Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

posterly

NPM · POSTERLY-MCP-SERVER · 2 COMPONENTS · SCANNED SEP 25

Validate, schedule, publish, and analyze social content across 18 platforms with posterly.

0 this week 76 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
  • Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability68
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 11296 tokens (~150/item across 75 items; 75 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 79% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 75 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the posterly MCP server?

posterly runs locally as an npm package, launched with npx -y posterly-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · posterly-mcp-server

# add to Claude Code
claude mcp add awpthorp-posterly -- npx -y posterly-mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "awpthorp-posterly": {
      "command": "npx",
      "args": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "awpthorp-posterly": {
      "command": "npx",
      "args": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add awpthorp-posterly -- npx -y posterly-mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "awpthorp-posterly": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "posterly-mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add awpthorp-posterly --command npx --arg -y --arg posterly-mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  awpthorp-posterly:
    command: "npx"
    args: ["-y", "posterly-mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "awpthorp-posterly": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add awpthorp-posterly -t stdio -c npx -a -y posterly-mcp-server
// mcp.json
{
  "mcpServers": {
    "awpthorp-posterly": {
      "command": "npx",
      "args": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 25 Sept 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 22 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Sept 26 −3
    • Stability: pass → 0.77 functional
  • 19 Sept 26 +1
    • Stability: 0.97 → pass security
  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 12 Sept 26 +1
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 25 Sept 2026 · Analysed npm/posterly-mcp-server@0.27.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 96 packages
Packages resolved 96
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 75 exposed · ~11,296 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_google_business_media ~251

Add a photo or video to a Google Business Profile gallery (the media shown on Maps and Search). Provide a public https source_url first by uploading via upload_media_from_url or upload_media. COVER and PROFILE are single-slot and replace the existing one. WRITE: show the location, category, and media URL to the user, then pass confirm=true only after explicit confirmation.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
categorystringyesWhich gallery category to add the media to.
confirmbooleanyesMust be true after explicit user confirmation.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
media_formatstring–Defaults to PHOTO. Use VIDEO for videos (Google caps profile videos at 30s / 75MB).
source_urlstringyesPublic https URL of the photo or video (from upload_media / upload_media_from_url).
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

ask_support ~209

Ask Posterly Support AI an authenticated question using Posterly docs plus read-only account/post diagnostics for the caller workspace. Requires POSTERLY_API_KEY with accounts:read and posts:read scopes. Human ticket creation requires request_human=true and confirm_escalation=true after explicit user confirmation.

NameTypeReqDescription
confirm_escalationboolean–Must be true after explicit user confirmation before a human support ticket can be created.
conversation_idstring–Continue a previous support conversation.
page_urlstring–Optional Posterly page URL for context.
post_idinteger–Optional post ID to inspect directly.
questionstringyes–
referenced_post_idsarray–Optional post IDs to include in read-only diagnostics.
request_humanboolean–Ask for human review. Does not create a ticket unless confirm_escalation is also true.
workspace_idstring–Workspace to inspect. Omit to use the API-key scoped workspace or personal workspace.

No output schema declared.

No examples provided.

audit_google_business_profile ~122

Run a live local-profile audit for a connected Google Business Profile location, including completeness, categories, media, attributes, reviews, and recommendations.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

cancel_subscription ~172

Cancel the authenticated user's posterly subscription. DESTRUCTIVE billing action; requires the billing:write scope. ALWAYS ask the user why they are cancelling FIRST and pass their answer as `reason` (one of the allowed values). By default the subscription is set to cancel at the end of the current period; pass immediate=true only if the user explicitly wants it cancelled right now. Only call after the user explicitly confirms.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms the cancellation.
feedbackstring–Optional free-text detail the user gave about why they are cancelling.
immediateboolean–Cancel immediately instead of at period end. Defaults to false (cancel at period end).
reasonstringyesWhy the user is cancelling. Ask the user before calling; do not guess.

No output schema declared.

