posterly
NPM · POSTERLY-MCP-SERVER · 2 COMPONENTS · SCANNED AUG 3
Validate, schedule, publish, and analyze social content across 18 platforms with posterly.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability60
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 11296 tokens (~150/item across 75 items; 75 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 79% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · posterly-mcp-server
claude mcp add awpthorp-posterly -- npx -y posterly-mcp-server
codex mcp add awpthorp-posterly -- npx -y posterly-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"awpthorp-posterly": {
"type": "local",
"command": [
"npx",
"-y",
"posterly-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add awpthorp-posterly --command npx --arg -y --arg posterly-mcp-server
mcp_servers:
awpthorp-posterly:
command: "npx"
args: ["-y", "posterly-mcp-server"] {
"mcpServers": {
"awpthorp-posterly": {
"command": "npx",
"args": [
"-y",
"posterly-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +47
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Maintenance: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → good ▲ functional
- MCP protocol: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Licence: MIT functional
- 31 Jul 26 +13
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- Tool coverage: unverified → 100 ▲ functional
- Package version: 0.27.0 → 0.27.1 functional
- 28 Jul 26 −19
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 19
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
list_google_business_media ~147
List the photos and videos on a Google Business Profile gallery (the media shown on Maps and Search) for one location/account or every accessible GBP location. This is separate from media attached to a post. Returns each item's resource name, category, format, and URLs.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | — | Google Business account ID from list_accounts. |
| location_id | string | — | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| workspace_id | string | — | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
list_google_business_reviews ~145
List Google Business Profile reviews for one location/account or every accessible GBP location. Supports rating and unanswered-only filters.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | — | Google Business account ID from list_accounts. |
| location_id | string | — | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| rating | integer | — | Filter to a 1-5 star rating. |
| unanswered | boolean | — | Only return reviews without owner replies. |
| workspace_id | string | — | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
list_oauth_clients ~34
List self-serve OAuth developer clients owned by the user. These are public PKCE clients for third-party app integrations.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_platforms ~71
List posterly platform integrations, posting capabilities, content/media limits, settings schemas, helper tools, and analytics support. Use include_planned to show future integration possibilities from the Postiz parity audit.
| Name | Type | Req | Description |
|---|---|---|---|
| include_planned | boolean | — | Include planned integrations such as reddit, medium, skool, whop. |
No output schema declared.
No examples provided.
list_post_suggestions ~129
List proactive post suggestions: evidence-based weekly drafts posterly writes in each account's learned voice, each with a rationale tying it back to what has performed well for that account. Filter by account_id and status (pending, scheduled, dismissed; default pending). Read-only; requires a Pro plan or higher. Use dismiss_suggestion to hide one.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string|number | — | Filter to one social account ID (from list_accounts). |
| limit | integer | — | Max suggestions to return (default 20). |
| status | string | — | Suggestion status to list (default pending). |
No output schema declared.
No examples provided.
list_posts ~185
List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, or workspace_id. If workspace_id is omitted, posts across every workspace the caller is a member of are returned.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | — | Filter to a specific social account ID (from list_accounts). |
| limit | number | — | Number of posts to return (default 20, max 100) |
| platform | string | — | Filter by platform: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, hashnode, wordpress, lemmy. |
| status | string | — | Filter by status: draft, scheduled, published, failed |
| workspace_id | string | — | Filter to posts in a specific workspace (get IDs via whoami). |
No output schema declared.
No examples provided.
list_webhooks ~43
List API webhook subscriptions, their event filters, active state, and most recent delivery status.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace_id | string | — | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
pause_subscription ~66
Pause the authenticated user's posterly subscription for 30 days (one pause allowed per 90-day cooldown). Billing action; requires the billing:write scope. Only call after the user explicitly confirms.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after the user explicitly confirms pausing the subscription. |
No output schema declared.
No examples provided.
reply_google_business_review ~172
Post or update the owner reply on a Google Business Profile review. WRITE: show the review, location, and exact reply text to the user, then pass confirm=true only after explicit confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | — | Google Business account ID from list_accounts. |
| comment | string | yes | Exact owner reply text to post. |
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| location_id | string | — | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| review_name | string | yes | Full Google review resource name. |
| workspace_id | string | — | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
resume_subscription ~28
Resume the authenticated user's paused posterly subscription, restoring active billing. Requires the billing:write scope.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
run_video_function ~101
Run a read-only Veo helper function before generation: list_input_modes, estimate_cost, or validate_request. This does not generate video or spend credits.
| Name | Type | Req | Description |
|---|---|---|---|
| functionName | string | yes | Helper function name from get_video_options.tools. |
| identifier | string | yes | Video generator identifier from get_video_options. |
| params | object | — | Function parameters. estimate_cost accepts model, duration_seconds, resolution, and output. validate_request accepts a generate_video-style payload. |
No output schema declared.
No examples provided.
start_signup ~226
Start the public Posterly paid signup flow for a user before Posterly API access exists. Returns a Posterly checkout handoff URL and signup poll URL. The user must handle payment and password setup in the browser. Do not ask for card details or a Posterly password in chat.
| Name | Type | Req | Description |
|---|---|---|---|
| api_addon | boolean | — | Always true for AI agent setup because MCP/API access requires the API add-on. |
| debug | boolean | — | When true, include the raw signup response JSON for debugging. Keep false for normal user-facing agent flows. |
| string | yes | User email address to sign up. Confirm this with the user before calling. | |
| interval | string | — | Billing interval. Public agent signup currently supports monthly billing. |
| name | string | — | Optional user or workspace name to pass into Posterly signup. |
| return_path | string | — | Where Posterly should continue after checkout and password setup. |
| source | string | — | Source label for analytics and support diagnostics. |
| tier | string | — | Posterly plan to start. Use starter unless the user explicitly chooses another plan. |
No output schema declared.
No examples provided.
submit_agent_feedback ~102
Submit bounded private operational telemetry after a concrete posterly workflow outcome. This does not alter product content but writes a private feedback event. Never include API keys, prompts, captions, media URLs, personal data, or fabricated outcomes.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | — | — |
| comment | string | — | — |
| context | object | — | — |
| error_code | — | — | — |
| outcome | string | yes | — |
| source | string | yes | — |
| tool | string | yes | — |
No output schema declared.
No examples provided.
suggest_google_business_review_reply ~186
Generate short, brand-aware AI reply suggestions for a Google review. Uses the AI Caption Assist allowance; does not post the reply.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | — | Optional Google Business account ID for brand voice context. |
| business_name | string | — | — |
| count | integer | — | — |
| location_id | string | — | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| review_text | string | — | Review text. Leave empty for rating-only reviews. |
| reviewer_name | string | — | — |
| star_rating | number | yes | Review rating from 1 to 5. |
| tone | string | — | — |
| workspace_id | string | — | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
test_webhook ~67
Send a signed webhook.test delivery to a webhook URL. OUTBOUND SIDE EFFECT: get explicit confirmation before sending a test request.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after the user explicitly confirms the test delivery. |
| webhook_id | string | yes | Webhook ID from list_webhooks. |
No output schema declared.
No examples provided.
trigger_platform_helper ~129
Run account-specific platform helper discovery. Available helpers: linkedin.recent_mentions, pinterest.boards, tiktok.creator_info, x.quota.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | — | Connected social account ID when the helper needs account context. |
| helper | string | yes | — |
| params | object | — | — |
| platform | string | — | Platform hint when no account_id is supplied. Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, dev… |
No output schema declared.
No examples provided.
update_oauth_client ~106
Update a self-serve OAuth developer client. WRITE: confirm changed redirect URIs, scopes, and active state before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| allowed_redirect_uris | array | — | — |
| client_id | string | yes | — |
| client_name | string | — | — |
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| default_scopes | array | — | — |
| description | string | — | — |
| homepage | string | — | — |
| is_active | boolean | — | — |
No output schema declared.
No examples provided.
update_post ~378
Update a scheduled or draft post. DESTRUCTIVE WRITE - overwrites the existing post's caption/media/schedule. Cannot edit published or currently publishing posts. REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media) and the PROPOSED changes, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each edit needs its own confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| caption | string | — | New caption/text content |
| confirm | boolean | yes | Must be true after explicit user confirmation of the proposed post update. |
| instagram_settings | object | — | Instagram-specific updates: post_type, collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_url, reel_thumb_offset. |
| media_url | string | — | New media URL. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this tool runs. |
| media_urls | array | — | New media URLs for carousel. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. |
| platform_settings | object | — | Platform-specific settings to merge into the post. Prefer this over raw metadata. |
| post_id | number | yes | The post ID to update |
| post_type | string | — | New post type: text, image, video, carousel, reel, story, story_series, document, photo, or cover_photo |
| scheduled_at | string | — | New scheduled time (ISO 8601, e.g. 2026-03-10T09:00:00Z) |
No output schema declared.
No examples provided.
update_post_release_id ~107
Set or repair an external release_id and optional group_id on a post. WRITE: call get_post first, show the target post and release/group IDs, then pass confirm=true only after explicit confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| group_id | string | — | Optional external group/campaign ID. |
| post_id | integer | yes | The post ID to update. |
| release_id | string | yes | External release ID to store on the post. |
No output schema declared.
No examples provided.
update_post_status ~128
Pause, resume/schedule, or move a post back to draft. DESTRUCTIVE WRITE: changes whether content will publish. REQUIRED BEFORE CALLING: Fetch the post with `get_post`, show the user current status and proposed status/scheduled_at, then get explicit confirmation. Pass confirm=true only after that confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| post_id | number | yes | The post ID to update. |
| scheduled_at | string | — | ISO 8601 datetime. Required when scheduling a draft. |
| status | string | yes | Target status. |
No output schema declared.
No examples provided.
update_webhook ~113
Update a webhook URL, events, workspace, description, or active state. WRITE WITH OUTBOUND SIDE EFFECTS: list the current webhook first and get explicit confirmation before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after the user explicitly confirms the webhook update. |
| description | — | — | — |
| events | array | — | — |
| is_active | boolean | — | — |
| url | string | — | — |
| webhook_id | string | yes | Webhook ID from list_webhooks. |
| workspace_id | string|null | — | — |
No output schema declared.
No examples provided.
upload_media ~275
Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB. This writes to the user's media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe - it's the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements. IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path - never guess paths.
| Name | Type | Req | Description |
|---|---|---|---|
| base64_data | string | — | Base64-encoded file data. PREFERRED for images shared directly in chat - extract the image data as base64 and pass it here. |
| content_type | string | — | MIME type (auto-detected from filename if omitted) |
| file_path | string | — | Absolute local filesystem path (e.g. /Users/name/photo.jpg). Only use when the user gives you an explicit path. Do NOT guess paths for images uploaded in chat. |
| filename | string | yes | Filename with extension (e.g. photo.jpg, video.mp4) |
No output schema declared.
No examples provided.
upload_media_from_url ~114
Fetch an image or video from a public HTTPS URL into Posterly storage. Returns a URL that can be used with create_post. You can also pass public HTTP(S) media URLs directly to create_post/update_post; use this tool when you want to upload once and reuse the returned Posterly URL.
| Name | Type | Req | Description |
|---|---|---|---|
| content_type | string | — | Optional MIME type override. |
| filename | string | — | Optional filename override. |
| url | string | yes | Public HTTPS URL for the image or video. Local/private network URLs are blocked. |
No output schema declared.
No examples provided.
validate_post ~627
Validate and normalize one post without creating it. This does not create records, copy remote media, consume post-item/storage quota, reserve X quota, emit webhooks, or enqueue publication. Third-party media may return remote_media_not_materialized because live create performs storage copy and final byte validation. Use this before showing the final preview and asking for confirmation to call create_post.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | — | Social account ID (from list_accounts) |
| caption | string | — | The post caption/text content. Ignored when `thread_posts` is provided. |
| instagram_settings | object | — | Instagram-specific settings: post_type (post/feed/story/reel/carousel), collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_u… |
| media_url | string | — | Media URL to attach. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this too… |
| media_urls | array | — | Multiple media URLs for carousel or multi-image posts. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. For TikTok, 2 or more… |
| platform | string | — | Platform name (required with username). Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, ha… |
| platform_settings | object | — | Platform-specific settings for the selected account. Use this for non-Instagram settings and prefer it over raw metadata. |
| post_type | string | — | Optional post type: text, image, video, carousel, reel, story, story_series, document, photo, cover_photo, x_thread, or threads_thread. Omit it for auto-detection from media. For TikTok photo posts,… |
| scheduled_at | string | — | ISO 8601 datetime for scheduling (e.g. 2026-03-05T09:00:00Z). Omit for immediate publish. |
| thread_posts | array | — | For X or Threads only: array of 2+ strings, one per post in the thread. The first entry leads, the rest reply in order. When set, the platform must be twitter or threads. |
| username | string | — | Account username (alternative to account_id) |
| workspace_id | string | — | Workspace ID to assign the post to (from whoami). If omitted, uses the account's workspace or the caller's default workspace. |
No output schema declared.
No examples provided.
whoami ~81
Return the authenticated user, API key scopes, the default (personal) workspace, and every workspace the caller can post in. ALWAYS call this at the start of a session before creating, listing, or scheduling posts - posts created without an explicit workspace_id land in the default workspace shown here, and confirming with the user first prevents posts from appearing in the wrong workspace.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.