Substack by Cotlet
REMOTE · COTLET.DEV · 3 COMPONENTS
Posts, Notes, messages, subscribers and stats for your publication.
Available components
Last scanned (1 hour ago)
Scores higher than 60% of remote servers
Reachable. Last reached 24 Oct 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security66
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (cotlet_browser_click). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability84
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 7845 tokens (~115/item across 68 items; 67 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability check failed: schema churn in the 1 day we've observed: 3 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 69 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 +1
- Stability: unverified → fail ▼ security
- A breaking change shipped without a version bump: still 0.1.0 ▼ security
- Tool “cotlet_balance” was removed ▼ security
- Tool “cotlet_browser_connect” was removed ▼ security
- Tool “cotlet_browser_sessions” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_subscriber” rewrote its description, which is the text the model reads security
- Tool “cancel_scheduled_post” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_click” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_close” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_navigate” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_open” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_press” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_read” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_screenshot” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_scroll” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_select” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_type” rewrote its description, which is the text the model reads security
- Tool “cotlet_browser_upload” rewrote its description, which is the text the model reads security
- Tool “create_draft” rewrote its description, which is the text the model reads security
- Tool “create_post_tag” rewrote its description, which is the text the model reads security
- Tool “create_subscriber_tag” rewrote its description, which is the text the model reads security
- Tool “delete_comment” rewrote its description, which is the text the model reads security
- Tool “delete_post” rewrote its description, which is the text the model reads security
- Tool “duplicate_post” rewrote its description, which is the text the model reads security
- Tool “export_subscribers” rewrote its description, which is the text the model reads security
- Tool “follow_user” rewrote its description, which is the text the model reads security
- Tool “get_audience_insights” rewrote its description, which is the text the model reads security
- Tool “get_conversation” rewrote its description, which is the text the model reads security
- Tool “get_daily_stats” rewrote its description, which is the text the model reads security
- Tool “get_feed” rewrote its description, which is the text the model reads security
- Tool “get_post” rewrote its description, which is the text the model reads security
- Tool “get_post_engagement” rewrote its description, which is the text the model reads security
- Tool “get_post_stats” rewrote its description, which is the text the model reads security
- Tool “get_post_traffic” rewrote its description, which is the text the model reads security
- Tool “get_publication_stats” rewrote its description, which is the text the model reads security
- Tool “get_unread_counts” rewrote its description, which is the text the model reads security
- Tool “like_comment” rewrote its description, which is the text the model reads security
- Tool “like_post” rewrote its description, which is the text the model reads security
- Tool “list_activity” rewrote its description, which is the text the model reads security
- Tool “list_comments” rewrote its description, which is the text the model reads security
- Tool “list_conversations” rewrote its description, which is the text the model reads security
- Tool “list_note_replies” rewrote its description, which is the text the model reads security
- Tool “list_notes” rewrote its description, which is the text the model reads security
- Tool “list_post_tags” rewrote its description, which is the text the model reads security
- Tool “list_posts” rewrote its description, which is the text the model reads security
- Tool “list_recommendations” rewrote its description, which is the text the model reads security
- Tool “list_sections” rewrote its description, which is the text the model reads security
- Tool “list_subscriber_tags” rewrote its description, which is the text the model reads security
- Tool “list_subscribers” rewrote its description, which is the text the model reads security
- Tool “list_subscriptions” rewrote its description, which is the text the model reads security
- Tool “list_traffic_sources” rewrote its description, which is the text the model reads security
- Tool “pin_comment” rewrote its description, which is the text the model reads security
- Tool “publish_note” rewrote its description, which is the text the model reads security
- Tool “publish_post” rewrote its description, which is the text the model reads security
- Tool “recommend_publication” rewrote its description, which is the text the model reads security
