# Xyla AI (remote · app.xyla.ai)

Social posts for Shopify and WooCommerce stores: approve posts, see results, change settings.

- Trust score: 87/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `app.xyla.ai`: 87/100 (this document), [markdown](https://verifymcp.io/servers/ai-xyla-xyla/app.md), [page](https://verifymcp.io/servers/ai-xyla-xyla/app)

## Channel facts

- Endpoint: `https://app.xyla.ai/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 92/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 86/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2193 tokens (~84/item across 26 items; 21 tools + 5 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 47/100
  - Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).
  - Supports UI / widget rendering.

## Install

### How do I install the Xyla AI MCP server?

Xyla AI is a hosted endpoint at https://app.xyla.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http ai-xyla-xyla 'https://app.xyla.ai/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "ai-xyla-xyla": {
      "url": "https://app.xyla.ai/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "ai-xyla-xyla": {
      "type": "http",
      "url": "https://app.xyla.ai/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.ai-xyla-xyla]
url = "https://app.xyla.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-xyla-xyla": {
      "type": "remote",
      "url": "https://app.xyla.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ai-xyla-xyla --url 'https://app.xyla.ai/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  ai-xyla-xyla:
    url: "https://app.xyla.ai/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "ai-xyla-xyla": {
      "Transport": "http",
      "Url": "https://app.xyla.ai/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add ai-xyla-xyla -t streamable-http -u 'https://app.xyla.ai/mcp'
```

### Other

```json
{
  "mcpServers": {
    "ai-xyla-xyla": {
      "type": "http",
      "url": "https://app.xyla.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 87, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-04 (score 86, 0)

- [functional] New tool “boost_estimate”

### 2026-11-03 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-23 (score 81, +1)

- [functional improvement] Stability: unverified → 0.03

## MCP tools (21)

### `whoami` (~29 tokens)

Connected shop

Shows which Xyla shop this connection acts for and whether it can only read or can also make changes.

### `shop_overview` (~52 tokens)

Shop overview

Summarises this Xyla shop: its plan, AI credits left, whether autopilot is on, how many posts wait for approval, the next 3 posts due, and any social account that needs fixing.

### `upcoming_posts` (~127 tokens)

Upcoming posts

Lists the posts this Xyla shop will publish, day by day, for up to 7 days from a start date (the shop's today if left out). Each post has its platforms, send time in the shop's time zone, type, caption and media links. Posts waiting for approval are not here: use pending_approvals.

Input parameters:

- `days` (integer): How many days to show, 1 to 7. Defaults to 7.
- `start_date` (string): First day to show, as YYYY-MM-DD in the shop's time zone. Defaults to today.

### `pending_approvals` (~89 tokens)

Posts waiting for approval

Lists the posts in this Xyla shop that wait for the merchant's approval before they are scheduled, 12 per page, with captions and media links. When the shop is still on its first batch, returns that batch as one draft: it is approved as a whole, not post by post.

Input parameters:

- `page` (integer): Page number, starting at 1. Defaults to 1.

### `insights` (~77 tokens)

Post results

Shows how this Xyla shop's published posts performed over the last 7, 14, 30 or 90 days: reach, views, engagement, followers per account, and the top posts. Same data as the Insights page in Xyla.

Input parameters:

- `window_days` (integer): How many days back to look. Defaults to 30.

### `boost_estimate` (~111 tokens)

Boost reach estimate

Estimates how many more people and store visits this Xyla shop could get each month with Boost, Xyla's always-on ads for the store, at a daily budget of $5 to $50. Use it when the merchant asks how to get more reach, followers, traffic or sales. Compares against the shop's own post reach and links to the Boost page in Xyla.

Input parameters:

- `daily_budget_dollars` (integer): Daily budget in whole dollars. Defaults to 10, Xyla's suggestion.

### `connection_status` (~46 tokens)

Social account health

Shows each social account connected to this Xyla shop: connected, expiring soon, expired, needs reconnecting, restricted or disconnected, and how many upcoming posts a broken account is blocking.

