Xyla AI
REMOTE · APP.XYLA.AI
Social posts for Shopify and WooCommerce stores: approve posts, see results, change settings.
Available components
Last scanned (1 hour ago)
Scores higher than 94% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security92
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2193 tokens (~84/item across 26 items; 21 tools + 5 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management47
- Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Nov 26 0
- New tool “boost_estimate” functional
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://app.xyla.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=app.xyla.ai | CN=WE1,O=Google Trust Services,C=US | 3 Nov 2026 | 1 Feb 2027 | ECDSA 256 | ECDSA-SHA256 | a87774e2e23789fa1323b1d8fe2ff7b8 |
| SANs: app.xyla.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of app.xyla.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 1814, 3799 | 8, 8 | Verified |
| xyla.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://app.xyla.ai/.well-known/oauth-protected-resource/mcp", scope="xyla.read xyla.write"
Bearer resource_metadata="https://app.xyla.ai/.well-known/oauth-protected-resource/mcp", scope="xyla.read xyla.write" | Header | Value |
|---|---|
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
Protected resource metadata
| Document | https://app.xyla.ai/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://app.xyla.ai/mcp |
| Authorisation server | https://app.xyla.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://app.xyla.ai/mcp | Verified | 200 | |
| http (plaintext) | http://app.xyla.ai/mcp | HTTPS enforced | 301 | https://app.xyla.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
approve_first_batch Approve the first batch ~73
Approves this Xyla shop's first batch of posts as a whole. When the shop can publish, this also turns autopilot on in include mode (the posts already made are scheduled and nothing is deleted), and releases posts held for review into the schedule. Posts go out at their scheduled times, not straight away.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
approve_posts Approve posts ~90
Approves posts in this Xyla shop that are waiting for approval, by their IDs from pending_approvals. Each approved post takes the next free slot in the schedule; nothing publishes straight away. Posts in the shop's first batch cannot be approved one by one: use approve_first_batch for those.
| Name | Type | Req | Description |
|---|---|---|---|
| post_ids | array | yes | The IDs of the posts to approve, from pending_approvals. |
No output schema declared.
No examples provided.
boost_estimate Boost reach estimate ~111
Estimates how many more people and store visits this Xyla shop could get each month with Boost, Xyla's always-on ads for the store, at a daily budget of $5 to $50. Use it when the merchant asks how to get more reach, followers, traffic or sales. Compares against the shop's own post reach and links to the Boost page in Xyla.
| Name | Type | Req | Description |
|---|---|---|---|
| daily_budget_dollars | integer | – | Daily budget in whole dollars. Defaults to 10, Xyla's suggestion. |
No output schema declared.
No examples provided.
change_history Settings change history ~69
Lists recent changes to the shop's Xyla settings, newest first: what changed, before and after, who made it (the merchant, Xyla or the assistant), and the undo id to pass to undo_change.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | How many changes to list. Defaults to 10. |
No output schema declared.
No examples provided.
change_settings Change settings ~140
Changes the shop's Xyla settings in one setting group (or a few related ones) and returns each value before and after plus an undo id. Every change in a call applies, or none does. Read the group with get_settings first, and confirm the change with the merchant before calling this. Changes affect posts made from now on, not posts already scheduled or published.
| Name | Type | Req | Description |
|---|---|---|---|
| actions | array | yes | The changes, applied together: all of them or none. |
| tool | string | yes | The setting group to change. logo, outro, post_type_on_off, billing cannot be changed from chat; naming one returns the web page to change it on. |
No output schema declared.
No examples provided.
confirm_post_fix Run a post fix ~92
Runs a post fix that request_post_fix started in this Xyla shop, with the change the merchant asked for. Call post_fix_status first and tell the merchant whether it is free or what it costs; a fix that is not free uses the shop's credits. The new image or video replaces the post's media when it is ready.
| Name | Type | Req | Description |
|---|---|---|---|
| audit_id | integer | yes | The audit_id from request_post_fix. |
No output schema declared.
No examples provided.
connect_account Connect a social account ~152
Makes a one-use link that connects a social account to this Xyla shop, or reconnects a broken one. Give the merchant the link to open in their browser; it works once and expires in 10 minutes, and asks for the store's email. To reconnect an account from connection_status, pass its social_media_account_id. Instagram has two ways in: instagram_direct (Instagram Login, the usual choice) and instagram (through a Facebook Page, needed for Stories and product tags). Disconnecting stays on the Xyla website.
| Name | Type | Req | Description |
|---|---|---|---|
| provider | string | yes | The platform to connect. |
| social_media_account_id | integer | – | The account to reconnect, from connection_status. Leave out to connect a new account. |
No output schema declared.
No examples provided.
connection_status Social account health ~46
Shows each social account connected to this Xyla shop: connected, expiring soon, expired, needs reconnecting, restricted or disconnected, and how many upcoming posts a broken account is blocking.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_settings Read settings ~68
Shows the shop's current Xyla settings for one setting group, with the ids change_settings needs and how each field works. Call it without tool to list the setting groups. Read a group before changing it.
| Name | Type | Req | Description |
|---|---|---|---|
| tool | string | – | The setting group to read. Leave out to list them. |
No output schema declared.
No examples provided.
insights Post results ~77
Shows how this Xyla shop's published posts performed over the last 7, 14, 30 or 90 days: reach, views, engagement, followers per account, and the top posts. Same data as the Insights page in Xyla.
| Name | Type | Req | Description |
|---|---|---|---|
| window_days | integer | – | How many days back to look. Defaults to 30. |
No output schema declared.