- Tool “remove_comment” rewrote its description, which is the text the model reads security
- Tool “remove_subscriber” rewrote its description, which is the text the model reads security
- Tool “reply_to_comment” rewrote its description, which is the text the model reads security
- Tool “reply_to_note” rewrote its description, which is the text the model reads security
- Tool “schedule_post” rewrote its description, which is the text the model reads security
- Tool “search_substack” rewrote its description, which is the text the model reads security
- Tool “send_message” rewrote its description, which is the text the model reads security
- Tool “tag_post” rewrote its description, which is the text the model reads security
- Tool “unpublish_post” rewrote its description, which is the text the model reads security
- Tool “update_draft” rewrote its description, which is the text the model reads security
- Tool “tag_subscribers” rewrote its description, which is the text the model reads security
- Schema quality: pass → fail ▼ functional
- Stability: unverified → 0.03 ▲ functional
- Schema quality: good → excellent functional
- 23 Oct 26 69
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Probed https://cotlet.dev/mcp/v1/substack
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=cotlet.dev | CN=YE1,O=Let's Encrypt,C=US | 12 Oct 2026 | 10 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 6afd7585ee8e24a40f5683c10835ec990a8 |
| SANs: *.cotlet.dev, cotlet.dev | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of cotlet.dev. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| cotlet.dev. | present | 2371 | 13 | Verified |
| cotlet.dev. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://cotlet.dev/mcp/v1/substack | Verified | 200 | |
| http (plaintext) | http://cotlet.dev/mcp/v1/substack | HTTPS enforced | 301 | https://cotlet.dev/mcp/v1/substack |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_subscriber Add subscriber ~108
Add one email to your list as a free subscriber. Adds one email as a free subscriber, the same as Add subscribers in the dashboard, and Substack sends its usual welcome email. Substack adds the email in the background, so list_subscribers may show it a minute later. Add only people who agreed to hear from you. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Subscriber email. |
No output schema declared.
No examples provided.
cancel_scheduled_post Cancel scheduled post ~78
Stop a scheduled post from going out; it stays as a draft. Removes the scheduled time from a post, so nothing is published or emailed then; the post stays a draft with its content. Schedule it again with schedule_post. A post with no schedule returns an error.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
No output schema declared.
No examples provided.
cotlet_apps Cotlet: apps I can use ~89
The apps of the user's workspace and whether each works now: access granted or requested, the app account in the user's Cloud Browser (connected, signed out, not enabled for agents), and the one step the user has to take, with the console link. Free. Needs the user's Cotlet API key or sign-in.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Only this app, e.g. skool. |
No output schema declared.
No examples provided.
cotlet_browser_click Click on the page ~120
Clicks a link, button or other element of the current page in the user's Substack Cloud Browser, by its number in the page's element list, and returns the URL and title after the click. It acts as the user on that site. Buttons that pay or buy and buttons on account or sign-in pages are refused. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| element | integer | yes | The element's number in the element list of the current page. |
No output schema declared.
No examples provided.
cotlet_browser_close Close the browser ~45
Ends the session in the user's Substack Cloud Browser: the browser keeps its cookies, goes to sleep and the per-minute charge stops. Returns the session's minutes and credits.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cotlet_browser_navigate Go to a page ~99
Opens a public http or https address in the user's Substack Cloud Browser and returns the URL and title it ended on. Only Substack pages open. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | A public http or https address, e.g. https://example.com. In an app's browser, a page of that app. |
No output schema declared.
No examples provided.
cotlet_browser_open Open the browser ~128
Wakes the user's Substack Cloud Browser, a real Chrome hosted on Cotlet and signed in to Substack as the user. Use it for what the Substack tools do not cover. Opens `url` when given and returns the page's URL and title. The user watches every step live. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | – | A public http or https address, e.g. https://example.com. In an app's browser, a page of that app. |
No output schema declared.
No examples provided.
cotlet_browser_press Press a key ~109
Presses one key on the current page in the user's Substack Cloud Browser, on the element that has focus: Tab to the next field, Enter to send, Escape to close a dialog or pop-up, arrows to move through a suggestion list. Returns the URL and title after it. Enter on account pages is refused. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | The key. |
No output schema declared.
