MCP server

The Submitator MCP server lets an AI assistant use the API for your agency. MCP, the Model Context Protocol, is how assistants such as Claude Code, Cursor and VS Code call outside tools.

Your assistant creates a client's project from a URL, shows the free preview and launches the project once you agree. Then it follows the listings as they go live. It calls the API with your agency key and does nothing the API does not.

It comes two ways:

• The npm package submitator-mcp runs on your machine with npx (Node.js 20 or newer). It can also read local images and save reports to disk.
• The remote server at https://mcp.submitator.com/mcp needs no install. It reads and saves no files.

Both run the same code, open source under the MIT license on GitHub. What it does for an agency, in short, is on the MCP server page.

Get a keyCopy Anchor Link

1. Create your agency at app.submitator.com/agency/start. Test mode needs no payment.
2. In the console, open Developers, then MCP. Pick your client and create a test key: the key is shown once, together with that client's setup with the key already in it.

A sbm_test_ key is free from the day you create your agency and runs in test mode. A sbm_live_ key comes with your first purchase, and each launch it starts spends one of your launches.

InstallCopy Anchor Link

The package runs with npx, so there is nothing to install by hand. Keep the key in your user-level config, never in a file that lives in a repository.

claude mcp add --scope user submitator --env SUBMITATOR_API_KEY=sbm_test_... -- npx -y submitator-mcp

• Claude Code: user scope keeps the key out of the project's .mcp.json.
• Cursor: ~/.cursor/mcp.json is the user-level file.
• VS Code asks for the key when the server starts and keeps it out of the file.
• Claude Desktop starts servers in the disk root, so SUBMITATOR_FILES_DIR names the folder of the local images you want to upload. Leave it out if you add images by URL only.
• Devin Desktop (formerly Windsurf), Cline and other MCP clients: add a server that runs npx -y submitator-mcp with SUBMITATOR_API_KEY in its environment, or use the remote server below.

Remote serverCopy Anchor Link

A client that connects over HTTP can use the remote server instead of the package. Send your key in the Authorization header as Bearer and the key, or in an X-API-Key header.

claude mcp add --transport http submitator https://mcp.submitator.com/mcp \
  --header "Authorization: Bearer $SUBMITATOR_API_KEY"

The remote server passes your key on to the API and keeps nothing between requests. It reads and saves no files, so save_report_file and local image paths work only with the package.

Start in test modeCopy Anchor Link

With a test key, projects and listings are test data: nothing is submitted, and test launches are not bought ones. Ask your assistant to run whoami first: it names the agency, the mode and the launches left. Then let your assistant create a project, preview it and launch it.

Test listings move on their own in about 15 minutes. advance_test_listing moves one on at once, and set_test_launches sets how many test launches you have. Test mode has the rules.

What the tools doCopy Anchor Link

Two prompts come with it: launch_client_project walks through a launch, and client_progress_update drafts a note for your client that does not name Submitator.

Keys and safetyCopy Anchor Link

• Keep the key in your MCP client's user-level config on your own machine. Never put it in a file that lives in a repository.
• A read-only key fits an assistant that only checks status: projects, listings, events and existing reports. Building a report or a client page link needs a key with full permissions, and share links work with a live key only.
• Keep your client's approval prompt on for launch_project, add_directories and update_project instead of allowing them always: a launch spends one of your launches.
• launch_project and add_directories refuse unless confirm_selected equals the count preview_launch shows for the same arguments. With a live key, clients that support questions to their user (MCP elicitation) also ask you before a launch or an add, and the answer never passes through the model.
• The package reads the key from its environment and sends it only to https://api.submitator.com.
• Logins and their passwords do not pass through the MCP server. Read them in the console.
• Revoke a key in the console under Developers at any time.

Local filesCopy Anchor Link

Only the package reads or writes files on your machine.

• Images: set_logo and add_screenshot read a file_path only inside SUBMITATOR_FILES_DIR, or inside the folder the client starts the server in when it is not set. Only real PNG, JPEG, GIF or WebP files up to 5 MB are read, and never through a symlink.
• No folder, no files: started in your home folder or the disk root without SUBMITATOR_FILES_DIR, the server reads no local files at all.
• Reports: save_report_file saves to your Downloads folder unless you name another one, and never over an existing file. A report that includes logins is not saved: download it from the console.

TroubleshootingCopy Anchor Link

Every call the server makes is in the console's request log, under Developers: open a request to see its id, which starts with mcp-. When a tool fails, its answer ends with that request id. Quote it when you write to support.