An AI-native product should not require you to use its own chat box. If the assistant you already trust can talk to Subscriber Bot directly, that is strictly better than a captive interface — and it is a real test of whether the API is complete, because an external agent has no UI to lean on.
The MCP server covers the whole domain rather than a demo slice. Forty product tools span providers and plans, relationships and entitlements and assets and renewal events, payment instruments and invoices and ingest channels and the Universal Inbox, and the automation layer of agents, policies, and workflows — plus a health probe. Alongside them sit read-only resources that expose the domain schema and your live providers, relationships, and portfolios, and guided prompt templates for common multi-step jobs. The server also mounts the shared platform modules — authentication, workspaces, organisations, files, tags, notifications, billing, export, security, and more — so an agent can complete an errand that crosses out of the subscription domain without a second connection.
Governance is inherited, not reimplemented. Every tool call runs through the same workspace API endpoint the browser uses, carries your identity from a real login, and is checked at the gateway against your role permissions before any resolver runs. Writes are workspace-scoped with a guarded update that asserts exactly one row changed. Every operation lands in the audit trail with the acting identity, workspace, action, and resource, and credential-shaped values are redacted before anything is logged. There is no service account, no bypass path, and no tool that can reach outside your workspace.
Tool metadata is filled in automatically: every registered tool is annotated as read-only or destructive so a well-behaved client can warn before it acts, and the annotation is applied centrally rather than left to each module to remember.
The gap worth naming precisely: the confirmation gate is not on for this product. The platform supports requiring an explicit confirmation before any destructive tool executes, but Subscriber Bot's server does not opt in — and even if it did, the automatic destructive-detection heuristic keys on the word "delete", while Subscriber Bot's genuinely consequential tools are named cancel, archive, and remove. So a capable agent can cancel a tracked relationship, archive a provider, or remove a payment instrument on the first call, with an audit record but no second look. Closing that — an explicit destructive annotation on each of those tools plus the confirmation gate switched on — is the next piece of MCP work, and it is a governance gap rather than a feature.
Because this story is lived in an external AI client — Claude Desktop, an IDE agent, or a harness you run yourself — rather than inside the Subscriber Bot web app, there is no in-app "Do it yourself" walkthrough for it. The capabilities below describe what that client gains once it connects, not a sequence of clicks inside the product UI.
Ready to make this your story?
