Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Xyla AI

REMOTE · APP.XYLA.AI

Social posts for Shopify and WooCommerce stores: approve posts, see results, change settings.

Available components

+3 this week 87 Trust /100

Last scanned (1 hour ago)

Scores higher than 94% of remote servers

Reachable. Last reached 5 Nov 2026.

Category Marketing and SEO

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security92
Transport & Reachability100
Schema Quality & AI Usability86
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Tool/resource definitions use about 2193 tokens (~84/item across 26 items; 21 tools + 5 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management47
  • Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
  • Supports UI / widget rendering.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 4 Nov 26 0
    • New tool “boost_estimate” functional
  • 3 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

  • 1 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

  • 29 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 27 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

  • 25 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

  • 23 Oct 26 +1
    • Stability: unverified → 0.03 ▲ functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://app.xyla.ai/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=app.xyla.ai CN=WE1,O=Google Trust Services,C=US 3 Nov 2026 1 Feb 2027 ECDSA 256 ECDSA-SHA256 a87774e2e23789fa1323b1d8fe2ff7b8
SANs: app.xyla.ai
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of app.xyla.ai. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
ai. present 1814, 3799 8, 8 Verified
xyla.ai. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer resource_metadata="https://app.xyla.ai/.well-known/oauth-protected-resource/mcp", scope="xyla.read xyla.write"

Bearer resource_metadata="https://app.xyla.ai/.well-known/oauth-protected-resource/mcp", scope="xyla.read xyla.write"
Header Value
x-content-type-options nosniff
x-frame-options SAMEORIGIN
referrer-policy strict-origin-when-cross-origin

Protected resource metadata

Document https://app.xyla.ai/.well-known/oauth-protected-resource/mcp
Retrieved Yes
Resource https://app.xyla.ai/mcp
Authorisation server https://app.xyla.ai

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://app.xyla.ai/mcp Verified 200
http (plaintext) http://app.xyla.ai/mcp HTTPS enforced 301 https://app.xyla.ai/mcp
MCP tools · 21 exposed · ~1,997 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
approve_first_batch ~73

Approves this Xyla shop's first batch of posts as a whole. When the shop can publish, this also turns autopilot on in include mode (the posts already made are scheduled and nothing is deleted), and releases posts held for review into the schedule. Posts go out at their scheduled times, not straight away.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

approve_posts ~90

Approves posts in this Xyla shop that are waiting for approval, by their IDs from pending_approvals. Each approved post takes the next free slot in the schedule; nothing publishes straight away. Posts in the shop's first batch cannot be approved one by one: use approve_first_batch for those.

NameTypeReqDescription
post_idsarrayyesThe IDs of the posts to approve, from pending_approvals.

No output schema declared.

No examples provided.

boost_estimate ~111

Estimates how many more people and store visits this Xyla shop could get each month with Boost, Xyla's always-on ads for the store, at a daily budget of $5 to $50. Use it when the merchant asks how to get more reach, followers, traffic or sales. Compares against the shop's own post reach and links to the Boost page in Xyla.

NameTypeReqDescription
daily_budget_dollarsinteger–Daily budget in whole dollars. Defaults to 10, Xyla's suggestion.

No output schema declared.

No examples provided.

change_history ~69

Lists recent changes to the shop's Xyla settings, newest first: what changed, before and after, who made it (the merchant, Xyla or the assistant), and the undo id to pass to undo_change.

NameTypeReqDescription
limitinteger–How many changes to list. Defaults to 10.

No output schema declared.

No examples provided.

change_settings ~140

Changes the shop's Xyla settings in one setting group (or a few related ones) and returns each value before and after plus an undo id. Every change in a call applies, or none does. Read the group with get_settings first, and confirm the change with the merchant before calling this. Changes affect posts made from now on, not posts already scheduled or published.

NameTypeReqDescription
actionsarrayyesThe changes, applied together: all of them or none.
toolstringyesThe setting group to change. logo, outro, post_type_on_off, billing cannot be changed from chat; naming one returns the web page to change it on.

No output schema declared.

No examples provided.

confirm_post_fix ~92

Runs a post fix that request_post_fix started in this Xyla shop, with the change the merchant asked for. Call post_fix_status first and tell the merchant whether it is free or what it costs; a fix that is not free uses the shop's credits. The new image or video replaces the post's media when it is ready.

NameTypeReqDescription
audit_idintegeryesThe audit_id from request_post_fix.

No output schema declared.

No examples provided.

connect_account ~152

Makes a one-use link that connects a social account to this Xyla shop, or reconnects a broken one. Give the merchant the link to open in their browser; it works once and expires in 10 minutes, and asks for the store's email. To reconnect an account from connection_status, pass its social_media_account_id. Instagram has two ways in: instagram_direct (Instagram Login, the usual choice) and instagram (through a Facebook Page, needed for Stories and product tags). Disconnecting stays on the Xyla website.

NameTypeReqDescription
providerstringyesThe platform to connect.
social_media_account_idinteger–The account to reconnect, from connection_status. Leave out to connect a new account.

No output schema declared.

No examples provided.

connection_status ~46

Shows each social account connected to this Xyla shop: connected, expiring soon, expired, needs reconnecting, restricted or disconnected, and how many upcoming posts a broken account is blocking.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_settings ~68

Shows the shop's current Xyla settings for one setting group, with the ids change_settings needs and how each field works. Call it without tool to list the setting groups. Read a group before changing it.

NameTypeReqDescription
toolstring–The setting group to read. Leave out to list them.

No output schema declared.

No examples provided.

insights ~77

Shows how this Xyla shop's published posts performed over the last 7, 14, 30 or 90 days: reach, views, engagement, followers per account, and the top posts. Same data as the Insights page in Xyla.