No examples provided.

create_api_key ~196

Create a new Posterly API key for the authenticated user. SECRET-CREATING WRITE: only use after explicit user confirmation. The new key can only request scopes already present on the calling dashboard-created API key; OAuth and managed assistant tokens cannot mint keys.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms that a new secret API key should be created.
expires_in_daysinteger–Optional expiry from now, up to 365 days. Omit for no expiry.
namestring–Human-readable key name.
scopesarray–Scopes for the new key. Omit to copy the calling key scopes. Cannot exceed the calling key scopes. billing:read and billing:write allow managing the posterly subscription (cancel/pause/resume/downgra…
workspace_idstring–Optional workspace restriction. Workspace-scoped calling keys cannot create keys outside their workspace.

No output schema declared.

No examples provided.

create_connect_session ~182

Create a short-lived Posterly dashboard handoff session for connecting a social account. Send the secure connection URL to the user, then poll get_connect_session to narrate progress. Do not ask for social media passwords or OAuth codes; Posterly handles those browser steps.

NameTypeReqDescription
auto_startboolean–When true, the dashboard starts the provider flow after the user opens the URL. Defaults to true.
debugboolean–When true, include the raw connect session JSON for debugging. Keep false for normal user-facing agent flows.
platformstringyesConnection target such as instagram, meta, linkedin_page, twitter, google_business, telegram, bluesky, discord, mastodon, devto, hashnode, wordpress, or lemmy.
workspace_idstring–Workspace to connect the account into. Workspace-scoped API keys ignore this.

No output schema declared.

No examples provided.

create_oauth_client ~105

Create a public OAuth 2.1 + PKCE developer client. WRITE: confirm app name, redirect URIs, and scopes with the user before calling.

NameTypeReqDescription
allowed_redirect_urisarrayyes–
client_namestringyes–
confirmbooleanyesMust be true after explicit user confirmation.
default_scopesarrayyes–
descriptionstring––
homepagestring––
is_activeboolean––

No output schema declared.

No examples provided.

create_post ~1,321

Schedule or immediately publish a social media post. This is a DESTRUCTIVE WRITE that creates content on the user's real social accounts - once scheduled_at passes, it will be posted publicly and cannot be un-posted. REQUIRED BEFORE CALLING: 1. Call `whoami` at the start of any new session to confirm which workspace and user you are acting for. 2. Show the user a preview containing ALL of: account(s) and platform(s), final caption text, scheduled time (in the user's timezone), media attached (if any), and workspace name. 3. Get explicit confirmation from the user (e.g. "post it", "yes schedule that", "looks good") BEFORE calling this tool. Do NOT infer consent from earlier instructions like "post about X every Monday" - confirm each individual post or the entire batch. 4. If scheduling multiple posts in one turn, list every post first and confirm the batch as a whole, then prefer `create_posts_batch` so they are created in one API request. AFTER CALLING: Tell the user the post was created, include the Posterly dashboard link returned by the tool, and offer the next natural action. Do not narrate raw HTTP, curl, or API plumbing. Provide either account_id OR username+platform to identify the account. If scheduled_at is omitted, the post publishes immediately. If workspace_id is omitted, the server resolves one from the social account, falling back to the caller's default (personal) workspace - pass workspace_id explicitly if the user has more than one workspace. MEDIA URLS: Posterly storage URLs are used as-is. Third-party HTTP(S) media URLs are copied into Posterly storage before the post is saved, so API-created posts do not later fail on expired signed URLs. Short-lived signed URLs must still be live when this tool runs. You can also call `upload_media_from_url` first if you want to upload once and reuse the returned Posterly URL across posts. THREADS: Pass `thread_posts` (an array of 2+ strings) to schedule a multi-post thread on X (Twitter) or Threads (Meta…

NameTypeReqDescription
account_idstring–Social account ID (from list_accounts)
captionstring–The post caption/text content. Ignored when `thread_posts` is provided.
confirmbooleanyesMust be true after explicit user confirmation of the post/account/workspace/schedule.
instagram_settingsobject–Instagram-specific settings: post_type (post/feed/story/reel/carousel), collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_u…
media_urlstring–Media URL to attach. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this too…
media_urlsarray–Multiple media URLs for carousel or multi-image posts. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. For TikTok, 2 or more…
platformstring–Platform name (required with username). Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, ha…
platform_settingsobject–Platform-specific settings for the selected account. Use this for non-Instagram settings and prefer it over raw metadata.
post_typestring–Optional post type: text, image, video, carousel, reel, story, story_series, document, photo, cover_photo, x_thread, or threads_thread. Omit it for auto-detection from media. For TikTok photo posts,…
scheduled_atstring–ISO 8601 datetime for scheduling (e.g. 2026-03-05T09:00:00Z). Omit for immediate publish.
thread_postsarray–For X or Threads only: array of 2+ strings, one per post in the thread. The first entry leads, the rest reply in order. When set, the platform must be twitter or threads.
usernamestring–Account username (alternative to account_id)
workspace_idstring–Workspace ID to assign the post to (from whoami). If omitted, uses the account's workspace or the caller's default workspace.

