Subscriberapi Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Subscriberapi Mcp (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP (Model Context Protocol) server that lets GitHub Copilot CLI query SFMC SubscriberAPI execution logs — health checks, email lookups, execution traces, and recent errors.
SFMC developers and engineers who want to troubleshoot SubscriberViaAPI issues from the terminal using natural language, for example:
MyForm."abc-123."git clone https://github.com/YOUR-ORG/subscriberapi-mcp.git
cd subscriberapi-mcpTip: Clone to a folder without spaces in the path (e.g. C:\dev\subscriberapi-mcp) to avoid Windows path issues.npm run setupcp .env.example .envEdit .env and set:
SFMC_LOG_ENDPOINT — your SFMC execution log API URLSFMC_LOG_API_KEY — your API keyNever commit `.env`. It is already in .gitignore.
This repo includes a project-level MCP config (.mcp.json) with a relative path — no machine-specific paths required.
From the cloned repo folder, start Copilot:
copilotCopilot auto-loads .mcp.json when you work in this project. You should see subscriberapi with a green checkmark under MCP Servers.
Inside Copilot:
Use subscriberapi health_check and tell me the result.Or from the shell (one-shot):
copilot -p "Call subscriberapi health_check" --allow-all-tools| Tool | Description |
|---|---|
health_check | Check if the SFMC log endpoint is available |
get_executions_by_email | Find executions by email (optional source, date range, limit) |
get_execution_trace | Get full trace for a formRequestId |
get_recent_errors | List recent errors (optional filters) |
| File | Purpose |
|---|---|
.mcp.json | Shared Copilot MCP config (relative dist/index.js, no secrets) |
.env | Private API credentials (each developer creates their own) |
~/.copilot/mcp-config.json | Optional global Copilot MCP config (user-specific) |
Recommended: Rely on .mcp.json in the repo. Each developer only needs their own .env.
If you previously added subscriberapi to your global ~/.copilot/mcp-config.json with an absolute path, remove it to avoid duplicates:
copilot mcp remove subscriberapiIf you want subscriberapi available outside this repo, register it once from the cloned folder:
Windows (PowerShell):
.\scripts\register-copilot-mcp.ps1macOS / Linux:
./scripts/register-copilot-mcp.shThese scripts read credentials from your .env and register an absolute path on your machine only.
npm run dev # run TypeScript directly (tsx)
npm run build # compile to dist/
npm start # run compiled server| Issue | Fix |
|---|---|
Red X on subscriberapi | Run npm run build so dist/index.js exists |
Missing SFMC_LOG_ENDPOINT | Create .env from .env.example |
| Path split at space (Windows) | Clone to a path without spaces, or use the register script |
Permission denied in -p mode | Add --allow-all-tools |
Duplicate subscriberapi servers | Run copilot mcp remove subscriberapi for the global entry |
ISC
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.