
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
substack-mcp
Advanced tools
A Model Context Protocol (MCP) Server for Substack enabling LLM clients to interact with Substack's API for automations like creating posts, managing drafts, and more.
A Model Context Protocol (MCP) Server for Substack enabling LLM clients to interact with Substack's API for automations like creating posts, managing drafts, and more.
Inputs:
title (string): Title of the postsubtitle (string): Subtitle of the postbody (string): Body of the postReturns: "OK" if the post was created successfully.
The installation process is standardized across all MCP clients. It involves manually adding a configuration object to your client's MCP configuration JSON file.
If you're unsure how to configure an MCP with your client, please refer to your MCP client's official documentation.
This option requires Node.js to be installed on your system.
{
"mcpServers": {
"substack-api": {
"command": "npx",
"args": ["-y", "substack-mcp@latest"],
"env": {
"SUBSTACK_PUBLICATION_URL": "<YOUR_PUBLICATION_URL>",
"SUBSTACK_SESSION_TOKEN": "<YOUR_SESSION_TOKEN>",
"SUBSTACK_USER_ID": "<YOUR_USER_ID>"
}
}
}
}
<SUBSTACK_PUBLICATION_URL>, <YOUR_SESSION_TOKEN> and <YOUR_USER_ID> with your credentials.This option requires Docker to be installed on your system.
{
"mcpServers": {
"substack-api": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"SUBSTACK_PUBLICATION_URL",
"-e",
"SUBSTACK_SESSION_TOKEN",
"-e",
"SUBSTACK_USER_ID",
"marcomoauro/substack-mcp:latest"
],
"env": {
"SUBSTACK_PUBLICATION_URL": "<YOUR_PUBLICATION_URL>",
"SUBSTACK_SESSION_TOKEN": "<YOUR_SESSION_TOKEN>",
"SUBSTACK_USER_ID": "<YOUR_USER_ID>"
}
}
}
}
<SUBSTACK_PUBLICATION_URL>, <YOUR_SESSION_TOKEN> and <YOUR_USER_ID> with your credentials.The server logs what it does as one JSON object per line, on stderr — MCP clients collect it
into their own log file (on macOS, Claude Desktop writes it to
~/Library/Logs/Claude/mcp-server-substack-api.log). It is the fastest way to see what your LLM
actually sent when a call does not do what you expected:
{"ts":"2026-08-07T10:12:03.114Z","level":"info","msg":"tool.call.start","tool":"create_draft_post","args":{"title":"My title","subtitle":"My subtitle","body":"…"}}
{"ts":"2026-08-07T10:12:03.402Z","level":"info","msg":"substack.response","status":200,"duration_ms":287}
{"ts":"2026-08-07T10:12:03.403Z","level":"info","msg":"create_draft_post.created","draft_id":167712345}
Set the optional SUBSTACK_MCP_LOG_LEVEL env var alongside your credentials to change how much
is written:
| Value | What you get |
|---|---|
silent | nothing |
error | failed calls only |
warn | the above, plus every answer the client received as an error — including calls rejected for bad arguments before they ran |
info (default) | the above, plus every tool call, request and response |
debug | the above, plus full payloads and every JSON-RPC message |
Your session token is never written to the log, at any level.
For a complete list of MCP clients and their feature support, visit the official MCP clients page.
| Client | Description |
|---|---|
| Claude Desktop | Desktop application for Claude AI |
| Cursor | AI-first code editor |
| Cline for VS Code | VS Code extension for AI assistance |
| GitHub Copilot MCP | VS Code extension for GitHub Copilot MCP integration |
| Windsurf | AI-powered code editor and development environment |
FAQs
A Model Context Protocol (MCP) Server for Substack enabling LLM clients to interact with Substack's API for automations like creating posts, managing drafts, and more.
The npm package substack-mcp receives a total of 287 weekly downloads. As such, substack-mcp popularity was classified as not popular.
We found that substack-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.