No examples provided.
cotlet_browser_read Read the page ~98
Returns the current page of the user's Substack Cloud Browser: its readable text, up to 20,000 characters, and a numbered list of its links, buttons and fields. Field values, cookies and storage are never returned. On a page longer than that, both start near where it is scrolled to. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cotlet_browser_screenshot See the page ~76
Returns a JPEG image of the visible part of the current page in the user's Substack Cloud Browser, with its URL and title: boards, canvases and layouts that the page text does not show. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
cotlet_browser_scroll Scroll the page ~176
Scrolls the current page in the user's Substack Cloud Browser with the mouse wheel, as a person does: down or up by `screens` viewport heights (default 0.8), to the top or the bottom, or until element `element` is in view. Content that loads on scroll appears, and the next read lists it. Returns the URL, title and scroll position (at_top, at_bottom). Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | Where to scroll. Default: down. |
| element | integer | – | Scroll until this element of the element list is in view. |
| screens | number | – | How far, in viewport heights, for down and up. Default: 0.8. |
No output schema declared.
No examples provided.
cotlet_browser_select Choose from a list ~123
Chooses an option of a drop-down list on the current page in the user's Substack Cloud Browser, by the list's number in the element list and the option's label as read lists it (or its value). Returns the URL and title after it. Card fields and account pages are refused. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| element | integer | yes | The element's number in the element list of the current page. |
| option | string | yes | The option. |
No output schema declared.
No examples provided.
cotlet_browser_type Type on the page ~149
Types text into a field of the current page in the user's Substack Cloud Browser, by the field's number in the page's element list, and with `submit` presses Enter. Returns the URL and title after it. Password, card and one-time code fields and sign-in pages are refused: the user fills those in themselves. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| element | integer | yes | The element's number in the element list of the current page. |
| submit | boolean | – | Press Enter after typing, e.g. to search. |
| text | string | yes | The text to type. |
No output schema declared.
No examples provided.
cotlet_browser_upload Upload a file ~152
Puts files into a file field of the current page in the user's Substack Cloud Browser, or into the file picker that an upload button opens, by its number in the element list. A file is given as {"url": "https://..."} for a file online or {"file_id": "..."} for one uploaded to Cotlet first; up to 10 files, 20 MB each. Returns the URL and title after it. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.
| Name | Type | Req | Description |
|---|---|---|---|
| element | integer | yes | The element's number in the element list of the current page. |
| files | array | yes | The files. |
No output schema declared.
No examples provided.
cotlet_get_call Cotlet: check a call ~76
Status of an earlier Cotlet call, by its call_id: pending (waits for the owner's approval in the Cotlet console), approved, running, success, rejected, expired, blocked or failed. For a call that answered with status pending or running.
| Name | Type | Req | Description |
|---|---|---|---|
| call_id | string | yes | call_id from the earlier call |
No output schema declared.
No examples provided.
cotlet_report_issue Cotlet: report a bug or a missing feature ~276
Sends a report straight to the Cotlet team: a tool that failed or returned wrong data, an error you could not get past, or a tool, field or app the task needed and Cotlet lacks. The report carries the error text and call_id when there is one, never passwords or tokens. Needs the user's Cotlet API key or sign-in.
| Name | Type | Req | Description |
|---|---|---|---|
| app | – | – | App slug the report is about, e.g. 'skool'. |
| call_id | – | – | call_id of the call that went wrong, if any. |
| client | – | – | Agent or tool sending this, e.g. 'Claude Code'. |
| description | string | yes | What you tried, what you expected and what happened, with the error text if there was one. No passwords, tokens or other secrets. |
| kind | string | yes | bug: a tool did the wrong thing or returned wrong data. error: a call failed or returned an error you could not get past. feature_request: something new the user wants. missing_feature: an app is her… |
| title | string | yes | One line, e.g. 'skool_list_members stops after 50 members'. |
| tool | – | – | Tool or endpoint name, e.g. 'skool_list_members'. |
No output schema declared.
No examples provided.
cotlet_request_apps Cotlet: request access to apps ~102
Requests access to apps for the user's workspace, as Request access in the console: a live app is granted at once, any other goes to the Cotlet team, who answer within 72 hours. Takes app slugs as listed at https://cotlet.dev/api/v1/apps. Free. Needs the user's Cotlet API key or sign-in.
| Name | Type | Req | Description |
|---|---|---|---|
| apps | array | yes | App slugs, e.g. ["skool", "substack"]. |
No output schema declared.
No examples provided.
cotlet_upload_file Cotlet: upload a file for a tool ~115
Returns a one-time upload_url and a file_id for a local file (an image for a post, an attachment). The file is sent to upload_url with an HTTP PUT; an argument that takes a file accepts {"file_id": "..."}. Up to 25 MB, the URL works once. Free. Needs the user's Cotlet API key or sign-in.
| Name | Type | Req | Description |
|---|---|---|---|
| content_type | string | – | MIME type, e.g. image/jpeg. |
| name | string | – | File name, e.g. photo.jpg. |
No output schema declared.
No examples provided.
cotlet_whoami Cotlet: who am I ~63
The Cotlet account this connection acts as: email, workspace, access status, the API key or OAuth client in use with its scope, the apps the workspace may call and its credit balance. Free. Needs the user's Cotlet API key or sign-in.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
create_draft Create draft ~168
New draft from Markdown. Nothing is sent until you publish or schedule it. Creates a draft in your publication and returns its post_id and editor link. Markdown covers headings, paragraphs, bullet and numbered lists, quotes, code blocks, rules, images by public URL, bold, italic, strikethrough, inline code and links; local image files cannot be used. Sending is a separate step: schedule_post or publish_post. A draft reaches no one, so it runs without asking.
| Name | Type | Req | Description |
|---|---|---|---|
| audience | string | – | everyone, only_paid or founding. Default: everyone. |
| body_markdown | string | yes | Post body in Markdown. Images by public URL. |
| subtitle | string | – | Shown under the title and in the email preview. |
| title | string | yes | Post title. |
No output schema declared.
No examples provided.
create_post_tag Create post tag ~64
New tag for grouping your posts. Creates a post tag on your publication; Substack makes the slug from the name. A tag with no posts shows nowhere. Put posts under it with tag_post.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Tag name, e.g. Habits. |
No output schema declared.
No examples provided.
create_subscriber_tag Create subscriber tag ~58
New private tag for grouping subscribers. Creates a subscriber tag on your publication. Tags are private: subscribers never see them. Put subscribers under it with tag_subscribers.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Tag name, e.g. Early readers. |
No output schema declared.
No examples provided.
delete_comment Delete comment or Note ~110
Delete one of your own comments, Notes or Note replies. Deletes something you wrote: a comment under a post, a Note or a reply to a Note. Replies other people wrote under it stay, under a deleted placeholder. Someone else's comment returns an error; on your own posts remove it with remove_comment. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.
| Name | Type | Req | Description |
|---|---|---|---|
| comment_id | string | yes | ID of your comment, Note or Note reply. |
No output schema declared.
No examples provided.
delete_post Delete post ~124
Delete a draft, scheduled or published post, with its comments. Deletes one post of your publication for good: a draft, a scheduled post (its send is cancelled) or a published post, which leaves the web, the archive and the app with its comments and stats. Emails already sent stay in inboxes. Substack has no undo; unpublish_post keeps the post as a draft instead. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
No output schema declared.
No examples provided.
duplicate_post Duplicate post ~82
Copy any post into a new draft. Makes a new draft with the title, subtitle, body and settings of a draft or published post, as Duplicate in the post list does. Substack puts [COPY] in front of the title; change it with update_draft. Nothing is published or sent.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
No output schema declared.
No examples provided.
export_subscribers Export subscribers ~102
The full subscriber list as a CSV download link, with the row count. Builds the same CSV as Export in the subscriber dashboard: email, name, subscription type, activity rating and start date. Substack builds the file in the background; the call waits up to about a minute and otherwise asks you to try again later. The link needs no sign-in and works until expires_at, 24 hours when we recorded it. For filtered pages use list_subscribers.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
follow_user Follow user ~104
Follow or unfollow a Substack user, so their Notes reach your feed. Follows a person on Substack, as Follow on their profile does, or unfollows them. Following is not subscribing: you get their Notes and activity in the app, not their newsletter by email. They see the follow.
| Name | Type | Req | Description |
|---|---|---|---|
| unfollow | boolean | – | Unfollow instead. Default: false. |
| user | string | yes | Handle (e.g. @mayachen) or user ID. |
No output schema declared.
No examples provided.
get_audience_insights Get audience insights ~142
Where your subscribers live, and which publications share your readers. Returns Analytics > Statistics > Audience: subscriber counts per country (region world, ISO codes such as us, gb) or per US state (region usa, codes such as ny, ca), all subscribers or paid only, the number of countries and states with any subscriber, and the publications whose readers overlap most with yours. Substack computes these in the background; a new publication has empty lists for a while.
| Name | Type | Req | Description |
|---|---|---|---|
| paid_only | boolean | – | Count paid subscribers only. Default: false. |
| region | string | – | world (by country) or usa (by state). Default: world. |
No output schema declared.
No examples provided.
get_conversation Get conversation ~72
The latest messages of one direct-message conversation, oldest first. Returns who is in the conversation and its latest messages as the chat window first shows them, oldest first, with sender, text and time. Opening a conversation this way marks nothing read.
| Name | Type | Req | Description |
|---|---|---|---|
| conversation_id | string | yes | Conversation ID from list_conversations. |
No output schema declared.
No examples provided.
get_daily_stats Get daily stats ~100
Day by day: total and paid subscribers, followers and views. Returns one row per day of the period, as the charts on the dashboard home and in Audience: total subscribers, paid subscribers and followers at the end of the day, and the day's views across your site and the app. Days Substack has no number for are null; a young publication starts on the day it was made.
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | Default: 30d. |
No output schema declared.
No examples provided.
get_feed Get feed ~134
Your Substack home feed: posts and Notes, For you or Following. Returns one page of the home feed of the Substack app, split into posts and Notes in feed order. for_you is Substack's own mix; following holds only people and publications you follow or subscribe to. Suggestions of people to follow are left out. Reading marks nothing seen. Page with next_cursor; the feed is personal and changes between calls.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from the previous page. |
| tab | string | – | for_you (Substack's picks) or following (whom you follow). Default: for_you. |
No output schema declared.
No examples provided.
get_post Get post ~103
Full post: title, subtitle, body as Markdown, audience, URL and dates. Returns one post of your publication, draft, scheduled or published, with its full body as Markdown, including the paywalled part. Images come back as URLs. Buttons, embeds and footnotes come back as plain text, so writing the body back with update_draft drops them. A scheduled post also has publish_at.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
No output schema declared.
No examples provided.
get_post_engagement Get post engagement ~96
Who liked and commented on a post, and the subscribers it won and lost. Returns the Engagement and Growth parts of a post's stats: like and comment counts with the people behind them (name and handle, never email), and the free signups, paid subscriptions and unsubscribes Substack credits to the post. Counts keep changing for days after a send.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
No output schema declared.
No examples provided.
get_post_stats Get post stats ~96
Recipients, opens, open rate, views, likes, restacks and subscribers gained. Returns the engagement numbers of one published post, as on its stats page in the dashboard. Email numbers cover the send; views include the web; likes are reactions. A draft or scheduled post returns an error. Numbers keep growing for days after a send, so check again later.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
No output schema declared.
No examples provided.
get_post_traffic Get post traffic ~95
Where a post's readers came from: sources, categories and devices. Returns the Traffic part of a post's stats: each source (app, email, a website, search) with its views, share of all views and the free and paid subscribers it brought, the share per source category and per device. A post nobody has read yet returns empty lists.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
No output schema declared.
