Subtext

Open the real production session recording — events, screenshots, DOM, console, network — to find root cause.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Subtext connector does

The Subtext MCP server lets Claude or any MCP-compatible agent open a real production session recording and investigate it — event map, screenshots, DOM tree, console and network traffic — instead of a human scrubbing a replay video. A second tool family lets the agent govern which page elements, URLs and network bodies get captured at all.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Subtext tools (15)

  • privacy-create
  • privacy-delete
  • privacy-list
  • privacy-promote
  • privacy-propose
  • review-close
  • review-snapshot
  • review-list-sessions
  • review-open
  • review-summary
  • review-zoom
  • privacy-url-list
  • privacy-url-create
  • privacy-network-list
  • privacy-network-create

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • The connector reads real users' session recordings, including screenshots, DOM state, console and network payloads, and the identified user's name, email and custom properties.
  • Sessions are addressable by person. An email address or user ID is enough to list one individual's sessions.
  • Rendered PII is captured unless tagged. Subtext states capture can include any DOM content by default; automatic masking covers form input, not text your app displays.
  • URL and network rules have no approval gate. privacy-url-create and privacy-network-create take effect for all sessions immediately, with no preview scope and no MCP delete.
  • Those two tools update in place. A URL rule update is a full replace, not a merge, so omitted fields are lost; a network rule can be overwritten with a flag.
  • A URL rule can be unconditional, applying to every URL, if both match fields are left empty.
  • privacy-promote is one-way through the agent tools. A promoted rule cannot be demoted or deleted via MCP.
  • No tool annotations are published, and the endpoint is gated, so nothing here is vendor-labelled read-only. Treat every tool as unannotated.
  • The directory record has no permissions label at all, over a tool set with five write-shaped verbs.
  • The directory listing is incomplete. Four documented comment-* tools on the same core server are absent from Anthropic's snapshot.
  • Network rules have no matching OAuth scope among the four advertised; which scope authorises them is undocumented.
  • The API-key path bypasses the scope split. A static bearer token is long-lived and not documented as narrowable.
  • It is metered on two axes. Captured sessions and agent credits, both monthly. A full agent session review costs 10 credits, a quick summary 1.
  • Free tops out at 10,000 sessions and 100 credits a month — roughly ten full reviews.
  • Hitting a cap pauses the relevant function, per Subtext: capture pauses at the session cap and agent tools pause at the credit cap.
  • Several review and privacy tools charge credits individually, including review-list-sessions, review-summary and privacy-propose at 1 credit each.
  • Free-tier retention is 30 days, so older sessions are not reachable on that plan.
  • Verify tooling is a closed beta and separate from the core server; we did not count its tools.
  • Usage-based pricing above the Team plan is not yet available, per Subtext's pricing page.

Frequently asked questions

Can the Subtext MCP server change what Fullstory records in production?

Partly, and the split matters. Element masking rules land in a preview scope and only reach production when a human promotes them, and the agent cannot delete a live rule at all. But URL and network rules created through the connector apply to all sessions immediately, with no preview step and no promotion gate. Those two tools are the ones to watch.

Can an agent remove a masking rule and expose data that was hidden before?

Not for live element rules. Subtext states the agent can only delete preview-scoped rules, and rejects a live rule ID outright, because removing production masking could expose personal data in future recordings. Removing a live rule requires the Fullstory settings interface. Unmask rules cannot be created through the connector either, and baseline form-input masking cannot be switched off by these tools.

Does the Subtext MCP server give an agent access to real session recordings?

Yes, directly and in detail. The review tools open a real production session and return the event map, a prose digest, screenshots of what the user saw, the component tree, and console and network activity down to headers and bodies. Sessions can be looked up by a user's email address, and responses carry the identified user's name, email and custom properties.

What OAuth scopes does the Subtext MCP server request?

Four, and they separate reading from writing. We verified them live on 2026-08-19 in the authentication challenge and the protected-resource descriptor alike: sessions:read, settings.privacy:read, settings.privacy.element_block:write and settings.privacy.url:write. Session data is read-only at the scope layer, and the two write scopes are confined to privacy settings. No scope grants writes to session content.

Is Subtext the same product as Fullstory session replay?

No. Subtext is a separate, self-serve product built by Fullstory on Fullstory capture infrastructure, with its own signup, billing and free tier. Fullstory states you do not need a Fullstory account, and that existing Fullstory customers get agentic session review through a different offering instead. The shared api.fullstory.com host reflects shared infrastructure, not a shared subscription.

How many tools does the Subtext MCP server have?

Anthropic's directory snapshot lists 15, and Subtext's documentation describes more than that. Four comment tools are documented as part of the same core server but absent from the snapshot, and a separate closed-beta browser toolset is documented on top. The 15 listed names are all real and all documented; the listing is a subset rather than a full inventory.

