Subtext
by Subtext
Hand an agent a session link and it opens the real production recording — event map, screenshots, DOM tree, console and network — to find the root cause. Fifteen listed tools split between session review and privacy-rule governance, four named OAuth scopes that separate reads from writes, and a preview-then-promote gate on the rules that decide what gets masked.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Subtext via MCP
https://api.fullstory.com/mcp/subtextWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Subtext Tools & Capabilities (15)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- The connector reads real users' session recordings, including screenshots, DOM state, console and network payloads, and the identified user's name, email and custom properties.
- Sessions are addressable by person. An email address or user ID is enough to list one individual's sessions.
- Rendered PII is captured unless tagged. Subtext states capture can include any DOM content by default; automatic masking covers form input, not text your app displays.
- URL and network rules have no approval gate.
privacy-url-createandprivacy-network-createtake effect for all sessions immediately, with no preview scope and no MCP delete. - Those two tools update in place. A URL rule update is a full replace, not a merge, so omitted fields are lost; a network rule can be overwritten with a flag.
- A URL rule can be unconditional, applying to every URL, if both match fields are left empty.
privacy-promoteis one-way through the agent tools. A promoted rule cannot be demoted or deleted via MCP.- No tool annotations are published, and the endpoint is gated, so nothing here is vendor-labelled read-only. Treat every tool as unannotated.
- The directory record has no
permissionslabel at all, over a tool set with five write-shaped verbs. - The directory listing is incomplete. Four documented
comment-*tools on the same core server are absent from Anthropic's snapshot. - Network rules have no matching OAuth scope among the four advertised; which scope authorises them is undocumented.
- The API-key path bypasses the scope split. A static bearer token is long-lived and not documented as narrowable.
- It is metered on two axes. Captured sessions and agent credits, both monthly. A full agent session review costs 10 credits, a quick summary 1.
- Free tops out at 10,000 sessions and 100 credits a month — roughly ten full reviews.
- Hitting a cap pauses the relevant function, per Subtext: capture pauses at the session cap and agent tools pause at the credit cap.
- Several review and privacy tools charge credits individually, including
review-list-sessions,review-summaryandprivacy-proposeat 1 credit each. - Free-tier retention is 30 days, so older sessions are not reachable on that plan.
- Verify tooling is a closed beta and separate from the core server; we did not count its tools.
- Usage-based pricing above the Team plan is not yet available, per Subtext's pricing page.
Frequently asked questions
Can the Subtext MCP server change what Fullstory records in production?
Partly, and the split matters. Element masking rules land in a preview scope and only reach production when a human promotes them, and the agent cannot delete a live rule at all. But URL and network rules created through the connector apply to all sessions immediately, with no preview step and no promotion gate. Those two tools are the ones to watch.
Can an agent remove a masking rule and expose data that was hidden before?
Not for live element rules. Subtext states the agent can only delete preview-scoped rules, and rejects a live rule ID outright, because removing production masking could expose personal data in future recordings. Removing a live rule requires the Fullstory settings interface. Unmask rules cannot be created through the connector either, and baseline form-input masking cannot be switched off by these tools.
Does the Subtext MCP server give an agent access to real session recordings?
Yes, directly and in detail. The review tools open a real production session and return the event map, a prose digest, screenshots of what the user saw, the component tree, and console and network activity down to headers and bodies. Sessions can be looked up by a user's email address, and responses carry the identified user's name, email and custom properties.
What OAuth scopes does the Subtext MCP server request?
Four, and they separate reading from writing. We verified them live on 2026-08-19 in the authentication challenge and the protected-resource descriptor alike: sessions:read, settings.privacy:read, settings.privacy.element_block:write and settings.privacy.url:write. Session data is read-only at the scope layer, and the two write scopes are confined to privacy settings. No scope grants writes to session content.
Is Subtext the same product as Fullstory session replay?
No. Subtext is a separate, self-serve product built by Fullstory on Fullstory capture infrastructure, with its own signup, billing and free tier. Fullstory states you do not need a Fullstory account, and that existing Fullstory customers get agentic session review through a different offering instead. The shared api.fullstory.com host reflects shared infrastructure, not a shared subscription.
How many tools does the Subtext MCP server have?
Anthropic's directory snapshot lists 15, and Subtext's documentation describes more than that. Four comment tools are documented as part of the same core server but absent from the snapshot, and a separate closed-beta browser toolset is documented on top. The 15 listed names are all real and all documented; the listing is a subset rather than a full inventory.
Do I need an enterprise plan to use the Subtext MCP server?