No output schema declared.

No examples provided.

create_posts_batch ~268

Create 1-25 scheduled or immediate social posts in one API request. This is a DESTRUCTIVE WRITE that creates content on the user's real social accounts - once scheduled_at passes, posts may go public and cannot be un-posted. REQUIRED BEFORE CALLING: 1. Call `whoami` at the start of any new session to confirm which workspace and user you are acting for. 2. Show the user a preview of EVERY post: account/platform, final caption or thread text, scheduled time in their timezone, media, platform settings, and workspace. 3. Get explicit confirmation for the whole batch before calling. Do not infer consent from an earlier content plan. AFTER CALLING: Summarize the batch result in natural language, include the Posterly dashboard link returned by the tool, and avoid narrating raw HTTP, curl, or API plumbing. Each item accepts the same fields as `create_post`, including `thread_posts`, `platform_settings`, `instagram_settings`, media URLs, and workspace_id. The endpoint may partially succeed; failed items are returned with their index.

NameTypeReqDescription
confirmbooleanyesMust be true after explicit user confirmation of every post in the batch.
postsarrayyesPosts to create. Each item uses the same schema as create_post.

No output schema declared.

No examples provided.

create_signed_upload ~92

Create a signed upload URL for a larger image or video. Upload the binary to upload_url; the API validates actual bytes before storage, then public_url can be used with create_post.

NameTypeReqDescription
content_typestringyesMIME type, e.g. video/mp4
filenamestringyesFilename with extension, e.g. launch-video.mp4
sizeintegeryesFile size in bytes

No output schema declared.

No examples provided.

create_webhook ~156

Create a webhook subscription for post/account/analytics events. WRITE WITH OUTBOUND SIDE EFFECTS: show the user the target URL, workspace, events, and active state, then get explicit confirmation before calling. The response includes the signing secret once.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms webhook creation.
descriptionstring––
eventsarray–Events to deliver. Defaults to core post lifecycle events.
is_activeboolean–Defaults to true.
urlstringyesHTTPS webhook endpoint URL. Localhost HTTP is allowed by the API for development.
workspace_idstring–Optional workspace filter. Omit for all workspaces owned by the API key user.

No output schema declared.

No examples provided.

delete_api_key ~123

Revoke a Posterly API key owned by the authenticated user. DESTRUCTIVE: call whoami or use a known key ID, show the user the exact key ID/prefix/name if available, and get explicit confirmation before calling. Cannot revoke the key currently authenticating this request, OAuth-issued keys, or managed assistant keys.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms API key revocation.
key_idstringyesAPI key ID to revoke. This is the API key resource ID, not the secret pst_live_ value.

No output schema declared.

No examples provided.

delete_google_business_media ~187

Remove a photo or video from a Google Business Profile gallery. Get media_name from list_google_business_media. This permanently deletes the item from the public profile. WRITE: show the exact media item and location to the user, then pass confirm=true only after explicit confirmation.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
confirmbooleanyesMust be true after explicit user confirmation.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
media_namestringyesFull media resource name from list_google_business_media (accounts/.../locations/.../media/...).
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

delete_google_business_review_reply ~155

Delete the owner reply from a Google Business Profile review. DESTRUCTIVE: confirm the review and location with the user, then pass confirm=true only after explicit confirmation.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
confirmbooleanyesMust be true after explicit user confirmation.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
review_namestringyesFull Google review resource name.
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

delete_oauth_client ~64

Delete a self-serve OAuth developer client. DESTRUCTIVE: prevents new authorizations for that client_id; existing access tokens remain revocable as API keys.

NameTypeReqDescription
client_idstringyes–
confirmbooleanyesMust be true after explicit user confirmation.

No output schema declared.

