Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

posterly

NPM · POSTERLY-MCP-SERVER · 2 COMPONENTS · SCANNED SEP 25

Validate, schedule, publish, and analyze social content across 18 platforms with posterly.

0 this week 76 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
  • Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability68
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 11296 tokens (~150/item across 75 items; 75 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
  • Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 79% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 75 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the posterly MCP server?

posterly runs locally as an npm package, launched with npx -y posterly-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · posterly-mcp-server

# add to Claude Code
claude mcp add awpthorp-posterly -- npx -y posterly-mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "awpthorp-posterly": {
      "command": "npx",
      "args": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "awpthorp-posterly": {
      "command": "npx",
      "args": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add awpthorp-posterly -- npx -y posterly-mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "awpthorp-posterly": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "posterly-mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add awpthorp-posterly --command npx --arg -y --arg posterly-mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  awpthorp-posterly:
    command: "npx"
    args: ["-y", "posterly-mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "awpthorp-posterly": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add awpthorp-posterly -t stdio -c npx -a -y posterly-mcp-server
// mcp.json
{
  "mcpServers": {
    "awpthorp-posterly": {
      "command": "npx",
      "args": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 25 Sept 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 22 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Sept 26 −3
    • Stability: pass → 0.77 functional
  • 19 Sept 26 +1
    • Stability: 0.97 → pass security
  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 −3
    • Stability: pass → 0.80 functional
  • 12 Sept 26 +1
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 25 Sept 2026 · Analysed npm/posterly-mcp-server@0.27.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 96 packages
Packages resolved 96
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 75 exposed · ~11,296 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
list_google_business_media ~147

List the photos and videos on a Google Business Profile gallery (the media shown on Maps and Search) for one location/account or every accessible GBP location. This is separate from media attached to a post. Returns each item's resource name, category, format, and URLs.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

list_google_business_reviews ~145

List Google Business Profile reviews for one location/account or every accessible GBP location. Supports rating and unanswered-only filters.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
ratinginteger–Filter to a 1-5 star rating.
unansweredboolean–Only return reviews without owner replies.
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

list_oauth_clients ~34

List self-serve OAuth developer clients owned by the user. These are public PKCE clients for third-party app integrations.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_platforms ~71

List posterly platform integrations, posting capabilities, content/media limits, settings schemas, helper tools, and analytics support. Use include_planned to show future integration possibilities from the Postiz parity audit.

NameTypeReqDescription
include_plannedboolean–Include planned integrations such as reddit, medium, skool, whop.

No output schema declared.

No examples provided.

list_post_suggestions ~129

List proactive post suggestions: evidence-based weekly drafts posterly writes in each account's learned voice, each with a rationale tying it back to what has performed well for that account. Filter by account_id and status (pending, scheduled, dismissed; default pending). Read-only; requires a Pro plan or higher. Use dismiss_suggestion to hide one.

NameTypeReqDescription
account_idstring|number–Filter to one social account ID (from list_accounts).
limitinteger–Max suggestions to return (default 20).
statusstring–Suggestion status to list (default pending).

No output schema declared.

No examples provided.

list_posts ~185

List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, or workspace_id. If workspace_id is omitted, posts across every workspace the caller is a member of are returned.

NameTypeReqDescription
account_idstring–Filter to a specific social account ID (from list_accounts).
limitnumber–Number of posts to return (default 20, max 100)
platformstring–Filter by platform: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, hashnode, wordpress, lemmy.
statusstring–Filter by status: draft, scheduled, published, failed
workspace_idstring–Filter to posts in a specific workspace (get IDs via whoami).

No output schema declared.

No examples provided.

list_webhooks ~43

List API webhook subscriptions, their event filters, active state, and most recent delivery status.

NameTypeReqDescription
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

pause_subscription ~66

Pause the authenticated user's posterly subscription for 30 days (one pause allowed per 90-day cooldown). Billing action; requires the billing:write scope. Only call after the user explicitly confirms.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms pausing the subscription.

No output schema declared.

No examples provided.

reply_google_business_review ~172

Post or update the owner reply on a Google Business Profile review. WRITE: show the review, location, and exact reply text to the user, then pass confirm=true only after explicit confirmation.

NameTypeReqDescription
account_idinteger–Google Business account ID from list_accounts.
commentstringyesExact owner reply text to post.
confirmbooleanyesMust be true after explicit user confirmation.
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
review_namestringyesFull Google review resource name.
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

resume_subscription ~28

Resume the authenticated user's paused posterly subscription, restoring active billing. Requires the billing:write scope.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

run_video_function ~101

Run a read-only Veo helper function before generation: list_input_modes, estimate_cost, or validate_request. This does not generate video or spend credits.