No. Subtext publishes a free tier with no credit card, covering 10,000 captured sessions and 100 agent credits a month, and paid plans at 50 and 250 dollars a month. No administrator role is documented as a prerequisite for connecting. Two meters apply: captured sessions and agent credits, where a full session review costs 10 credits.
Sources
- Subtext documentation home — https://subtext.fullstory.com/docs (fetched 2026-08-19) · retrieved 2026-08-19
- Session review tools reference — https://subtext.fullstory.com/docs/session-review/tools-reference (fetched 2026-08-19 as the
.mdvariant; documents every parameter and return for the six review tools) · retrieved 2026-08-19 - Privacy MCP tools reference — https://subtext.fullstory.com/docs/privacy/tools-reference (fetched 2026-08-19; the source for the preview/live scope model, the live-delete block, the unmask restriction and the no-preview warning on URL and network rules) · retrieved 2026-08-19
- Privacy and PII governance overview — https://subtext.fullstory.com/docs/privacy/overview (fetched 2026-08-19; baseline form masking, the governance workflow, the stated reason live rules are protected) · retrieved 2026-08-19
- Tagging sensitive elements — https://subtext.fullstory.com/docs/privacy/sensitive-elements (fetched 2026-08-19; states capture can include any DOM content by default) · retrieved 2026-08-19
- Installation overview — https://subtext.fullstory.com/docs/install/overview (fetched 2026-08-19; the two-part setup, the Fullstory edge-network capture note) · retrieved 2026-08-19
- Manual install — https://subtext.fullstory.com/docs/install/manual (fetched 2026-08-19; the OAuth and API-key connection paths) · retrieved 2026-08-19
- Comment tools reference — https://subtext.fullstory.com/docs/session-review/comment-tools (fetched 2026-08-19; four tools described as part of the core MCP server and absent from Anthropic's listing) · retrieved 2026-08-19
- Verify overview — https://subtext.fullstory.com/docs/verify/overview (fetched 2026-08-19; closed-beta tooling, excluded from our count) · retrieved 2026-08-19
- Linear triage recipe — https://subtext.fullstory.com/docs/recipes/linear (fetched 2026-08-19) · retrieved 2026-08-19
- Subtext pricing — https://subtext.fullstory.com/pricing (fetched 2026-08-19; Free $0 with 10,000 sessions and 100 credits, Starter $50/mo, Team $250/mo, 30-day retention on Free, credit costs, and the statement that a Fullstory account is not required) · retrieved 2026-08-19
- Introducing Subtext — https://subtext.fullstory.com/blog/introducing-subtext (fetched 2026-08-19) · retrieved 2026-08-19
- Subtext machine index — https://subtext.fullstory.com/llms.txt (fetched 2026-08-19; describes Subtext as a standalone self-serve product from Fullstory).
subtext.fullstory.com/robots.txtallows all agents with no disallows and publishes noContent-Signalaxes;www.fullstory.com/robots.txtallows all with one unrelated disallow and likewise publishes noContent-Signalaxes. A documentation index is also published athttps://subtext.fullstory.com/docs/llms.txt· retrieved 2026-08-19 - Live anonymous probe — 2026-08-19: an
initializePOST tohttps://api.fullstory.com/mcp/subtextreturns HTTP 401 withwww-authenticate: Bearer realm="Fullstory API", resource_metadata="...", scope="sessions:read settings.privacy:read settings.privacy.element_block:write settings.privacy.url:write", plus anx-fullstory-data-realmresponse header. No tool was called and no authentication was attempted · retrieved 2026-08-19 - Live RFC 9728 check — all three protected-resource path forms probed 2026-08-19: path-append returns a 269-byte JSON descriptor declaring four scopes and
authorization_servers: ["https://auth.fullstory.com"]; root returns a 301 redirect; path-insert returns a 52-byte typed JSON 404 · retrieved 2026-08-19 - Live RFC 8414 authorization-server metadata — https://auth.fullstory.com/.well-known/oauth-authorization-server (fetched 2026-08-19; 491 bytes,
S256only,authorization_codeandrefresh_tokengrants, noclient_credentials, public clients, dynamic registration and revocation endpoints, noscopes_supported). All three well-known forms onapi.fullstory.comreturn 404 · retrieved 2026-08-19 - Anthropic connector directory — https://claude.ai/directory/ba1a54c3-9b80-4113-8c04-4a599cc48936 (snapshot 2026-08-16; 15 tool names, no
permissionsfield, no prompts listed, author recorded as Fullstory) · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Subtext
- Tools
- 15
- Domain
- api.fullstory.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.