No examples provided.

delete_post ~136

Delete a scheduled or draft post. DESTRUCTIVE and IRREVERSIBLE - the post and its caption cannot be recovered. Cannot delete published or currently publishing posts. REQUIRED BEFORE CALLING: Fetch the post with `get_post` first and show the user what will be deleted (caption, account, scheduled time). Get explicit confirmation ("yes delete it", "remove it") before calling. Never delete multiple posts in a single batch without listing each one and confirming the full list.

NameTypeReqDescription
confirmbooleanyesMust be true after explicit user confirmation of the post deletion.
post_idnumberyesThe post ID to delete

No output schema declared.

No examples provided.

delete_post_group ~89

Delete every draft/scheduled/failed/paused post matching a caller-defined group_id, post_group_id, api_group_id, or release_id. DESTRUCTIVE: inspect the group first, list the affected posts, and pass confirm=true only after explicit confirmation.

NameTypeReqDescription
confirmbooleanyesMust be true after explicit user confirmation.
group_idstringyesGroup/release ID to delete.

No output schema declared.

No examples provided.

delete_webhook ~71

Delete a webhook subscription. DESTRUCTIVE: list the webhook first, show the user its URL/events/workspace, and get explicit confirmation before calling.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms webhook deletion.
webhook_idstringyesWebhook ID from list_webhooks.

No output schema declared.

No examples provided.

disconnect_account ~123

Disconnect a connected social account from posterly. DESTRUCTIVE and IRREVERSIBLE: removes the account connection, emits account.disconnected webhooks, and may transfer Instagram scheduled posts to a replacement account. REQUIRED BEFORE CALLING: Call `list_accounts` first, show the user the exact platform, username, account ID, and workspace that will be disconnected, then get explicit confirmation. Pass confirm=true only after that confirmation.

NameTypeReqDescription
account_idstringyesConnected social account ID from list_accounts.
confirmbooleanyesMust be true after explicit user confirmation.

No output schema declared.

No examples provided.

dismiss_suggestion ~67

Dismiss a proactive post suggestion so it stops appearing. WRITE: confirm the exact suggestion with the user first. Never dismisses a suggestion that was already turned into a scheduled post (that would break adoption tracking).

NameTypeReqDescription
suggestion_idstringyesSuggestion ID from list_post_suggestions.

No output schema declared.

No examples provided.

downgrade_subscription ~91

Downgrade the authenticated user's posterly subscription one tier (or to an explicit lower `tier`) at the next renewal with no proration. Billing action; requires the billing:write scope. Only call after the user explicitly confirms.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms the downgrade.
tierstring–Optional explicit target tier. Omit to drop one tier automatically.

No output schema declared.

No examples provided.

find_available_slot ~179

Find available time slots for posting. Respects a 1-hour gap between posts and preferred hours (8am-10pm in the given timezone). Returns up to 10 slots. IMPORTANT: pass a timezone explicitly - default is America/New_York and slots will be off if the user is elsewhere. Pass workspace_id to only avoid collisions with posts in that workspace.

NameTypeReqDescription
account_idsarray–Filter slots for specific account IDs
countnumber–Number of slots to return (default 5, max 10)
timezonestring–IANA timezone (e.g. Asia/Dubai, Europe/London). Defaults to America/New_York - pass the user's actual timezone or slots will be wrong.
workspace_idstring–Scope slot-finding to a single workspace (get IDs via whoami).

No output schema declared.

No examples provided.

generate_captions ~239

Generate or adapt AI caption suggestions for one or more social platforms. Uses AI Caption Assist quota and returns options only; it does not create or schedule posts. After the user chooses final copy, pass it to create_post or create_posts_batch.

NameTypeReqDescription
allow_emojisboolean––
briefstring–What the post is about. Recommended for generate mode.
countinteger––
hashtag_strategystring––
manual_brand_voiceobject–Use when Posterly asks for brand voice input.
modestring––
platformsarrayyesTarget platforms such as instagram, linkedin, twitter, tiktok, youtube, pinterest, or google_business.
preserve_call_to_actionboolean––
preserve_linksboolean––
preserve_mentionsboolean––
social_account_idstring–Optional connected account ID for brand voice and workspace billing context.
source_captionstring–Required when mode=adapt. The master caption to adapt.
source_platformstring––
tonestring––
workspace_idstring––

No output schema declared.