NameTypeReqDescription
functionNamestringyesHelper function name from get_video_options.tools.
identifierstringyesVideo generator identifier from get_video_options.
paramsobject–Function parameters. estimate_cost accepts model, duration_seconds, resolution, and output. validate_request accepts a generate_video-style payload.

No output schema declared.

No examples provided.

start_signup ~226

Start the public Posterly paid signup flow for a user before Posterly API access exists. Returns a Posterly checkout handoff URL and signup poll URL. The user must handle payment and password setup in the browser. Do not ask for card details or a Posterly password in chat.

NameTypeReqDescription
api_addonboolean–Always true for AI agent setup because MCP/API access requires the API add-on.
debugboolean–When true, include the raw signup response JSON for debugging. Keep false for normal user-facing agent flows.
emailstringyesUser email address to sign up. Confirm this with the user before calling.
intervalstring–Billing interval. Public agent signup currently supports monthly billing.
namestring–Optional user or workspace name to pass into Posterly signup.
return_pathstring–Where Posterly should continue after checkout and password setup.
sourcestring–Source label for analytics and support diagnostics.
tierstring–Posterly plan to start. Use starter unless the user explicitly chooses another plan.

No output schema declared.

No examples provided.

submit_agent_feedback ~102

Submit bounded private operational telemetry after a concrete posterly workflow outcome. This does not alter product content but writes a private feedback event. Never include API keys, prompts, captions, media URLs, personal data, or fabricated outcomes.

NameTypeReqDescription
clientstring––
commentstring––
contextobject––
error_code–––
outcomestringyes–
sourcestringyes–
toolstringyes–

No output schema declared.

No examples provided.

suggest_google_business_review_reply ~186

Generate short, brand-aware AI reply suggestions for a Google review. Uses the AI Caption Assist allowance; does not post the reply.

NameTypeReqDescription
account_idinteger–Optional Google Business account ID for brand voice context.
business_namestring––
countinteger––
location_idstring–Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
review_textstring–Review text. Leave empty for rating-only reviews.
reviewer_namestring––
star_ratingnumberyesReview rating from 1 to 5.
tonestring––
workspace_idstring–Filter to a workspace ID from whoami.

No output schema declared.

No examples provided.

test_webhook ~67

Send a signed webhook.test delivery to a webhook URL. OUTBOUND SIDE EFFECT: get explicit confirmation before sending a test request.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms the test delivery.
webhook_idstringyesWebhook ID from list_webhooks.

No output schema declared.

No examples provided.

trigger_platform_helper ~129

Run account-specific platform helper discovery. Available helpers: linkedin.recent_mentions, pinterest.boards, tiktok.creator_info, x.quota.

NameTypeReqDescription
account_idstring–Connected social account ID when the helper needs account context.
helperstringyes–
paramsobject––
platformstring–Platform hint when no account_id is supplied. Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, dev…

No output schema declared.

No examples provided.

update_oauth_client ~106

Update a self-serve OAuth developer client. WRITE: confirm changed redirect URIs, scopes, and active state before calling.

NameTypeReqDescription
allowed_redirect_urisarray––
client_idstringyes–
client_namestring––
confirmbooleanyesMust be true after explicit user confirmation.
default_scopesarray––
descriptionstring––
homepagestring––
is_activeboolean––

No output schema declared.

No examples provided.

update_post ~378

Update a scheduled or draft post. DESTRUCTIVE WRITE - overwrites the existing post's caption/media/schedule. Cannot edit published or currently publishing posts. REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media) and the PROPOSED changes, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each edit needs its own confirmation.

NameTypeReqDescription
captionstring–New caption/text content
confirmbooleanyesMust be true after explicit user confirmation of the proposed post update.
instagram_settingsobject–Instagram-specific updates: post_type, collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_url, reel_thumb_offset.
media_urlstring–New media URL. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this tool runs.
media_urlsarray–New media URLs for carousel. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved.
platform_settingsobject–Platform-specific settings to merge into the post. Prefer this over raw metadata.
post_idnumberyesThe post ID to update
post_typestring–New post type: text, image, video, carousel, reel, story, story_series, document, photo, or cover_photo
scheduled_atstring–New scheduled time (ISO 8601, e.g. 2026-03-10T09:00:00Z)

No output schema declared.

No examples provided.

update_post_release_id ~107

Set or repair an external release_id and optional group_id on a post. WRITE: call get_post first, show the target post and release/group IDs, then pass confirm=true only after explicit confirmation.

NameTypeReqDescription
confirmbooleanyesMust be true after explicit user confirmation.
group_idstring–Optional external group/campaign ID.
post_idintegeryesThe post ID to update.
release_idstringyesExternal release ID to store on the post.

No output schema declared.

No examples provided.

update_post_status ~128

Pause, resume/schedule, or move a post back to draft. DESTRUCTIVE WRITE: changes whether content will publish. REQUIRED BEFORE CALLING: Fetch the post with `get_post`, show the user current status and proposed status/scheduled_at, then get explicit confirmation. Pass confirm=true only after that confirmation.

NameTypeReqDescription
confirmbooleanyesMust be true after explicit user confirmation.
post_idnumberyesThe post ID to update.
scheduled_atstring–ISO 8601 datetime. Required when scheduling a draft.
statusstringyesTarget status.

No output schema declared.

No examples provided.

update_webhook ~113

Update a webhook URL, events, workspace, description, or active state. WRITE WITH OUTBOUND SIDE EFFECTS: list the current webhook first and get explicit confirmation before calling.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms the webhook update.
description–––
eventsarray––
is_activeboolean––
urlstring––
webhook_idstringyesWebhook ID from list_webhooks.
workspace_idstring|null––

No output schema declared.

No examples provided.

upload_media ~275

Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB. This writes to the user's media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe - it's the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements. IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path - never guess paths.

NameTypeReqDescription
base64_datastring–Base64-encoded file data. PREFERRED for images shared directly in chat - extract the image data as base64 and pass it here.
content_typestring–MIME type (auto-detected from filename if omitted)
file_pathstring–Absolute local filesystem path (e.g. /Users/name/photo.jpg). Only use when the user gives you an explicit path. Do NOT guess paths for images uploaded in chat.
filenamestringyesFilename with extension (e.g. photo.jpg, video.mp4)

No output schema declared.

No examples provided.

upload_media_from_url ~114

Fetch an image or video from a public HTTPS URL into Posterly storage. Returns a URL that can be used with create_post. You can also pass public HTTP(S) media URLs directly to create_post/update_post; use this tool when you want to upload once and reuse the returned Posterly URL.

NameTypeReqDescription
content_typestring–Optional MIME type override.
filenamestring–Optional filename override.
urlstringyesPublic HTTPS URL for the image or video. Local/private network URLs are blocked.

No output schema declared.

No examples provided.

validate_post ~627

Validate and normalize one post without creating it. This does not create records, copy remote media, consume post-item/storage quota, reserve X quota, emit webhooks, or enqueue publication. Third-party media may return remote_media_not_materialized because live create performs storage copy and final byte validation. Use this before showing the final preview and asking for confirmation to call create_post.

NameTypeReqDescription
account_idstring–Social account ID (from list_accounts)
captionstring–The post caption/text content. Ignored when `thread_posts` is provided.
instagram_settingsobject–Instagram-specific settings: post_type (post/feed/story/reel/carousel), collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_u…
media_urlstring–Media URL to attach. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this too…
media_urlsarray–Multiple media URLs for carousel or multi-image posts. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. For TikTok, 2 or more…
platformstring–Platform name (required with username). Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, ha…
platform_settingsobject–Platform-specific settings for the selected account. Use this for non-Instagram settings and prefer it over raw metadata.
post_typestring–Optional post type: text, image, video, carousel, reel, story, story_series, document, photo, cover_photo, x_thread, or threads_thread. Omit it for auto-detection from media. For TikTok photo posts,…
scheduled_atstring–ISO 8601 datetime for scheduling (e.g. 2026-03-05T09:00:00Z). Omit for immediate publish.
thread_postsarray–For X or Threads only: array of 2+ strings, one per post in the thread. The first entry leads, the rest reply in order. When set, the platform must be twitter or threads.
usernamestring–Account username (alternative to account_id)
workspace_idstring–Workspace ID to assign the post to (from whoami). If omitted, uses the account's workspace or the caller's default workspace.

No output schema declared.

No examples provided.

whoami ~81

Return the authenticated user, API key scopes, the default (personal) workspace, and every workspace the caller can post in. ALWAYS call this at the start of a session before creating, listing, or scheduling posts - posts created without an explicit workspace_id land in the default workspace shown here, and confirming with the user first prevents posts from appearing in the wrong workspace.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

Common questions

What is the posterly MCP server?

posterly is an MCP server listed in the public MCP registry as io.github.awpthorp/posterly. Validate, schedule, publish, and analyze social content across 18 platforms with posterly. This page covers its npm package (posterly-mcp-server).

Is the posterly MCP server safe to use?

posterly scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the posterly MCP server expose?

posterly exposes 75 tools: get_agent_signup_info, start_signup, get_signup_session, get_mcp_status, whoami, and 70 more. Their descriptions and schemas cost roughly 11,296 tokens of context every time the server is loaded.

Is the posterly MCP server still maintained?

posterly is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the posterly MCP server under?

posterly declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.