Submitator

com.submitatorPublished by submitator.comOfficial publisherv0.1.1Updated Nov 1, 2026

Launch your clients' products on up to 100 directories each from Claude, ChatGPT, Cursor or VS Code.

VerifiedStreamable HTTPWeb executableProductivity & WorkflowBusiness & Commerce

Overview

AI-generated overview

Submitator lets an assistant create client product projects and submit them to up to 100 web directories, then track listings, badges, reports and share links.

What you can do
  • Check the agency key's mode, permissions, launches left and request budget
  • Create, read, update and delete draft projects from a client URL, and manage logos and screenshots
  • Search the directory catalog and see one project's suggested, open and locked directories
  • Dry-run and then launch submissions, or add more directories from a launched project's allowance
  • Follow listings and change events, and check the badge required on the client's site
  • Build PDF or XLSX reports and manage the client progress page link
When to use it
For agencies on Submitator's white label plan that want an assistant to set up a client project, preview and launch directory submissions, and report progress under their own brand.
Requirements
An agency account and an API key from the agency console, sent as SUBMITATOR_API_KEY for the npx package (Node.js 20 or newer) or as an Authorization bearer header for the remote endpoint. claude.ai and ChatGPT can sign in instead. A test key is free; live mode needs purchased launches.
Before you install
launch_project spends one paid launch per call, and update_project, add_directories and other write tools change or delete data; keep approval prompts on. The key grants agency-wide access, so keep it out of repositories and revoke it in the console. Text from third-party sites and directories is untrusted. The remote server cannot read or save local files.

Installation

In SourceWeft

  1. Open Submitator in the dashboard and add it to a workspace.
  2. Connect Authorization token credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.submitator%2Fmcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "submitator": {
      "type": "http",
      "url": "https://mcp.submitator.com/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

README

Submitator MCP server

Launch your clients' products on up to 100 directories each from Claude, ChatGPT, Cursor or VS Code.

This MCP server is for agencies on Submitator's white label plan. Your assistant creates a client project from a URL, shows which directories it would reach, launches it once you agree, and follows the listings as they go live. The badge, the report and the client page carry your agency's brand. It calls the Submitator API with your agency key and does nothing the API does not.

What you need

  • An agency account: app.submitator.com/agency/start.
  • An API key from Developers in the agency console. With claude.ai or ChatGPT, the sign-in creates one (see Remote server).
    • A sbm_test_ key is free from the day you create the agency. It runs in test mode: projects and listings are test data, nothing is submitted, and its test launches are not bought ones.
    • A sbm_live_ key comes with your first purchase. Each launch_project spends one launch.

Install

The package runs on your machine with npx (Node.js 20 or newer). Keep the key in your user-level config, never in a file that lives in a repository.

Claude Code (user scope, so the key stays out of the project's .mcp.json)

sh
claude mcp add --scope user submitator --env SUBMITATOR_API_KEY=sbm_test_... -- npx -y submitator-mcp

Cursor (~/.cursor/mcp.json, the user-level file)

json
{  "mcpServers": {    "submitator": {      "command": "npx",      "args": ["-y", "submitator-mcp"],      "env": { "SUBMITATOR_API_KEY": "sbm_test_..." }    }  }}

VS Code (.vscode/mcp.json): VS Code asks for the key and keeps it out of the file.

json
{  "inputs": [    { "type": "promptString", "id": "submitator-key", "description": "Submitator API key", "password": true }  ],  "servers": {    "submitator": {      "type": "stdio",      "command": "npx",      "args": ["-y", "submitator-mcp"],      "env": { "SUBMITATOR_API_KEY": "${input:submitator-key}" }    }  }}

Claude Desktop (claude_desktop_config.json): the same block as Cursor, under mcpServers. Claude Desktop starts servers in the disk root, so add "SUBMITATOR_FILES_DIR": "/path/to/client/images" to env if you want to upload local images.

Devin Desktop (formerly Windsurf), Cline and other MCP clients: run npx -y submitator-mcp with SUBMITATOR_API_KEY in its environment, or use the remote server below.

Remote server

The remote server at https://mcp.submitator.com/mcp needs no install. There are two ways in: claude.ai and ChatGPT sign in to Submitator, and other clients send an agency key in a header.

claude.ai: sign in

  1. In claude.ai, open Customize > Connectors, press + Add, then Add custom connector.
  2. Enter the name Submitator and the URL https://mcp.submitator.com/mcp, then press Continue. Check the settings it found and press Continue again.
  3. Under Authentication pick Sign in now, keep Use Claude's published identity (Recommended) as the OAuth client, leave Request headers empty and press Add.
  4. Submitator's sign-in opens: log in to the agency console. The consent page names the client and its host (Claude, claude.ai). Pick Test or Live and Full or Read only, then press Allow Claude.
  5. In a chat, open +, then Connectors, and switch Submitator on.

This link opens the dialog of step 1 with the name and the URL filled in.

The sign-in creates a key labelled MCP: Claude on the console's Developers page. Revoke it there to disconnect: the next call asks to sign in again. Live needs an agency that has bought launches, so a new agency gets Test only, and test mode submits nothing.

On Team and Enterprise plans an Owner adds the connector first, under Organization settings > Connectors: Add, Custom, Web. Members then press Connect under Customize > Connectors, and each of them signs in.

ChatGPT: sign in

  1. In ChatGPT on the web, open Plugins (chatgpt.com/plugins), press the plus button, then Add custom MCP server.
  2. Enter the name Submitator and, under Connection, the Server URL https://mcp.submitator.com/mcp.
  3. For authentication pick OAuth with a Client ID Metadata Document (CIMD), and enter no client ID or secret: Submitator's sign-in reads ChatGPT's published client document and needs no client registration.
  4. Review the risk warning, select I understand and want to continue, then Create as a plugin.
  5. Install the plugin, then in a chat type @ and pick it.

When ChatGPT sends you to Submitator's sign-in, log in to the agency console, pick Test or Live and Full or Read only on the consent page, and allow ChatGPT. As with claude.ai, the sign-in creates a key whose label starts with MCP: on the console's Developers page (revoke it there to disconnect), and a new agency gets Test only.

OpenAI's documentation says ChatGPT asks for confirmation before write actions by default and treats a tool without readOnlyHint as a write. Here the tools that only read carry readOnlyHint: true, and every other tool false. In a workspace, its permissions and security settings apply to adding and using custom MCP servers.

Claude Code, Cursor, VS Code and other clients: a key in a header

URL:    https://mcp.submitator.com/mcpHeader: Authorization: Bearer <your key>   (X-API-Key: <your key> works too)

Claude Code

sh
claude mcp add --transport http submitator https://mcp.submitator.com/mcp \  --header "Authorization: Bearer $SUBMITATOR_API_KEY"

Cursor (~/.cursor/mcp.json)

json
{  "mcpServers": {    "submitator": {      "url": "https://mcp.submitator.com/mcp",      "headers": { "Authorization": "Bearer sbm_test_..." }    }  }}

VS Code (.vscode/mcp.json): VS Code asks for the key and keeps it out of the file.

json
{  "inputs": [    { "type": "promptString", "id": "submitator-key", "description": "Submitator API key", "password": true }  ],  "servers": {    "submitator": {      "type": "http",      "url": "https://mcp.submitator.com/mcp",      "headers": { "Authorization": "Bearer ${input:submitator-key}" }    }  }}

Other clients that connect over HTTP take the same URL and header.

The remote server keeps nothing between requests: it passes the key, from the header or from the sign-in's access token, on to the Submitator API and forgets it. Files cannot be read or saved there, so save_report_file and local image paths work only with the npx package.

Tools

ToolWhat it does
whoamiThe agency and mode behind the key, its permissions, launches left and the hourly budget
list_projects, get_projectFind client projects; read one in full
create_project, update_project, delete_draftCreate a project from a URL, change its fields, delete a draft
set_logo, add_screenshot, remove_imageImages from a public URL, or a local file with the npx package
preview_launchFree dry run of a launch or an add with the same arguments: how many directories, what is missing, the cost, plus the top and median DR of the auto pick
find_directories, project_directoriesSearch the catalog; see one project's directory choices
launch_projectStart submissions. Spends one launch; refuses unless confirm_selected equals the count preview_launch shows for the same arguments
add_directoriesReach more directories from a launched project's free allowance, with the same check
list_listings, list_eventsFollow listings and what changed since a given time
get_badge, verify_badgeThe badge install code for the client's site, and a check that it is there
create_report, get_report, save_report_fileBuild a PDF or XLSX report; save it to disk with the npx package
get_share_link, create_share_link, delete_share_linkThe client's progress page (live keys)
advance_test_listing, set_test_launchesTest mode helpers (test keys)

Prompts: launch_client_project walks through a launch, and client_progress_update drafts a note for your client that does not name Submitator.

Keys and safety

  • Keep your client's approval prompt on for launch_project, add_directories and update_project instead of allowing them always: a launch spends money. These three, like every tool that overwrites or deletes data or submits to directories, carry destructiveHint: true, so clients that read the hint ask before each call. Tools that only add or check, such as create_project, add_screenshot and verify_badge, carry false. With a live key, clients that support questions to their user (MCP elicitation) also ask you before a launch or an add, and the answer never passes through the model. The remote server keeps no session, so there this question reaches only clients on MCP protocol 2026-07-28.
  • The npx package reads the key from its environment and sends it only to https://api.submitator.com.
  • Local images are read only from SUBMITATOR_FILES_DIR (or the folder the client starts the server in), only real PNG, JPEG, GIF or WebP files, and never through a link. Reports are saved to Downloads by default and never over an existing file; reports that include logins are not saved here.
  • A read-only key fits an assistant that only checks status: projects, listings, events and existing reports. Building a report or a client page link needs a key with full permissions.
  • Logins and their passwords are not exposed through this server. Read them in the agency console.
  • Every call shows up in Developers, Request log with a request id that starts with mcp-. Revoke a key there at any time.
  • Report a vulnerability by email to [email protected], not in a public issue (SECURITY.md).

Development

sh
npm installnpm test               # unit, contract and protocol testsnpm run buildnpm run sync:openapi   # refresh openapi/v1.json and src/v1.d.ts from the public contractnpm run check:pack     # pack, install in an empty folder, run the stdio handshake

When the API ships a new release, npm run sync:openapi and npm test show which new operations need a tool or a line in EXCLUDED (src/tools/index.ts).

License

MIT

Source: README.md at commit 91e08a5

Tools

23

whoami

Check the API key

Shows the agency and mode (live or test) behind the key, its permissions, launches left and the hourly request budget.

Takes no parameters.

list_projects

List client projects

Lists the agency projects, newest first. q finds one by part of its name or URL, and external_id by the agency's own id.

Parametersqlimitcursorstatusexternal_id

get_project

Read a project

One project in full: status, what it waits for, progress counts, allowance, readiness, texts, images and the image candidates found on its site.

Parametersproject_idrequired

create_project

Create a client project

Creates a project for a client's product from its URL. Name, tagline and description are filled from the site in the background when left out. Costs nothing: a launch is spent only by launch_project.

Parametersurlrequirednametagstaglineaudiencecategorylogo_urlmetadatamaker_namepromo_codecompetitorsexternal_id+11 more

update_project

Update a project

Changes the project fields it is sent and leaves the others as they are; null clears a field, and a list replaces the whole list. contact_email cannot change after launch, and after launch an edit reaches only the listings that have not been sent to their directory.

Parametersurlnametagstaglineaudiencecategorymetadatamaker_nameproject_idrequiredpromo_codecompetitorsexternal_id+10 more

delete_draft

Delete a draft project

Deletes a project that was never launched. A launched project cannot be deleted.

Parametersproject_idrequired

add_screenshot

Add a screenshot

Adds one screenshot to a project (5 at most), from a public image URL. Each call adds another one: a repeated call adds the same image twice.

Parametersurlrequiredproject_idrequired

remove_image

Remove the logo or a screenshot

Removes the logo ("logo") or one screenshot (its img_ id). A launched project keeps at least its logo and one screenshot.

Parametersimagerequiredproject_idrequired

preview_launch

Preview a launch

Free dry run of launch_project (or of add_directories on a launched project) with the same arguments: how many directories it would submit to, what is missing, what would unlock more and what it costs, plus the top and median DR of the auto pick. Its would_submit count is the confirm_selected that launch_project or add_directories requires for the same arguments.

Parametersproject_idrequireddirectoriesauto_replaceexcluded_directories

find_directories

Search the directory catalog

Searches the directories Submitator submits to, highest Domain Rating first, or reads one by id. Before the agency first buys launches, only the top 20 are shown.

Parametersqkindlimittopiccursormin_draudiencerequiresdirectory_id

project_directories

A project's directory choices

Every catalog directory as seen by one project: suggested (the auto pick), open, locked (with what unlocks it), excluded or listed. Shows suggested, open and locked by default; the counts cover all.

Parameterslimitoffsetstatesproject_idrequired

launch_project

Launch a project

Starts submissions and spends one of the agency's paid launches; with a sbm_test_ key it spends a test launch and submits nothing. Refuses unless confirm_selected equals the directory count preview_launch returns for the same arguments. With a live key, a client on MCP protocol 2026-07-28 that supports elicitation also gets a question to confirm, and the answer does not pass through the model. This remote server keeps no session, so a client on an earlier protocol version is not asked.

Parametersproject_idrequireddirectoriesauto_replaceconfirm_selectedrequiredexcluded_directories

add_directories

Add directories to a launched project

Submits a launched project to more directories from its free allowance (no launch is spent). Refuses unless confirm_selected equals the directory count preview_launch returns for the same arguments. With a live key, a client on MCP protocol 2026-07-28 that supports elicitation also gets a question to confirm, and the answer does not pass through the model. This remote server keeps no session, so a client on an earlier protocol version is not asked. An include longer than the free allowance answers allowance_exhausted; a directory already listed answers invalid_directories.

Parametersproject_idrequireddirectoriesrequiredconfirm_selectedrequiredexcluded_directories

list_listings

List a project's listings

A project's listings, one per directory, highest DR first, with status and the live link once published. Or one listing in full by its id.

Parameterslimitcursorstatusdirectorylisting_idproject_id

list_events

What changed

Changes to projects and listings. The feed keeps 90 days and reads oldest first, so one call scans up to 1,000 events from the cursor (or from the start) and returns the newest ones since `since` (7 days ago by default). Passed back in a later call, its next_cursor reads only what came after. For the current state of a project, get_project and list_listings are cheaper.

Parameterstypelimitsincecursorproject_id

get_badge

Get the badge install kit

The agency-branded badge some directories require on the client's site: its status, a message to forward to the client, the platforms it has install code for, and the code for the one named in platform.

Parametersplatformproject_idrequired

verify_badge

Check the badge on the site

Checks the client's site for the badge now. Each project gets up to 10 checks an hour.

Parametersproject_idrequired

create_report

Build a client report

Builds a PDF or XLSX report of a project, branded for the agency. Building takes a moment; get_report says when it is ready.

Parametersformatrequiredproject_idrequired

get_report

Read a report

Whether a report is ready, and how to get the file.

Parametersreport_idrequired

Version history

2
  1. v0.1.1LatestNov 1, 2026
  2. v0.1.0Oct 30, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts