Terms of Service · SubflowAI Substack MCP

Effective date: July 2, 2026

Operator: GENAI UNPLUGGED LLC (Pennsylvania, USA)

1. Agreement

These product-specific Terms of Service govern your access to and use of the SubflowAI Substack MCP at substackmcp.genaiunplugged.com. They are supplemental to and governed by the GenAI Unplugged Terms of Service (the "Master Terms"), which cover disclaimers of warranties, limitation of liability, indemnification, intellectual property, governing law (Commonwealth of Pennsylvania), and dispute resolution (30-day informal period, then binding arbitration, class action waiver). By authenticating or using the SubflowAI Substack MCP you agree to both documents. In the event of any conflict, the Master Terms control.

2. What this product is

The SubflowAI Substack MCP is a Model Context Protocol (MCP) server operated by GENAI UNPLUGGED LLC. It enables compatible AI clients — including Claude Desktop, Claude Cowork, Claude Code, and ChatGPT — to work with your Substack account on your behalf. The full tool surface spans several categories: creating, editing, publishing, scheduling, and deleting Notes; creating and updating drafts and posts (including full-body replacement); listing your published and scheduled content; retrieving dashboard, subscriber, and post analytics; calendar-planning tools that check your weekly capacity, find free slots, and distribute a batch of Notes across your schedule; and AI tools that repurpose an article into Notes or refine a draft. The server is hosted on Cloudflare Workers at substackmcp.genaiunplugged.com, with OAuth authentication flows running on Oracle Cloud infrastructure at www.genaiunplugged.com.

Certain tools — the calendar-planning and AI tools in particular — are available only when you connect through the SubflowAI Chrome extension relay (see Section 6), and the AI tools draw down your SubflowAI AI credits. The relay is a separate connection path from the BYOK cookie method and is described in Sections 4 and 6.

The SubflowAI Substack MCP is a service, not a downloadable product. You receive access, not a transferable license. GENAI UNPLUGGED LLC controls, operates, and is solely responsible for the service. There is no co-brand partner. This product is not affiliated with, endorsed by, or approved by Substack, Inc. in any way.

3. Unofficial API disclaimer — USE AT YOUR OWN RISK

4. Access eligibility and tools

There are two independent ways to be granted access to the SubflowAI Substack MCP, and your tool tier depends on which one you use:

• Path A — Subscriber or SubflowAI customer, by email (BYOK). You sign in with a GenAI Unplugged magic link and provide your own Substack session cookie (see Section 6). Any active GenAI Unplugged Substack subscriber (free or paid) gets the Free tier (Notes management, drafts/posts, dashboard and subscriber stats, post listing). You receive the PluggedIn (Paid) tier, which additionally unlocks advanced analytics (subscriber growth timeseries, per-post traffic stats), if either (a) you are an active GenAI Unplugged paid Substack subscriber, or (b) the email you sign in with is associated with an active paid SubflowAI license (validated by email against our records; SubflowAI trials do not qualify). This means a paid SubflowAI customer can use the full standalone Substack tools without a GenAI Unplugged Substack subscription. "Active" means the subscription or license has not been cancelled, lapsed, refunded, or suspended at the time of the access request; access auto-revokes when it lapses.
• Path B — SubflowAI paid-license holder (relay). If you hold a valid, paid (non-trial) SubflowAI license, you may connect by pairing the SubflowAI Chrome extension (see Section 6). This grants the Paid tier regardless of whether you are a GenAI Unplugged Substack subscriber. Your SubflowAI license is validated server-to-server against the SubflowAI service at the time of pairing; SubflowAI trial licenses are not granted paid access. The relay-only calendar and AI tools, and any tools that consume SubflowAI AI credits, are available on this path.

You may not share, sell, or transfer your access tokens, session credentials, SubflowAI license, or relay pairing to any other person or system.

5. Payment and refunds

We do not process payments for the SubflowAI Substack MCP directly. Subscription payments are collected and managed by Substack under Substack's own billing terms. Refund requests for the Substack subscription are governed by Substack's refund policy. For billing disputes related to GenAI Unplugged, contact support@genaiunplugged.com.

6. Connecting your account — BYOK cookie or SubflowAI relay

There are two ways the Substack tools reach your Substack account. You choose one.