Do I need an enterprise plan to use the Subtext MCP server?

No. Subtext publishes a free tier with no credit card, covering 10,000 captured sessions and 100 agent credits a month, and paid plans at 50 and 250 dollars a month. No administrator role is documented as a prerequisite for connecting. Two meters apply: captured sessions and agent credits, where a full session review costs 10 credits.

Sources

  • Subtext documentation home — https://subtext.fullstory.com/docs (fetched 2026-08-19) · retrieved 2026-08-19
  • Session review tools reference — https://subtext.fullstory.com/docs/session-review/tools-reference (fetched 2026-08-19 as the .md variant; documents every parameter and return for the six review tools) · retrieved 2026-08-19
  • Privacy MCP tools reference — https://subtext.fullstory.com/docs/privacy/tools-reference (fetched 2026-08-19; the source for the preview/live scope model, the live-delete block, the unmask restriction and the no-preview warning on URL and network rules) · retrieved 2026-08-19
  • Privacy and PII governance overview — https://subtext.fullstory.com/docs/privacy/overview (fetched 2026-08-19; baseline form masking, the governance workflow, the stated reason live rules are protected) · retrieved 2026-08-19
  • Tagging sensitive elements — https://subtext.fullstory.com/docs/privacy/sensitive-elements (fetched 2026-08-19; states capture can include any DOM content by default) · retrieved 2026-08-19
  • Installation overview — https://subtext.fullstory.com/docs/install/overview (fetched 2026-08-19; the two-part setup, the Fullstory edge-network capture note) · retrieved 2026-08-19
  • Manual install — https://subtext.fullstory.com/docs/install/manual (fetched 2026-08-19; the OAuth and API-key connection paths) · retrieved 2026-08-19
  • Comment tools reference — https://subtext.fullstory.com/docs/session-review/comment-tools (fetched 2026-08-19; four tools described as part of the core MCP server and absent from Anthropic's listing) · retrieved 2026-08-19
  • Verify overview — https://subtext.fullstory.com/docs/verify/overview (fetched 2026-08-19; closed-beta tooling, excluded from our count) · retrieved 2026-08-19
  • Linear triage recipe — https://subtext.fullstory.com/docs/recipes/linear (fetched 2026-08-19) · retrieved 2026-08-19
  • Subtext pricing — https://subtext.fullstory.com/pricing (fetched 2026-08-19; Free $0 with 10,000 sessions and 100 credits, Starter $50/mo, Team $250/mo, 30-day retention on Free, credit costs, and the statement that a Fullstory account is not required) · retrieved 2026-08-19
  • Introducing Subtext — https://subtext.fullstory.com/blog/introducing-subtext (fetched 2026-08-19) · retrieved 2026-08-19
  • Subtext machine index — https://subtext.fullstory.com/llms.txt (fetched 2026-08-19; describes Subtext as a standalone self-serve product from Fullstory). subtext.fullstory.com/robots.txt allows all agents with no disallows and publishes no Content-Signal axes; www.fullstory.com/robots.txt allows all with one unrelated disallow and likewise publishes no Content-Signal axes. A documentation index is also published at https://subtext.fullstory.com/docs/llms.txt · retrieved 2026-08-19
  • Live anonymous probe — 2026-08-19: an initialize POST to https://api.fullstory.com/mcp/subtext returns HTTP 401 with www-authenticate: Bearer realm="Fullstory API", resource_metadata="...", scope="sessions:read settings.privacy:read settings.privacy.element_block:write settings.privacy.url:write", plus an x-fullstory-data-realm response header. No tool was called and no authentication was attempted · retrieved 2026-08-19
  • Live RFC 9728 check — all three protected-resource path forms probed 2026-08-19: path-append returns a 269-byte JSON descriptor declaring four scopes and authorization_servers: ["https://auth.fullstory.com"]; root returns a 301 redirect; path-insert returns a 52-byte typed JSON 404 · retrieved 2026-08-19
  • Live RFC 8414 authorization-server metadata — https://auth.fullstory.com/.well-known/oauth-authorization-server (fetched 2026-08-19; 491 bytes, S256 only, authorization_code and refresh_token grants, no client_credentials, public clients, dynamic registration and revocation endpoints, no scopes_supported). All three well-known forms on api.fullstory.com return 404 · retrieved 2026-08-19
  • Anthropic connector directory — https://claude.ai/directory/ba1a54c3-9b80-4113-8c04-4a599cc48936 (snapshot 2026-08-16; 15 tool names, no permissions field, no prompts listed, author recorded as Fullstory) · retrieved 2026-08-16

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Subtext to work.

Connect Subtext once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio