Memberpass Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Memberpass Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Connect Claude, Cursor, VS Code and other MCP clients to your Subscriby workspace.
Subscriby is a connector-based community monetisation platform — creators sell access to the channels, groups and servers a connector gates, with projects, tiered subscriptions, access codes, and analytics. Learn more at subscriby.net.
217 tools across your own account (who the token belongs to, its team, plan capabilities, connected accounts and alert routing, the notification centre, an export of everything it holds, and its standing in the Partner Program: the code and links, the commission ladder, the referrals, the ledger and the payouts, with the payout rail written but never read back, and its Transaction Fees ledger: every fee Subscriby charged it, line by line and added up per month, with the invoice that billed each, and its Copilot Credits, the prepaid pool that pays for Subscriby Copilot past the monthly free allowance: the balance split into free and paid, the statement, a pack to buy on a Stripe Checkout page and the auto top-up and cap), the Connectors Marketplace (every connector in its lane, what each can do and the form that connects it) and a project's connector installations (read them with their health; install, verify, configure, disconnect, and uninstall them after an impact preview), projects and their portal design (the look of the portal page: read the published document and the draft, change its keys, publish or discard), plans and pass windows, subscriptions and their access grants, the hand-arranged perks still to deliver, the Disaster Recovery ledger (incidents, recoveries and their undo state, roll calls, allowances, readiness) and its controls (failover settings, standbys and their mirror, chat pickers, undo, reminders, the handover mail), coupons, Smart Links (a tracked address per channel with its three addresses to share and the funnel behind it), Revenue Recovery (the grace window with its ladder in words, the cancellation screen's offers and the feedback it gathered, the recovery sequences with their steps and the passages members made through them, the checkout ledger, and the figures the dashboard card shows), the Referral Program (the programme, its affiliates, their referrals, the reward ledger and the payouts the creator records), subscriptions, members and their connected accounts, the support inbox (conversations, saved replies, settings with the two switches that let Subscriby Copilot answer members), Knowledge (what a project has taught Subscriby Copilot: questions with their answers and documents sent as text, each marked for members or for the team alone), access codes, payment methods, payments, broadcasts, resources, bots, teams, webhook endpoints and deliveries, and analytics. See the full catalog at docs.subscriby.net/mcp/v1/tools-reference. Every tool declares whether it only reads or may change data, so a client can ask before running a destructive one.
Add https://mcp.subscriby.net as a custom connector in claude.ai or Claude Desktop, or run claude mcp add --transport http subscriby https://mcp.subscriby.net in Claude Code, then sign in when asked. Follow docs.subscriby.net/mcp/v1/connecting-claude-desktop.
Follow docs.subscriby.net/mcp/v1/connecting-cursor.
Follow docs.subscriby.net/mcp/v1/connecting-vscode-claude.
Follow docs.subscriby.net/mcp/v1/connecting-chatgpt-desktop.
Two credentials work on the same endpoint:
401 challenge, registers itself dynamically (RFC 7591) and sends you to Subscriby to sign in and authorize; PKCE S256 is required, access tokens last an hour and refresh tokens rotate. The connection acts as you, on the team you are working in. Nothing to copy.Authorization: Bearer sbt_…, minted at https://app.subscriby.net/settings/tokens with only the abilities and team scope you choose.See docs.subscriby.net/mcp/v1/authentication.
Every tool enforces one ability; an OAuth connection satisfies them all as the signed-in creator, a personal access token only those it carries. See docs.subscriby.net/api/v1/abilities.
See docs.subscriby.net/api/v1/rate-limiting.
See docs.subscriby.net/api/v1/errors.
See docs.subscriby.net/mcp/v1/async-jobs.
See SECURITY.md.
See CHANGELOG.md. The version field in server.json is the canonical version published to the MCP Registry.
MIT.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.