No examples provided.

generate_image ~435

Generate an AI image via Posterly's Nano Banana (Gemini) integration. The image is saved to the user's media storage and the returned URL can be passed to `create_post` as `media_url`. COSTS CREDITS. Every call consumes part of the user's monthly AI image quota (or purchased credits once the quota is exhausted). Do NOT call speculatively - always describe the image you're about to generate (subject, style, aspect ratio) to the user and get confirmation before calling. If the user is over their plan limit and has no credits, this tool returns a 402 with upgrade info. Surface that message verbatim - do not retry. Common aspect ratios by platform: • Instagram feed / LinkedIn: 1:1 (square) or 4:5 (portrait) • Instagram Story/Reel, TikTok, YouTube Shorts: 9:16 • YouTube thumbnail, Twitter cards, landscape feed: 16:9 • Pinterest: 2:3

NameTypeReqDescription
aspect_ratiostring–Aspect ratio. Default 1:1. Pick based on target platform (see tool description).
confirmbooleanyesMust be true after explicit user confirmation of subject, style, aspect ratio, and credit use.
modelstring–flash (default, 1 credit per 1K image) is fast and cost-effective. pro (2 credits per 1K) is higher quality for hero imagery. Start with flash unless quality is critical.
promptstringyesDetailed image description. 5-4000 characters. Describe subject, scene, lighting, mood, and style.
resolutionstring–Output resolution. Default 1K. Higher resolutions cost more credits. 512 is flash-only.
stylestring–Preset style. Default photographic. Use youtube_thumbnail / reel_cover for platform-optimized covers; review_background for testimonial backgrounds.
variationsinteger–How many variations to generate. Default 1. Each variation costs credits separately - prefer 1 unless the user explicitly wants options.

No output schema declared.

No examples provided.

generate_video ~173

Queue a Veo AI video generation job. COSTS VEO CREDITS: confirm prompt, model, duration, resolution, aspect ratio, audio choice, and credit cost with the user before calling. Poll get_video_job for status and final video_url.

NameTypeReqDescription
aspect_ratiostring––
confirmbooleanyesMust be true after explicit user confirmation of prompt, model, duration, resolution, and credit cost.
duration_secondsnumber––
end_image_urlstring––
generate_audioboolean––
image_urlstring––
modelstring––
negative_promptstring––
promptstringyes–
reference_imagesarray––
resolutionstring––
source_video_urlstring––

No output schema declared.

No examples provided.

get_account_analytics ~153

Get daily analytics snapshots and a period summary for a connected social account. Supports Instagram, Facebook, LinkedIn, Google Business Profile, Pinterest, YouTube, and Threads. Uses API-provided display_metrics for platform-native dashboard labels and supports presentation: compact, table, or json.

NameTypeReqDescription
account_idnumberyesThe social account ID (from list_accounts)
fromstring–Start date (ISO date, e.g. 2026-03-19). Defaults to 30 days ago.
presentationstring–Output style: compact bullets, Markdown table, or raw JSON for client-side chart/card rendering.
tostring–End date (ISO date). Defaults to today.

No output schema declared.

No examples provided.

get_agent_signup_info ~36

Explain how to use Posterly MCP for agent-led signup before an API key exists, including the safe human-in-the-browser boundaries.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_brand ~57

Get one brand/client by ID. Returns its workspace, source, linked legacy brand group if present, and the number of social accounts assigned to it.

NameTypeReqDescription
brand_idstringyesThe brand ID to look up (from list_brands).

No output schema declared.

No examples provided.

get_brand_profile ~62

Get the extended brand profile for a brand/client. Returns voice/tone guidance, audience, keywords, dos and don’ts, visual notes, and other saved brand context.

NameTypeReqDescription
brand_idstringyesThe brand ID to inspect (from list_brands).

No output schema declared.

No examples provided.

get_connect_link ~163

List dashboard handoff links/readiness for connecting social accounts, or get one platform connection URL. Use connection_url in a logged-in browser. Direct OAuth URLs are intentionally not exposed because provider callbacks rely on browser state.

