# Submitator

> Launch your clients' products on up to 100 directories each from Claude, ChatGPT, Cursor or VS Code.

- name: com.submitator/mcp
- version: 0.1.1
- connection class: R1 (autonomous)
- trust: 100/100
- quality: 76/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.submitator%2Fmcp
- tools: https://api.protogrid.dev/v1/servers/com.submitator%2Fmcp/tools

**An agent can connect on its own if it already holds `api_key`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "submitator": {
      "type": "http",
      "url": "https://mcp.submitator.com/mcp",
      "headers": {
        "Authorization": "Bearer ${api_key}"
      }
    }
  }
}
```

Placeholders to fill: `${api_key}`.

## Trust

- hygiene: 100
- liveness: 100
- freshness: 100
- provenance: 100
- drivers: +repository +namespace-matches-repo +dns-namespace +website +reachable +uptime-100% +updated-7d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 76/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 93 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 23 of 23 tools declare readOnlyHint or destructiveHint
- warn `tools.directory_hints`: 12 of 23 tools declare all four hints; missing: whoami (idempotentHint); get_report (idempotentHint); project_directories (idempotentHint); …
- pass `tools.token_cost`: about 6,449 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 19 tool changes in 30 days
- fail `stability.rug_pull`: 3 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: deps.dev does not know submitator-mcp@0.1.1

- tools: 23, about 6,449 tokens to load them all
- tool set hash: 3b06d37e25a053295b7527739e917e45
- tools last changed: 2026-10-31T08:01:38.128Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.submitator/mcp.svg)](https://protogrid.dev/servers/com.submitator/mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-31 `get_share_link` changed (annotations)
- 2026-10-31 `get_report` changed (annotations)
- 2026-10-31 `create_report` changed (description)
  - before: Builds a PDF or XLSX report of a project, branded for the agency. Building takes a moment: then call get_report.
  - after: Builds a PDF or XLSX report of a project, branded for the agency. Building takes a moment; get_report says when it is ready.
- 2026-10-31 `verify_badge` changed (description)
  - before: Checks the client's site for the badge now. Up to 10 checks an hour per project, so check once after the client says it is installed.
  - after: Checks the client's site for the badge now. Each project gets up to 10 checks an hour.
- 2026-10-31 `get_badge` changed (description, annotations)
  - before: The agency-branded badge some directories require on the client's site: its status, a message to forward to the client, and install code for one platform. Call without platform to see the platforms.
  - after: The agency-branded badge some directories require on the client's site: its status, a message to forward to the client, the platforms it has install code for, and the code for the one named in platform.
- 2026-10-31 `list_events` changed (description, annotations)
  - before: Changes to projects and listings. The feed keeps 90 days and reads oldest first, so one call scans up to 1,000 events from the cursor (or from the start) and returns the newest ones since `since` (7 days ago by default). Keep next_cursor and pass it next time to read only what came after. For the current state of a project, get_project and list_listings are cheaper.
  - after: Changes to projects and listings. The feed keeps 90 days and reads oldest first, so one call scans up to 1,000 events from the cursor (or from the start) and returns the newest ones since `since` (7 days ago by default). Passed back in a later call, its next_cursor reads only what came after. For the current state of a project, get_project and list_listings are cheaper.
- 2026-10-31 `list_listings` changed (annotations)
- 2026-10-31 `add_directories` changed (description, inputSchema, annotations) **meaning changed**
  - before: Submits a launched project to more directories from its free allowance (no launch is spent). Call preview_launch with the same arguments first and get the user to agree. An include longer than the free allowance answers allowance_exhausted; a directory already listed answers invalid_directories.
  - after: Submits a launched project to more directories from its free allowance (no launch is spent). Refuses unless confirm_selected equals the directory count preview_launch returns for the same arguments. With a live key, a client on MCP protocol 2026-07-28 that supports elicitation also gets a question to confirm, and the answer does not pass through the model. This remote server keeps no session, so a client on an earlier protocol version is not asked. An include longer than the free allowance answers allowance_exhausted; a directory already listed answers invalid_directories.
- 2026-10-31 `launch_project` changed (description, inputSchema) **meaning changed**
  - before: Starts submissions and spends one launch of the agency (a test launch with a sbm_test_ key). Call preview_launch with the same arguments first and get the user to agree; confirm_selected is the count they agreed to. With a live key, clients that can ask their user get a confirmation question too.
