer using session cookies, exactly like
evite-mcp does. **This is a curl skill, not fpx**: Evite's login is a
plain CSRF-protected Django form POST, and reads/writes with the
resulting cookies are **not** bot-walled (Cloudflare sits in front but
doesn't trip on a plain `curl`/Node request carrying a valid session) —
so the whole flow runs server-side with a cookie jar. No signed-in
browser tab, no ContextMint Bridge extension, no bridge.

Auth model: session cookies `x-evite-session` + `evtsession`, plus a
CSRF cookie `csrftoken` sent back as the `X-CSRFToken` header on every
write. The CSRF cookie **rotates** — re-read it from the jar immediately
before each write, never cache it.

## One-time login (per shell session, until the jar's session expires)

```sh
export [email protected] EVITE_PASSWORD=yourpassword   # or: op read op://.../evite/password
JAR=/tmp/evite-jar.txt
touch "$JAR" && chmod 600 "$JAR"   # jar holds the live session cookie — restrict before writing
UA='Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36'

# 1. Prime: GET the homepage to obtain the csrftoken (+ anonymous session) cookies.
curl -sS -c "$JAR" -b "$JAR" -A "$UA" 'https://www.evite.com/' -o /dev/null

# 2. Login: POST creds with the primed jar + X-CSRFToken + Origin/Referer (Django's
#    HTTPS CSRF check needs all three; a cold POST without them 403s).
CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR")
curl -sS -c "$JAR" -b "$JAR" -A "$UA" \
  -H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF" \
  -H 'Origin: https://www.evite.com' -H 'Referer: https://www.evite.com/' \
  -d "$(jq -n --arg e "$EVITE_EMAIL" --arg p "$EVITE_PASSWORD" '{email:$e,password:$p}')" \
  'https://www.evite.com/ajax_login'
```

A `200` means the jar now holds the authenticated cookies
(`x-evite-session`, `evtsession`, a freshly-rotated `csrftoken`,
`x-evite-features`) and a JSON body with `full_name`/`user_id`/`token`.
`401 {"error":"Invalid Email Address / Password"}` = bad creds; `403
{"error":"HTTP_403"}` = the priming GET was skipped, or its `csrftoken`
wasn't echoed back.

## Reads: jar + `Accept: application/json`

```sh
curl -sS -b "$JAR" -c "$JAR" -H 'Accept: application/json'

_meta.json

{
  "ownerId": "kn700jq4sjtf2anb0rk3ft4p7n856872",
  "slug": "evite-api",
  "version": "1.3.5",
  "publishedAt": 1791588493973
}

references/endpoints.md

# Evite endpoint reference (curl)

Base host: `https://www.evite.com`. All paths below assume `$JAR` already
holds an authenticated session (see `SKILL.md`'s one-time login) and that
every call passes `-b "$JAR" -c "$JAR"` so a rotated `csrftoken` lands
back in the jar. Reads add `-H 'Accept: application/json'`; writes add
`-H 'Content-Type: application/json' -H "X-CSRFToken: $CSRF"` with `CSRF`
re-read from the jar immediately before the call:

```sh
CSRF=$(awk -F'\t' '$6=="csrftoken"{v=$7} END{print v}' "$JAR")
```

Transcribed from `evite-mcp`'s `src/client.ts` + `docs/EVITE-API.md`
(live-verified 2026-06-01/02). Every shape below is a REAL captured
request/response unless marked "assumed" (URL captured, body not).

---

## Reads

### 1. List events — `GET /services/events/v1/`

Query: `filterBy` (`all|host|others`, others = you're a guest), `status`
(repeatable — `upcoming|draft|archived|past|canceled`), `type=invitation`,
`offset`, `numResults`, `filter` (free text).

```sh
curl -sS -b "$JAR" -c "$JAR" -H 'Accept: application/json' \
  'https://www.evite.com/services/events/v1/?filterBy=all&type=invitation&status=upcoming&status=draft&numResults=25' \
  | jq '.totals, (.events[] | {id: .event_id, title, start, status, is_host, rsvp})'
```

→ `{ events: Event[], totals }`. `totals` = `{all, sending, draft,
received, canceled, past, upcoming, archived}` (sending = hosting,
received = invited). `Event` fields: `event_id, title, start, end,
status, past, is_host, rsvp(yes|no|maybe), guest_status(0|1|2),
guest_id, host_id, host_name, location{location_name, street_address,
unit_num, city, state, zip_code, place_id}, timezone,
known_timezone_name, template_name, event_category, rsvp_off, is_invite,
is_pending_cohost, rendered_image_url, updated`.

### 2. Get event detail — `GET /services/event/v1/{id}`

```sh
curl -sS -b "$JAR" -c "$JAR" -H 'Accept: application/json' \
  "https://www.evite.com/services/event/v1/$EVENT_ID" \
  | jq '{title: .event.title, start: .event.startDatetime, status: .event.status, settings}'
```

→ top keys: `event, calculatedFields, design, location,
userEventContext, attributes, registries, settings, charity, gifting,
rendered, calendar, features`. `event`: `id, title, message,
startDatetime, endDatetime, knownTimezoneName,
knownTimezoneAbbreviation, eventHostName, eventPhoneNumber, hostId,
hostIds, status, isPast, eventType, category, superCategory,
templateName, origin, isFabricPremium, shareableLink, sendOn`.
`settings`: `enableMaybe, privateGuestList, headCountByFamily, plusOne,
maxEventCapacity, allowViewMap, showGifting, rsvpBy, strictRsvpBy,
enableHostPhotoGallery, enablePhotoSharing, allowGuestNumber, rsvpOff`.

### 3. Guest list + RSVP summary — `GET /services/event/v1/{id}/guests/`

One endpoint powers both `evite_list_guests` and `evite_rsvp_summary`.

```sh
curl -sS -b "$JAR" -c "$JAR" -H 'Accept: application/json' \
  "https://www.evite.com/services/event/v1/$EVENT_ID/guests/" \
  | jq '.summary, (.guests[] |

skill-card.md

## Description:

Guides agents in reading and managing Evite events, guest lists, RSVPs, and messages from the shell using authenticated requests.

This skill is ready for commercial/non-commercial use.

## Publisher:

[chrischall](https://clawhub.ai/user/chrischall)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and other Evite account holders use this skill to check events and guest responses or manage invitations from a shell without an MCP server.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Account credentials and live session cookies can expose Evite account access or private guest lists.

Mitigation: Avoid passwords in shell history and store cookie jars and guest lists only in restricted, non-shared locations.

Risk: Actions can change events or email real guests without a built-in confirmation step.

Mitigation: Require explicit confirmation before sends, broadcasts, cancellations, guest-list changes, or photo uploads; test with a throwaway event.

Risk: Two message and invitation request bodies are not verified, so these operations may fail or act unexpectedly.

Mitigation: Test unverified operations on a throwaway event before using them with real guests.

## Reference(s):

- [Evite endpoint reference](artifact/references/endpoints.md)
- [Evite API skill on ClawHub](https://clawhub.ai/chrischall/skills/evite-api)

## Skill Output:

**Output Type(s):** [Shell commands, Guidance]

**Output Format:** [Markdown with shell code blocks]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Commands use an Evite account session; some actions change events or contact guests.]

## Skill Version(s):

1.3.5 (source: ClawHub release metadata)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 17h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.