6.1 Bring-your-own-key (BYOK) — Substack session cookie. You provide your own Substack session cookie via the X-BYOK-Substack-Cookie HTTP request header (with your publication subdomain via X-BYOK-Substack-Subdomain). This is a BYOK arrangement:

• We never store your session cookie. The value travels in the request header, is forwarded once to Substack's endpoints in the same request lifecycle, and is then dropped from memory. It is never written to logs, databases, or any persistent storage.
• You are solely responsible for keeping your session cookie confidential. Do not share your cookie in public configs, screenshots, or version-controlled files.
• Cookie expiry: Substack session cookies typically expire within 30 days or when you log out of Substack in your browser. When a cookie expires, Substack tool calls will return authentication errors. You must obtain a fresh cookie from your browser and update your config.

6.2 SubflowAI extension relay. If you connect through the SubflowAI Chrome extension (Path B in Section 4), your Substack session never leaves your browser. Commands are relayed to the extension over an authenticated, per-user channel, and the extension executes them locally using your in-browser Substack session. We do not receive or store your session cookie on this path. The relay only works while your browser is open and online; when it is closed, relayed commands queue or fail, though Notes already scheduled natively on Substack still publish at their scheduled time. Relaying is fully revocable at any time from the extension's "Disconnect all agents" control.

6.3 Rate limits (both paths). 50 tool calls per hour and 200 tool calls per day per authenticated user, applied across all Substack tools. These limits are a protective cap, not a contractual SLA. GENAI UNPLUGGED LLC may adjust limits at any time.

7. Tool output, destructive operations, and your backups

The tools provided by the SubflowAI Substack MCP interact directly with your Substack account and can create, edit, publish, schedule, reschedule, overwrite, and permanently delete content on your behalf. Several tools are destructive or irreversible: note_delete permanently deletes a Note and cannot be undone; draft_update and draft_body_set perform a full-body replacement of a draft's content; and any publish or schedule action is irreversible once confirmed by Substack.

These are automated operations that you (through your AI client) direct. You are solely responsible for reviewing what your AI client proposes and for confirming operations before they run, and for maintaining your own backups of any content you value. To the maximum extent permitted by law, GENAI UNPLUGGED LLC is not liable for any loss, deletion, overwrite, corruption, or unintended creation, modification, publication, or scheduling of your Notes, drafts, posts, or other Substack content resulting from tool use — whether initiated by you, your AI client, or an automated agent you have connected. It is your responsibility to operate these tools in a safe manner.

8. Acceptable use

In addition to the prohibited-use rules in the Master Terms, you may not:

• Use the SubflowAI Substack MCP to publish spam, misleading content, or content that violates Substack's content policies or applicable law.
• Use the service to make automated, scripted, or bulk tool calls beyond the rate limits in Section 6.
• Attempt to reverse-engineer, scrape, or extract internal API endpoints, tool definitions, or session management logic.
• Share your OAuth access tokens, refresh tokens, or Substack session cookie with any other person or system.
• Use the service in any way that violates the Terms of Service of your AI client (Claude Desktop, Claude Cowork, Claude Code, etc.).
• Use the service to access a Substack account that does not belong to you.

9. Service availability

The SubflowAI Substack MCP is provided on an "as-is" and "as-available" basis. We may modify, rate-limit, suspend, or discontinue the service or any tool at any time without prior notice. We are also subject to changes or disruptions in Substack's internal API; Substack may block, change, or remove API endpoints at any time, and GENAI UNPLUGGED LLC is not responsible for service disruption resulting from Substack's actions. Planned maintenance will be communicated via the GenAI Unplugged Substack on a best-effort basis.

10. Disconnecting and account deletion

You can revoke your OAuth tokens at any time by re-authenticating with a new magic link or by contacting support. If you connected through the SubflowAI extension relay, use the "Disconnect all agents" control in the extension to revoke access immediately. Disconnecting does not cancel your Substack or SubflowAI subscription; manage those directly with the respective provider.

To request deletion of all data we hold about you (OAuth token records, KV entries, audit log rows), email support@genaiunplugged.com. We will action deletion requests within 30 days. The 90-day audit log auto-purges in any case. We do not hold your Substack session cookie.

11. Support

Questions, issues, and bug reports: support@genaiunplugged.com. We aim to respond within 3 business days on a best-effort basis. We cannot guarantee resolution of issues caused by Substack's internal API changes or your MCP client's behaviour.

12. Conflict with Master Terms

Nothing in these product Terms expands, reduces, or overrides the GenAI Unplugged Master Terms. If any provision here conflicts with the Master Terms, the Master Terms control. The unofficial-API disclaimer and "use at your own risk" language in Section 3 are additive — they do not reduce the protections afforded to GENAI UNPLUGGED LLC under the Master Terms.

Effective July 2, 2026. Operator: GENAI UNPLUGGED LLC. Contact: support@genaiunplugged.com.