### `get_settings` (~68 tokens)

Read settings

Shows the shop's current Xyla settings for one setting group, with the ids change_settings needs and how each field works. Call it without tool to list the setting groups. Read a group before changing it.

Input parameters:

- `tool` (string): The setting group to read. Leave out to list them.

### `change_settings` (~140 tokens)

Change settings

Changes the shop's Xyla settings in one setting group (or a few related ones) and returns each value before and after plus an undo id. Every change in a call applies, or none does. Read the group with get_settings first, and confirm the change with the merchant before calling this. Changes affect posts made from now on, not posts already scheduled or published.

Input parameters:

- `actions` (array, required): The changes, applied together: all of them or none.
- `tool` (string, required): The setting group to change. logo, outro, post_type_on_off, billing cannot be changed from chat; naming one returns the web page to change it on.

### `undo_change` (~79 tokens)

Undo a settings change

Puts back the settings a change set replaced, using the undo id from change_settings or change_history. The whole set is undone, or nothing is. It is refused when a setting has changed again since, so a newer choice is never overwritten.

Input parameters:

- `undo_id` (string, required): The undo id, exactly as change_settings or change_history gave it.

### `change_history` (~69 tokens)

Settings change history

Lists recent changes to the shop's Xyla settings, newest first: what changed, before and after, who made it (the merchant, Xyla or the assistant), and the undo id to pass to undo_change.

Input parameters:

- `limit` (integer): How many changes to list. Defaults to 10.

### `connect_account` (~152 tokens)

Connect a social account

Makes a one-use link that connects a social account to this Xyla shop, or reconnects a broken one. Give the merchant the link to open in their browser; it works once and expires in 10 minutes, and asks for the store's email. To reconnect an account from connection_status, pass its social_media_account_id. Instagram has two ways in: instagram_direct (Instagram Login, the usual choice) and instagram (through a Facebook Page, needed for Stories and product tags). Disconnecting stays on the Xyla website.

Input parameters:

- `provider` (string, required): The platform to connect.
- `social_media_account_id` (integer): The account to reconnect, from connection_status. Leave out to connect a new account.

### `approve_posts` (~90 tokens)

Approve posts

Approves posts in this Xyla shop that are waiting for approval, by their IDs from pending_approvals. Each approved post takes the next free slot in the schedule; nothing publishes straight away. Posts in the shop's first batch cannot be approved one by one: use approve_first_batch for those.

Input parameters:

- `post_ids` (array, required): The IDs of the posts to approve, from pending_approvals.

### `reject_post` (~63 tokens)

Reject a post

Rejects one post in this Xyla shop that is waiting for approval, by its ID from pending_approvals. The post is cancelled and will not be published.

Input parameters:

- `post_id` (integer, required): The ID of the post to reject, from pending_approvals.

### `approve_first_batch` (~73 tokens)

Approve the first batch

Approves this Xyla shop's first batch of posts as a whole. When the shop can publish, this also turns autopilot on in include mode (the posts already made are scheduled and nothing is deleted), and releases posts held for review into the schedule. Posts go out at their scheduled times, not straight away.

### `request_post_fix` (~118 tokens)

Ask for a post fix

Starts a fix for one post's image or video in this Xyla shop. Xyla first checks the media for a problem on its side, which makes the fix free; otherwise the fix costs credits. Nothing is changed or charged yet. Then call post_fix_status with the audit_id to learn the cost, tell the merchant, and call confirm_post_fix only once they agree.

Input parameters:

- `post_id` (integer, required): The ID of the post to fix.
- `what_to_change` (string, required): What the merchant wants changed, in their words.

### `post_fix_status` (~78 tokens)

Post fix status

Reports where a post fix from request_post_fix stands in this Xyla shop: still being checked, free (Xyla found a problem on its side), or how many credits it costs. After confirm_post_fix, reports whether the fix is running, done or failed.