NameTypeReqDescription
debugboolean–When true, include the raw connect option JSON for debugging. Keep false for normal user-facing agent flows.
include_plannedboolean–Include planned provider expansion targets from the Postiz parity audit: reddit, medium, skool, whop.
platformstring–Connection target such as instagram, meta, linkedin_page, twitter, x, google_business, telegram, reddit, or wordpress. Omit to list live connection targets.
workspace_idstring–Filter connected account counts to a workspace.

No output schema declared.

No examples provided.

get_connect_session ~89

Poll a Posterly connect session. Use the returned status and next-step guidance to keep the user updated in plain language. Stop when status is connected, failed, cancelled, or expired.

NameTypeReqDescription
debugboolean–When true, include the raw connect session JSON for debugging. Keep false for normal user-facing agent flows.
session_idstringyesConnect session ID returned by create_connect_session.

No output schema declared.

No examples provided.

get_google_business_review_link ~145

Get the direct public Google review link for a connected Google Business Profile location. Requires account_id or location_id. Returns reviewLink plus the Google Place ID (ChIJ...); that Place ID is output only and must NOT be passed back as location_id to other tools.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID this tool returns. Prefer account_id.
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

get_learned_voice ~118

Get the voice posterly has learned from a connected account’s real published captions (the "learned captions" shown on the dashboard). Returns a narrative summary, voice traits, style guidelines, and observed posting habits. Keyed by social account ID (from list_accounts or list_brand_accounts). Returns nothing until the account has enough published posts to learn from. Read-only; this never overwrites the saved brand profile.

NameTypeReqDescription
account_idstring|numberyesThe social account ID to inspect (from list_accounts or list_brand_accounts).

No output schema declared.

No examples provided.

get_mcp_status ~46

Report the Posterly MCP server version, latest npm version, MCP endpoint health, API key health, and update guidance. Safe to call before POSTERLY_API_KEY is configured.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_performance_profile ~128

Get the performance profile posterly has derived for a connected account from the last 90 days of per-post analytics. Returns coaching stats (format, timing, caption-length patterns), an engagement-rate trend, and a narrative summary. Keyed by social account ID (from list_accounts or list_brand_accounts). Returns nothing until the account has a derived profile; Google Business Profile and other platforms without per-post analytics never get one. Read-only; requires a Pro plan or higher.

NameTypeReqDescription
account_idstring|numberyesThe social account ID to inspect (from list_accounts or list_brand_accounts).

No output schema declared.

No examples provided.

get_platform_schema ~138

Get the platform schema for a specific connected account or platform. Call this before creating posts with platform_settings so you know allowed post types, media limits, helper tools, and field names.

NameTypeReqDescription
account_idstring–Connected account ID from list_accounts. Preferred because it returns account context.
include_plannedboolean––
platformstring–Platform ID such as instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, hashnode, wordpress, lemmy. Set i…

No output schema declared.

No examples provided.

get_post ~45

Get details of a specific post by ID. Returns caption, status, scheduled time, media, and platform info.

NameTypeReqDescription
post_idnumberyesThe post ID to look up

No output schema declared.

No examples provided.

get_post_analytics ~214

Get per-post engagement metrics (likes, comments/replies, reach, impressions/views, saves, shares, reposts, quotes, plays, clicks, watch time) for a connected social account. Supports Instagram, Facebook, LinkedIn, Google Business Profile, Pinterest, YouTube, and Threads. Returns the most recent posts first. presentation controls output: compact for Telegram/mobile, table for Markdown clients, json for custom chart/card renderers.

NameTypeReqDescription
account_idnumberyesThe social account ID (from list_accounts)
fromstring–Start date (ISO date, e.g. 2026-03-19). Defaults to 30 days ago.
limitnumber–Number of posts to return (default 50, max 200)
offsetnumber–Pagination offset
presentationstring–Output style: compact bullets, Markdown table, or raw JSON for client-side chart/card rendering.
tostring–End date (ISO date). Defaults to today.

No output schema declared.

No examples provided.

get_post_insights ~159

List per-post feedback insights from the posterly performance feedback loop: for recently published posts, the performance tier (great/good/mixed/poor), a diagnosis, a suggested next action, metrics, and the baseline it was compared against. Filter by account_id, post_id, and checkpoint (1h, 6h, 24h, 72h, 7d). Read-only; requires a Pro plan or higher.