NameTypeReqDescription
window_daysinteger–How many days back to look. Defaults to 30.

No output schema declared.

No examples provided.

pending_approvals ~89

Lists the posts in this Xyla shop that wait for the merchant's approval before they are scheduled, 12 per page, with captions and media links. When the shop is still on its first batch, returns that batch as one draft: it is approved as a whole, not post by post.

NameTypeReqDescription
pageinteger–Page number, starting at 1. Defaults to 1.

No output schema declared.

No examples provided.

post_fix_status ~78

Reports where a post fix from request_post_fix stands in this Xyla shop: still being checked, free (Xyla found a problem on its side), or how many credits it costs. After confirm_post_fix, reports whether the fix is running, done or failed.

NameTypeReqDescription
audit_idintegeryesThe audit_id from request_post_fix.

No output schema declared.

No examples provided.

preview_status ~79

Checks a store preview started with preview_store: the brand Xyla found and the sample posts finished so far. done is true once the preview is ready or has stopped. While the preview card is showing it updates itself, so only call this when no card is shown, every few seconds.

NameTypeReqDescription
tokenstringyesThe preview token preview_store returned.

No output schema declared.

No examples provided.

preview_store ~166

Shows what Xyla would post for an online store, with no Xyla account. Give it the store's web address (Shopify or WooCommerce). Xyla reads the store's brand (logo, colours, niche) and makes 3 sample social media posts from the store's own product photos, with captions. Returns a preview token at once; the posts take about 3 minutes and the card shows them as they finish. A store previewed in the last 7 days gets its earlier samples back. When no card is shown, call preview_status with the token to follow it. A store that already uses Xyla gets a sign-in link instead.

NameTypeReqDescription
urlstringyesThe store's web address, such as yourstore.com or yourstore.myshopify.com.

No output schema declared.

No examples provided.

reject_post ~63

Rejects one post in this Xyla shop that is waiting for approval, by its ID from pending_approvals. The post is cancelled and will not be published.

NameTypeReqDescription
post_idintegeryesThe ID of the post to reject, from pending_approvals.

No output schema declared.

No examples provided.

request_post_fix ~118

Starts a fix for one post's image or video in this Xyla shop. Xyla first checks the media for a problem on its side, which makes the fix free; otherwise the fix costs credits. Nothing is changed or charged yet. Then call post_fix_status with the audit_id to learn the cost, tell the merchant, and call confirm_post_fix only once they agree.

NameTypeReqDescription
post_idintegeryesThe ID of the post to fix.
what_to_changestringyesWhat the merchant wants changed, in their words.

No output schema declared.

No examples provided.

set_autopilot ~199

Turns Xyla autopilot on or off for this shop. With autopilot on, Xyla makes and schedules posts by itself. mode include (the default) keeps posts already made and adds them to the schedule. mode fresh DELETES every post not yet scheduled, including posts the merchant made by hand, then builds a new schedule: call it first without confirm_delete_count to get the number of posts it deletes, tell the merchant, and only after they agree call again with confirm_delete_count set to that number. Turning autopilot off unschedules upcoming posts and deletes nothing.

NameTypeReqDescription
confirm_delete_countinteger–Fresh mode only: the number of posts to delete, from the previous set_autopilot reply, after the merchant agreed.
modestring–Only when turning on. include keeps existing posts; fresh deletes unscheduled posts first.
onbooleanyestrue turns autopilot on, false turns it off.

No output schema declared.

No examples provided.

shop_overview ~52

Summarises this Xyla shop: its plan, AI credits left, whether autopilot is on, how many posts wait for approval, the next 3 posts due, and any social account that needs fixing.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

undo_change ~79

Puts back the settings a change set replaced, using the undo id from change_settings or change_history. The whole set is undone, or nothing is. It is refused when a setting has changed again since, so a newer choice is never overwritten.

NameTypeReqDescription
undo_idstringyesThe undo id, exactly as change_settings or change_history gave it.

No output schema declared.

No examples provided.

upcoming_posts ~127

Lists the posts this Xyla shop will publish, day by day, for up to 7 days from a start date (the shop's today if left out). Each post has its platforms, send time in the shop's time zone, type, caption and media links. Posts waiting for approval are not here: use pending_approvals.

NameTypeReqDescription
daysinteger–How many days to show, 1 to 7. Defaults to 7.
start_datestring–First day to show, as YYYY-MM-DD in the shop's time zone. Defaults to today.

No output schema declared.

No examples provided.

whoami ~29

Shows which Xyla shop this connection acts for and whether it can only read or can also make changes.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Install

How do I install the Xyla AI MCP server?

Xyla AI is a hosted endpoint at https://app.xyla.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · app.xyla.ai

# add to Claude Code
claude mcp add --transport http ai-xyla-xyla 'https://app.xyla.ai/mcp'
Common questions

What is the Xyla AI MCP server?

Xyla AI is an MCP server listed in the public MCP registry as ai.xyla/xyla. Social posts for Shopify and WooCommerce stores: approve posts, see results, change settings. This page covers its hosted endpoint (https://app.xyla.ai/mcp).

Is the Xyla AI MCP server safe to use?

Xyla AI scores 87 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Xyla AI MCP server expose?

Xyla AI exposes 21 tools: whoami, shop_overview, upcoming_posts, pending_approvals, insights, and 16 more. Their descriptions and schemas cost roughly 1,997 tokens of context every time the server is loaded.

Does the Xyla AI MCP server require authentication?

Yes. Xyla AI asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the Xyla AI MCP server still maintained?

Xyla AI is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.