Permissions and Safety
The guard plugin whose hook makes every destructive tool ask, what destructive means on the Subscriby server, least-privilege tokens, the audit trail, members' data, and the settings a team admin uses.
Three layers keep a session with the kit safe: the server enforces an ability on every tool, the same one its REST twin requires, so a connection can never act beyond the account's reach; every skill reads before it writes, shows you the exact record and what will change, and waits for your yes before a destructive tool is called; and the companion guard plugin makes Claude Code itself stop at every tool that changes or removes existing data, whatever your permission settings say.
The guard
subscriby-guard is a second plugin in the same marketplace, installed beside the kit:
/plugin install subscriby-guard@envigoIt registers a PreToolUse hook whose matcher is the generated list of the server's destructive tools. When Claude is about to call one, the hook answers with a permission decision of ask, so Claude Code shows the call and waits for you, with this reason:
This Subscriby tool changes or removes existing data. Confirm it before it runs.It fires whatever your permission settings say: even a session that has auto-approved the Subscriby server still stops at a cancellation, a deletion, a ban, a secret rotation or a refund. The hook is a plain shell command with no dependencies, it reads nothing from the call, and it never changes the arguments.
Why a second plugin
The guard is a command hook, and Anthropic's plugin directory accepts command hooks only from organizations it has verified, so the kit's listing there carries none; the marketplace carries both plugins, and the guard carries the kit's version and updates with it. Without the guard, Claude Code's own permission prompt still covers every tool unless you auto-approve the server, and the skills confirm every destructive change in conversation before the tool is called.
Of the 238 tools the server publishes, 108 only read and never prompt, 46 add something new (a project, a plan, a coupon, a reply) and run as the client's own permission settings allow, and 84 change or remove existing data and, with the guard installed, ask before they run whatever the client's settings say.
What destructive means
Every tool the server publishes carries annotations: readOnlyHint for a read, and destructiveHint set to true for a change or removal of existing data and false for an additive write. The guard follows the flag, never a hand-typed list, so a new tool is guarded the moment the catalogue says it should be.
| Example | Flag | What happens in a session |
|---|---|---|
cancel_subscription, delete_plan, ban_member, rotate_webhook_endpoint_secret, broadcast_message | destructive | The skill has shown you what will change and waited for your yes; with the guard installed, Claude Code asks once more at the call, whatever your settings say. |
create_project, create_coupon, invite_team_member, retry_webhook_delivery, reply_support_conversation | additive | Runs as your Claude Code permission settings allow; the skill still confirms wording that reaches a real person, such as a support reply or a broadcast. |
list_subscribers, get_dashboard_metrics, get_webhook_delivery | read-only | Never prompts; the agents are built from these alone. |
Some additive tools reach people
A support reply reaches a member and a broadcast reaches everyone, and neither can be recalled. The skills for the inbox and for broadcasts therefore ask for your approval of the exact wording and, for a broadcast, the previewed audience, before the tool runs, even though the wire flag is additive.
Least privilege
Signing in gives the connection your own reach on the team you chose; that is the right default for the creator working on their own community. For a narrower connection, a personal access token carries only the abilities you tick:
- A read-only token for research and reports: the
view-any,viewandreadabilities (project:view-any,project-subscription:view-any,dashboard:read,activity:readand the like), nothing that creates, updates or deletes. - A token restricted to chosen projects:
scope:project:entries, so anything outside them answers as not found. - A write token kept apart from a read token, so a leak of the one shows what the dashboard shows and changes nothing.
/subscriby:mint-token proposes the least set for a purpose from the catalogue; Authentication and the ability catalogue carry the rules.
The audit trail
Every REST call and every MCP tool call is recorded in the activity log with the actor kind, so an action Claude took is attributable to the connection that took it, beside the actions you took in the dashboard. Read it in the dashboard, with get_activity_log, or over GET /v1/activity; the community analyst and /subscriby:weekly quote it.
Members' data
Tool results and webhook payloads never carry a member's e-mail address, card data, fee breakdowns or support message bodies, and the skills say so, so Claude never expects them. A member's own data stays where Subscriby keeps it; what crosses to Claude is what the dashboard shows the signed-in account. The kit never asks you to paste a token, a secret or a credential into a conversation, a file or a commit, and the hub skill forbids Claude from doing so.
Your settings
Claude Code's own permission system applies to every tool the plugin adds. You may approve calls one by one, or auto-approve the Subscriby server for a session so reads and additive writes run without prompts; with the guard installed, every destructive tool still stops. Disconnect the server in /mcp to end the connection, and revoke the authorization under your account's connected applications on Subscriby to end it for every machine.
Questions
How is this guide?
Last updated on
Subagents
The three subagents the kit adds to Claude Code, when Claude delegates to them on its own, how to ask for one, and the generated allowlists that keep them read-only.
Updates and Versions
How a new kit version reaches you, the kit's own version line and changelog, the catalogue stamp, what it means that the kit follows code, and the eval suite as the proof of a release.