No examples provided.
get_publication_stats Get publication stats ~138
Total and paid subscribers, new subscribers, paid cancellations and estimated revenue for a period. Totals are from the publisher dashboard at the end of the period (7, 30 or 90 days). subscribers_churned counts paid cancellations only; Substack keeps no count of free unsubscribes. subscribers_new is the growth in total subscribers plus those cancellations. revenue_usd is not money received: it is the dashboard's annualized revenue at the end of the period, times the period's share of a year.
| Name | Type | Req | Description |
|---|---|---|---|
| period | string | – | 7d, 30d or 90d. Default: 30d. |
No output schema declared.
No examples provided.
get_unread_counts Get unread counts ~60
How many unread direct messages, message requests and activity notifications you have. Returns the badges of the Substack app: unread direct messages, pending message requests and unread activity (likes, replies, new followers, restacks). Reading them marks nothing read.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
like_comment Like comment or Note ~110
Like or unlike a comment or a Note as you. Adds your heart to any Note or Note reply, or to a comment under a post of your publication, or removes it with unlike. Comments and Notes share one ID space, so a Note ID from list_notes or search_substack works too. The author sees your like in their activity.
| Name | Type | Req | Description |
|---|---|---|---|
| comment_id | string | yes | Comment ID from list_comments, or a Note ID. |
| unlike | boolean | – | Remove your like instead. Default: false. |
No output schema declared.
No examples provided.
like_post Like post ~95
Like or unlike any Substack post as you. Adds your heart to a post on any publication, as the heart under a post does, or removes it with unlike. The author sees your like in their activity. Liking twice keeps one like.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from search_substack, list_posts or a post's data. |
| unlike | boolean | – | Remove your like instead. Default: false. |
No output schema declared.
No examples provided.
list_activity List activity ~161
Your Substack notifications: replies, likes, new followers, restacks, newest first. Returns the Activity tab of the Substack app, newest first. type is Substack's own name, e.g. note_reply, note_like, comment_reply, comment_like, post_like, follow, restack or mention. from lists the latest people behind a grouped item and people counts all of them. A reply or mention carries its comment_id and text; on_comment_id and on_post_id point at what it was about. Reading the list marks nothing read. Page with next_cursor.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from the previous page. |
| filter | string | – | all, replies (replies and mentions) or restacks. Default: all. |
No output schema declared.
No examples provided.
list_comments List comments ~108
Comments on a post, with author, text and whether you replied. Returns all comments of one post at once, oldest first, with replies nested under their parent. Deleted comments are left out. replied is true when you answered anywhere in the thread under the comment; unanswered_only keeps only top-level comments where you did not. Pass comment_id to reply_to_comment.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | string | yes | Post ID from list_posts. |
| unanswered_only | boolean | – | Skip threads you already replied to. |
No output schema declared.
No examples provided.
list_conversations List conversations ~118
Your direct-message conversations, latest first, with the last message. Returns your Substack chat inbox: one-to-one and group direct messages with who they are with, the last message, its time, your unread count and whether it is a message request from someone you do not follow. Publication chats are left out. Reading the list does not mark anything read. Pass conversation_id to get_conversation or send_message.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from the previous page. |
| unread_only | boolean | – | Only conversations with unread messages. |
No output schema declared.
No examples provided.
list_note_replies List Note replies ~111
Replies under a Note, with author, text and likes. Returns the direct replies under one Note (yours or anyone's), in Substack's order. replies is the count under each reply; list those by passing its note_id. Substack sends no handle with replies, so author.handle is empty and url is null. Page with next_cursor.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from the previous page. |
| note_id | string | yes | Note ID from list_notes or search_substack. |
No output schema declared.
No examples provided.
list_notes List Notes ~130
Notes posted by you or any other Substack user, newest first, with likes and replies. Returns the Notes on a profile's Notes tab, newest first: text, time, likes, restacks, reply count and link. Without user it lists yours. Posts and restacks of posts on the profile are left out. Page with next_cursor. Pass note_id to list_note_replies, like_comment or reply_to_note.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from the previous page. |
| user | string | – | Handle (e.g. @mayachen) or user ID. Default: you. |
No output schema declared.
No examples provided.
list_post_tags List post tags ~58
Tags your publication uses to group posts. Returns every post tag of your publication with its ID, name and slug; readers see tagged posts on /t/{slug}. hidden tags group posts without a public page. Pass tag_id to tag_post.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_posts List posts ~113
Posts of your publication, newest first, with status and audience. Lists posts of your publication, newest first. Filter by status to see drafts or scheduled posts. Scheduled posts include their publish time. Pages hold up to 50 posts; pass next_cursor back as cursor for the next page.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Next page cursor from the previous call. |
| limit | integer | – | 1 to 50. Default: 20. |
| status | string | – | published, draft or scheduled. Default: published. |
No output schema declared.
No examples provided.
list_recommendations List recommendations ~144
Publications you recommend, or that recommend you, with the subscribers each sent. Returns Audience > Recommendations: with direction given, the publications you recommend; with received, the ones recommending you, and whether you recommend them back (mutual). subscribers_sent counts subscribers the recommendation brought. The table is rebuilt by Substack in the background, so a recommendation made minutes ago may be missing while counts already include it; publication_id checks one recommendation of yours directly.
| Name | Type | Req | Description |
|---|---|---|---|
| direction | string | – | given (publications you recommend) or received (that recommend you). Default: given. |
| publication_id | string | – | Check one publication instead: does yours recommend it (given only). |
No output schema declared.
No examples provided.
list_sections List sections ~65
Sections of your publication, the separate newsletters inside it. Returns each section with its ID, name, description and slug. live is false while Substack still sets a new section up. subscribed_by_default tells whether new subscribers get its emails. A publication without sections returns an empty list.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_subscriber_tags List subscriber tags ~50
Tags you use to group subscribers. Returns the subscriber tags of your publication with their IDs, as Audience > Subscribers > Tags shows them. Subscribers never see tags. Pass tag_id to tag_subscribers.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_subscribers List subscribers ~177
Subscribers with plan, start date and activity rating. Lists subscribers, newest first, from the subscriber dashboard. Activity rating is the 0 to 5 score Substack shows there. Pages hold up to 500 rows; pass next_cursor back as cursor. The plan and since filters apply inside each page, so a filtered page can be short or empty while next_cursor still points further. Someone added a minute ago may not show yet: Substack fills the table in the background. paid includes founding members.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | Next page cursor from the previous call. |
| limit | integer | – | 1 to 500. Default: 100. |
| plan | string | – | all, free, paid, comp or founding. Default: all. |
| since | string | – | Only subscribers who joined on or after this date. |
No output schema declared.
No examples provided.
How do I install the Substack by Cotlet MCP server?
Substack by Cotlet is a hosted endpoint at https://cotlet.dev/mcp/v1/substack, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · cotlet.dev
claude mcp add --transport http dev-cotlet-substack 'https://cotlet.dev/mcp/v1/substack'
What is the Substack by Cotlet MCP server?
Substack by Cotlet is an MCP server listed in the public MCP registry as dev.cotlet/substack. Posts, Notes, messages, subscribers and stats for your publication. This page covers its hosted endpoint (https://cotlet.dev/mcp/v1/substack).
Is the Substack by Cotlet MCP server safe to use?
Substack by Cotlet scores 70 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Substack by Cotlet MCP server expose?
Substack by Cotlet exposes 67 tools: cotlet_whoami, cotlet_apps, cotlet_request_apps, cotlet_get_call, cotlet_upload_file, and 62 more. Their descriptions and schemas cost roughly 7,659 tokens of context every time the server is loaded.
Does the Substack by Cotlet MCP server require authentication?
No. We connected to Substack by Cotlet without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Substack by Cotlet MCP server still maintained?
Substack by Cotlet is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.