Input parameters:

- `audit_id` (integer, required): The audit_id from request_post_fix.

### `confirm_post_fix` (~92 tokens)

Run a post fix

Runs a post fix that request_post_fix started in this Xyla shop, with the change the merchant asked for. Call post_fix_status first and tell the merchant whether it is free or what it costs; a fix that is not free uses the shop's credits. The new image or video replaces the post's media when it is ready.

Input parameters:

- `audit_id` (integer, required): The audit_id from request_post_fix.

### `set_autopilot` (~199 tokens)

Turn autopilot on or off

Turns Xyla autopilot on or off for this shop. With autopilot on, Xyla makes and schedules posts by itself. mode include (the default) keeps posts already made and adds them to the schedule. mode fresh DELETES every post not yet scheduled, including posts the merchant made by hand, then builds a new schedule: call it first without confirm_delete_count to get the number of posts it deletes, tell the merchant, and only after they agree call again with confirm_delete_count set to that number. Turning autopilot off unschedules upcoming posts and deletes nothing.

Input parameters:

- `confirm_delete_count` (integer): Fresh mode only: the number of posts to delete, from the previous set_autopilot reply, after the merchant agreed.
- `mode` (string): Only when turning on. include keeps existing posts; fresh deletes unscheduled posts first.
- `on` (boolean, required): true turns autopilot on, false turns it off.

### `preview_store` (~166 tokens)

Preview a store

Shows what Xyla would post for an online store, with no Xyla account. Give it the store's web address (Shopify or WooCommerce). Xyla reads the store's brand (logo, colours, niche) and makes 3 sample social media posts from the store's own product photos, with captions. Returns a preview token at once; the posts take about 3 minutes and the card shows them as they finish. A store previewed in the last 7 days gets its earlier samples back. When no card is shown, call preview_status with the token to follow it. A store that already uses Xyla gets a sign-in link instead.

Input parameters:

- `url` (string, required): The store's web address, such as yourstore.com or yourstore.myshopify.com.

### `preview_status` (~79 tokens)

Check a store preview

Checks a store preview started with preview_store: the brand Xyla found and the sample posts finished so far. done is true once the preview is ready or has stopped. While the preview card is showing it updates itself, so only call this when no card is shown, every few seconds.

Input parameters:

- `token` (string, required): The preview token preview_store returned.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/ai-xyla-xyla/app#diagnostics

## Score history

- 2026-11-05: 87
- 2026-11-04: 86
- 2026-11-03: 86
- 2026-11-02: 85
- 2026-11-01: 85
- 2026-10-31: 84
- 2026-10-30: 84
- 2026-10-29: 84
- 2026-10-28: 83
- 2026-10-27: 83
- 2026-10-26: 82
- 2026-10-25: 82
- 2026-10-24: 81
- 2026-10-23: 81
- 2026-10-22: 80

## Common questions

### What is the Xyla AI MCP server?

Xyla AI is an MCP server listed in the public MCP registry as ai.xyla/xyla. Social posts for Shopify and WooCommerce stores: approve posts, see results, change settings. This page covers its hosted endpoint (https://app.xyla.ai/mcp).

### Is the Xyla AI MCP server safe to use?

Xyla AI scores 87 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Xyla AI MCP server expose?

Xyla AI exposes 21 tools: whoami, shop_overview, upcoming_posts, pending_approvals, insights, and 16 more. Their descriptions and schemas cost roughly 1,997 tokens of context every time the server is loaded.

### Does the Xyla AI MCP server require authentication?

Yes. Xyla AI asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Xyla AI MCP server still maintained?

Xyla AI is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://app.xyla.ai/mcp
- Website: https://app.xyla.ai/help/chat-apps
- Changelog RSS feed: https://verifymcp.io/servers/ai-xyla-xyla/app.xml
- Changelog JSON feed: https://verifymcp.io/servers/ai-xyla-xyla/app.json
- HTML version of this page: https://verifymcp.io/servers/ai-xyla-xyla/app