NameTypeReqDescription
account_idstring|number–Filter to one social account ID (from list_accounts).
checkpointstring–Filter to one checkpoint after publish.
limitinteger–Max insights to return (default 20).
post_idinteger–Filter to one post ID.

No output schema declared.

No examples provided.

get_post_missing ~54

Inspect whether a post is missing required content, media, account, platform settings, or metadata before it can publish. Use this to repair failed or imported posts.

NameTypeReqDescription
post_idintegeryesThe post ID to inspect.

No output schema declared.

No examples provided.

get_signup_session ~113

Poll a public Posterly signup session created by start_signup. Use this to narrate checkout, payment, password setup, and agent access status before a Posterly API key is installed. Keep updates user-facing; do not narrate raw HTTP, curl, or API plumbing.

NameTypeReqDescription
debugboolean–When true, include the raw signup session JSON for debugging. Keep false for normal user-facing agent flows.
session_idstringyesSignup session ID returned by start_signup, usually the Stripe checkout session ID.

No output schema declared.

No examples provided.

get_subscription ~46

Get the authenticated user's posterly subscription: status, tier, cancel-at-period-end, current period end, trial end, and pause state. Read-only. Requires the billing:read scope.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_updates ~95

Get the latest posterly product updates and news from the updates feed: new features, improvements, and fixes. Requires an active posterly subscription.

NameTypeReqDescription
include_contentboolean–Include the full markdown body of each update. Defaults to false.
limitinteger–Number of updates to return. Default 10, max 50.
sincestring–ISO date. Return updates published on or after this date.

No output schema declared.

No examples provided.

get_video_job ~63

Get one Veo video generation job by ID, or list recent video jobs when job_id is omitted. Use after generate_video to poll for completed video_url.

NameTypeReqDescription
job_idstring––
limitinteger––
statusstring––

No output schema declared.

No examples provided.

get_video_options ~42

List read-only Veo video generation options, input modes, durations, resolutions, aspect ratios, and credit-cost estimates. This does not generate video or spend credits.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_x_posting_quota ~59

Get managed X posting quota for a workspace, including total monthly allowance, used posts, remaining posts, and URL-blocking status.

NameTypeReqDescription
workspace_idstring–Workspace ID from whoami. Defaults to the caller personal workspace context.

No output schema declared.

No examples provided.

list_accounts ~70

List connected social media accounts. Returns platform, username, account ID, and workspace ID for each. Pass workspace_id to filter to a specific workspace; otherwise returns all accounts the caller owns across every workspace.

NameTypeReqDescription
workspace_idstring–Filter to accounts in a specific workspace (get IDs via whoami).

No output schema declared.

No examples provided.

list_activity ~118

List recent activity and publish events for posts, including status changes, publish attempts, failures, and retries. Use this as the agent notifications feed.

NameTypeReqDescription
limitinteger–Number of items to return. Default 50, max 100.
post_idinteger–Filter to one post ID.
sincestring–ISO datetime. Return events created at or after this time.
typestring–Event source filter. Defaults to all.
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

list_brand_accounts ~55

List the connected social accounts assigned to a brand/client. Use this when a user refers to a brand name rather than a raw account handle.

NameTypeReqDescription
brand_idstringyesThe brand ID to inspect (from list_brands).

No output schema declared.

No examples provided.

list_brands ~62

List brands/clients the caller can access. Returns each brand ID, name, workspace ID, source, and how many social accounts are currently assigned to it.

NameTypeReqDescription
workspace_idstring–Filter to brands in a specific workspace (get IDs via whoami).

No output schema declared.

No examples provided.

Common questions

What is the posterly MCP server?

posterly is an MCP server listed in the public MCP registry as io.github.awpthorp/posterly. Validate, schedule, publish, and analyze social content across 18 platforms with posterly. This page covers its npm package (posterly-mcp-server).

Is the posterly MCP server safe to use?

posterly scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the posterly MCP server expose?

posterly exposes 75 tools: get_agent_signup_info, start_signup, get_signup_session, get_mcp_status, whoami, and 70 more. Their descriptions and schemas cost roughly 11,296 tokens of context every time the server is loaded.

Is the posterly MCP server still maintained?

posterly is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the posterly MCP server under?

posterly declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.