Substack MCP Server
NPM · @CONORBRONSDON/SUBSTACK-MCP · SCANNED AUG 11
Substack MCP server: posts are draft-only by design; short-form Notes publish immediately.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 30 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to conorbronsdon/substack-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability81
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1087 tokens (~77/item across 14 items; 14 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management53
- Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @conorbronsdon/substack-mcp
claude mcp add conorbronsdon-substack-mcp -- npx -y @conorbronsdon/substack-mcp
codex mcp add conorbronsdon-substack-mcp -- npx -y @conorbronsdon/substack-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"conorbronsdon-substack-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"@conorbronsdon/substack-mcp"
],
"enabled": true
}
}
} openclaw mcp add conorbronsdon-substack-mcp --command npx --arg -y --arg @conorbronsdon/substack-mcp
mcp_servers:
conorbronsdon-substack-mcp:
command: "npx"
args: ["-y", "@conorbronsdon/substack-mcp"] {
"mcpServers": {
"conorbronsdon-substack-mcp": {
"command": "npx",
"args": [
"-y",
"@conorbronsdon/substack-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 11 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 9 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Aug 26 +1
- Security disclosure: fail → pass ▲ functional
- 7 Aug 26 +4
- Known CVEs: partial → pass ▲ security
- Dependency health: partial → 0.85 functional
- 5 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Aug 26 +35
- Schema quality: 69 → 77 ▼ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.30 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Package version: 0.6.0 → 0.6.2 functional
- 3 Aug 26 −33
- Stability: 0.23 → unverified ▼ security
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Package version: 0.6.0 → 0.6.2 functional
- Package version: 0.6.0 → 0.6.1 functional
- 2 Aug 26 +59
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- The attested source repository moved: conorbronsdon/substack-mcp security
- Schema quality: 58 → 69 ▼ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
- Package version: 0.3.0 → 0.6.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 11 Aug 2026 · Analysed npm/@conorbronsdon/[email protected]
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | conorbronsdon/substack-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/conorbronsdon/substack-mcp/.github/workflows/publish.yml@refs/heads/main |
| Rekor log index | 2334182913 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:e9bb719d42893e5b0378201904792790179a6b9c8616b6adc4b9947ed015d2dff32bf3f1c28532ebb8c9a1acbeaa40e3c42b0d764af8af23cf9ae38ed |
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
create_draft ~79
Create a new draft post. Accepts markdown body which is converted to Substack's format. Does NOT publish — creates a draft only.
| Name | Type | Req | Description |
|---|---|---|---|
| audience | string | – | Who can see this post |
| body | string | – | Post body in markdown format |
| subtitle | string | – | Post subtitle |
| title | string | yes | Post title |
No output schema declared.
No examples provided.
create_note ~74
Create a Substack Note (short-form content). Accepts markdown text. PUBLISHES IMMEDIATELY to your public Notes feed — Notes have no draft state on Substack, and this server has no delete tools, so there is no undo from here.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Note content in markdown format |
No output schema declared.
No examples provided.
create_note_with_link ~87
Create a Substack Note with a link attachment, displayed as a rich card below the note text. PUBLISHES IMMEDIATELY to your public Notes feed — same caveats as create_note: no draft state, no undo from this server.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Note content in markdown format |
| url | string | yes | URL to attach as a link card |
No output schema declared.
No examples provided.
get_draft ~40
Get the full content of a draft post by ID. Returns title, body, metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| draft_id | number | yes | The draft ID to retrieve |
No output schema declared.
No examples provided.
get_post ~40
Get the full content of a published post by ID. Returns title, body HTML, metadata.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | number | yes | The post ID to retrieve |
No output schema declared.
No examples provided.
get_post_analytics ~94
Get performance stats (views, emails sent/delivered/opened, signups, subscribes, estimated value, comments, reactions) for a published post by ID. Substack has no per-post stats endpoint, so this searches your 500 most recent published posts for the ID; returns a not-found note if it isn't among them.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | number | yes | The published post ID to get stats for |
No output schema declared.
No examples provided.
get_post_comments ~59
Get comments on a published post. Returns commenter name, comment body, date, and reaction counts.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max comments to return (default 20) |
| post_id | number | yes | The post ID to get comments for |
No output schema declared.
No examples provided.
get_sections ~46
List your publication's sections (categories). Returns each section's id and name. Use a section id as `section_id` when creating or updating a draft to file it under that section.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_subscriber_count ~90
Get the current subscriber count for your Substack publication. Returns `precision`: 'exact' when the API reports a true count, 'approximate' when only Substack's rounded value is available (the real number is that or higher — render it hedged, e.g. '1,000+'), or 'unavailable' with count -1. Never treat an approximate value as exact.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_drafts ~65
List draft posts. Returns title, creation date, and audience for each draft.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max drafts to return (1-50; Substack rejects anything higher, so larger values are clamped) |
| offset | number | – | Number of drafts to skip |
No output schema declared.
No examples provided.
list_published_posts ~69
List published posts with pagination. Returns title, date, slug, and URL for each post.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max posts to return (1-50; Substack rejects anything higher, so larger values are clamped) |
| offset | number | – | Number of posts to skip |
No output schema declared.
No examples provided.
list_scheduled_posts ~107
List posts scheduled for future publication, soonest first. Read-only visibility into what's queued — scheduling itself is done in Substack's editor (this server does not schedule, publish, or delete long-form posts). Returns id, title, audience, and scheduled time (`trigger_at`).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max posts to return (1-50; Substack rejects anything higher, so larger values are clamped) |
| offset | number | – | Number of posts to skip |
No output schema declared.
No examples provided.
update_draft ~81
Update an existing draft post. Only works on unpublished drafts. Accepts markdown body.
| Name | Type | Req | Description |
|---|---|---|---|
| audience | string | – | Who can see this post |
| body | string | – | New body in markdown format |
| draft_id | number | yes | The draft ID to update |
| subtitle | string | – | New subtitle |
| title | string | – | New title |
No output schema declared.
No examples provided.
upload_image ~156
Upload an image to Substack's CDN. Provide exactly one of `image_base64` (a base64 data URI) or `image_path` (a local file path). Returns a hosted image URL that is publicly fetchable by anyone with the link (an unlisted asset — not attributed to you or added to your feed).
| Name | Type | Req | Description |
|---|---|---|---|
| image_base64 | string | – | Base64-encoded image with data URI prefix (e.g., "data:image/png;base64,..."). Mutually exclusive with image_path. |
| image_path | string | – | Absolute path to a local image file (e.g., "/Users/me/pic.png"). Read and encoded automatically; MIME type inferred from the extension. Mutually exclusive with image_base64. |
No output schema declared.
No examples provided.