No examples provided.
pending_approvals Posts waiting for approval ~89
Lists the posts in this Xyla shop that wait for the merchant's approval before they are scheduled, 12 per page, with captions and media links. When the shop is still on its first batch, returns that batch as one draft: it is approved as a whole, not post by post.
| Name | Type | Req | Description |
|---|---|---|---|
| page | integer | – | Page number, starting at 1. Defaults to 1. |
No output schema declared.
No examples provided.
post_fix_status Post fix status ~78
Reports where a post fix from request_post_fix stands in this Xyla shop: still being checked, free (Xyla found a problem on its side), or how many credits it costs. After confirm_post_fix, reports whether the fix is running, done or failed.
| Name | Type | Req | Description |
|---|---|---|---|
| audit_id | integer | yes | The audit_id from request_post_fix. |
No output schema declared.
No examples provided.
preview_status Check a store preview ~79
Checks a store preview started with preview_store: the brand Xyla found and the sample posts finished so far. done is true once the preview is ready or has stopped. While the preview card is showing it updates itself, so only call this when no card is shown, every few seconds.
| Name | Type | Req | Description |
|---|---|---|---|
| token | string | yes | The preview token preview_store returned. |
No output schema declared.
No examples provided.
preview_store Preview a store ~166
Shows what Xyla would post for an online store, with no Xyla account. Give it the store's web address (Shopify or WooCommerce). Xyla reads the store's brand (logo, colours, niche) and makes 3 sample social media posts from the store's own product photos, with captions. Returns a preview token at once; the posts take about 3 minutes and the card shows them as they finish. A store previewed in the last 7 days gets its earlier samples back. When no card is shown, call preview_status with the token to follow it. A store that already uses Xyla gets a sign-in link instead.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | The store's web address, such as yourstore.com or yourstore.myshopify.com. |
No output schema declared.
No examples provided.
reject_post Reject a post ~63
Rejects one post in this Xyla shop that is waiting for approval, by its ID from pending_approvals. The post is cancelled and will not be published.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | integer | yes | The ID of the post to reject, from pending_approvals. |
No output schema declared.
No examples provided.
request_post_fix Ask for a post fix ~118
Starts a fix for one post's image or video in this Xyla shop. Xyla first checks the media for a problem on its side, which makes the fix free; otherwise the fix costs credits. Nothing is changed or charged yet. Then call post_fix_status with the audit_id to learn the cost, tell the merchant, and call confirm_post_fix only once they agree.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | integer | yes | The ID of the post to fix. |
| what_to_change | string | yes | What the merchant wants changed, in their words. |
No output schema declared.
No examples provided.
set_autopilot Turn autopilot on or off ~199
Turns Xyla autopilot on or off for this shop. With autopilot on, Xyla makes and schedules posts by itself. mode include (the default) keeps posts already made and adds them to the schedule. mode fresh DELETES every post not yet scheduled, including posts the merchant made by hand, then builds a new schedule: call it first without confirm_delete_count to get the number of posts it deletes, tell the merchant, and only after they agree call again with confirm_delete_count set to that number. Turning autopilot off unschedules upcoming posts and deletes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm_delete_count | integer | – | Fresh mode only: the number of posts to delete, from the previous set_autopilot reply, after the merchant agreed. |
| mode | string | – | Only when turning on. include keeps existing posts; fresh deletes unscheduled posts first. |
| on | boolean | yes | true turns autopilot on, false turns it off. |
No output schema declared.
No examples provided.
shop_overview Shop overview ~52
Summarises this Xyla shop: its plan, AI credits left, whether autopilot is on, how many posts wait for approval, the next 3 posts due, and any social account that needs fixing.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
undo_change Undo a settings change ~79
Puts back the settings a change set replaced, using the undo id from change_settings or change_history. The whole set is undone, or nothing is. It is refused when a setting has changed again since, so a newer choice is never overwritten.
| Name | Type | Req | Description |
|---|---|---|---|
| undo_id | string | yes | The undo id, exactly as change_settings or change_history gave it. |
No output schema declared.
No examples provided.
upcoming_posts Upcoming posts ~127
Lists the posts this Xyla shop will publish, day by day, for up to 7 days from a start date (the shop's today if left out). Each post has its platforms, send time in the shop's time zone, type, caption and media links. Posts waiting for approval are not here: use pending_approvals.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | How many days to show, 1 to 7. Defaults to 7. |
| start_date | string | – | First day to show, as YYYY-MM-DD in the shop's time zone. Defaults to today. |
No output schema declared.
No examples provided.
whoami Connected shop ~29
Shows which Xyla shop this connection acts for and whether it can only read or can also make changes.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the Xyla AI MCP server?
Xyla AI is a hosted endpoint at https://app.xyla.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · app.xyla.ai
claude mcp add --transport http ai-xyla-xyla 'https://app.xyla.ai/mcp'
What is the Xyla AI MCP server?
Xyla AI is an MCP server listed in the public MCP registry as ai.xyla/xyla. Social posts for Shopify and WooCommerce stores: approve posts, see results, change settings. This page covers its hosted endpoint (https://app.xyla.ai/mcp).
Is the Xyla AI MCP server safe to use?
Xyla AI scores 87 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Xyla AI MCP server expose?
Xyla AI exposes 21 tools: whoami, shop_overview, upcoming_posts, pending_approvals, insights, and 16 more. Their descriptions and schemas cost roughly 1,997 tokens of context every time the server is loaded.
Does the Xyla AI MCP server require authentication?
Yes. Xyla AI asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Xyla AI MCP server still maintained?
Xyla AI is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.