  - after: Starts submissions and spends one of the agency's paid launches; with a sbm_test_ key it spends a test launch and submits nothing. Refuses unless confirm_selected equals the directory count preview_launch returns for the same arguments. With a live key, a client on MCP protocol 2026-07-28 that supports elicitation also gets a question to confirm, and the answer does not pass through the model. This remote server keeps no session, so a client on an earlier protocol version is not asked.
- 2026-10-31 `project_directories` changed (annotations)

Full history: https://api.protogrid.dev/v1/servers/com.submitator%2Fmcp/changes

## Dependencies

- npm submitator-mcp@0.1.1: unknown

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://mcp.submitator.com/mcp (streamable-http, auth api_key ${api_key}, reachable true, uptime30d 1)

## Packages

- npm submitator-mcp@0.1.1 secrets: SUBMITATOR_API_KEY

## Tools (23)

- `add_directories`: Submits a launched project to more directories from its free allowance (no launch is spent). Refuses unless confirm_selected equals the directory count preview_launch returns for the same arguments. With a live key, a client on MCP protocol 2026-07-28 that supports elicitation also gets a question to confirm, and the answer does not pass through the model. This remote server keeps no session, so a client on an earlier protocol version is not asked. An include longer than the free allowance answers allowance_exhausted; a directory already listed answers invalid_directories.
- `add_screenshot`: Adds one screenshot to a project (5 at most), from a public image URL. Each call adds another one: a repeated call adds the same image twice.
- `create_project`: Creates a project for a client's product from its URL. Name, tagline and description are filled from the site in the background when left out. Costs nothing: a launch is spent only by launch_project.
- `create_report`: Builds a PDF or XLSX report of a project, branded for the agency. Building takes a moment; get_report says when it is ready.
- `create_share_link`: Gives the project's client page link. Returns the current link when there is one; replace: true issues a new link and turns the old one off.
- `delete_draft`: Deletes a project that was never launched. A launched project cannot be deleted.
- `delete_share_link`: Turns the project's client page link off. Anyone holding it sees nothing afterwards.
- `find_directories`: Searches the directories Submitator submits to, highest Domain Rating first, or reads one by id. Before the agency first buys launches, only the top 20 are shown.
- `get_badge`: The agency-branded badge some directories require on the client's site: its status, a message to forward to the client, the platforms it has install code for, and the code for the one named in platform.
- `get_project`: One project in full: status, what it waits for, progress counts, allowance, readiness, texts, images and the image candidates found on its site.
- `get_report`: Whether a report is ready, and how to get the file.
- `get_share_link`: The project's client page link (a read-only progress page in the agency's brand), with its views.
- `launch_project`: Starts submissions and spends one of the agency's paid launches; with a sbm_test_ key it spends a test launch and submits nothing. Refuses unless confirm_selected equals the directory count preview_launch returns for the same arguments. With a live key, a client on MCP protocol 2026-07-28 that supports elicitation also gets a question to confirm, and the answer does not pass through the model. This remote server keeps no session, so a client on an earlier protocol version is not asked.
- `list_events`: Changes to projects and listings. The feed keeps 90 days and reads oldest first, so one call scans up to 1,000 events from the cursor (or from the start) and returns the newest ones since `since` (7 days ago by default). Passed back in a later call, its next_cursor reads only what came after. For the current state of a project, get_project and list_listings are cheaper.
- `list_listings`: A project's listings, one per directory, highest DR first, with status and the live link once published. Or one listing in full by its id.
- `list_projects`: Lists the agency projects, newest first. q finds one by part of its name or URL, and external_id by the agency's own id.
- `preview_launch`: Free dry run of launch_project (or of add_directories on a launched project) with the same arguments: how many directories it would submit to, what is missing, what would unlock more and what it costs, plus the top and median DR of the auto pick. Its would_submit count is the confirm_selected that launch_project or add_directories requires for the same arguments.
- `project_directories`: Every catalog directory as seen by one project: suggested (the auto pick), open, locked (with what unlocks it), excluded or listed. Shows suggested, open and locked by default; the counts cover all.
- `remove_image`: Removes the logo ("logo") or one screenshot (its img_ id). A launched project keeps at least its logo and one screenshot.
- `set_logo`: Sets or replaces a project's logo from a public image URL, fetched right away (a failed fetch answers image_unreachable).
- `update_project`: Changes the project fields it is sent and leaves the others as they are; null clears a field, and a list replaces the whole list. contact_email cannot change after launch, and after launch an edit reaches only the listings that have not been sent to their directory.
- `verify_badge`: Checks the client's site for the badge now. Each project gets up to 10 checks an hour.
- `whoami`: Shows the agency and mode (live or test) behind the key, its permissions, launches left and the hourly request budget.