Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

posterly

NPM · POSTERLY-MCP-SERVER · 2 COMPONENTS · SCANNED AUG 3

Validate, schedule, publish, and analyze social content across 18 platforms with posterly.

+41 this week 60 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency19
  • Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 3 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability60
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 11296 tokens (~150/item across 75 items; 75 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 79% of tool parameters carry a description.Partial
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · posterly-mcp-server

# add to Claude Code
claude mcp add awpthorp-posterly -- npx -y posterly-mcp-server
# add to Codex CLI
codex mcp add awpthorp-posterly -- npx -y posterly-mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "awpthorp-posterly": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "posterly-mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add awpthorp-posterly --command npx --arg -y --arg posterly-mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  awpthorp-posterly:
    command: "npx"
    args: ["-y", "posterly-mcp-server"]
// mcp.json
{
  "mcpServers": {
    "awpthorp-posterly": {
      "command": "npx",
      "args": [
        "-y",
        "posterly-mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +47
    • Provenance: unverified → fail security
    • Install scripts: unverified → pass security
    • Known CVEs: unverified → partial security
    • Malware scan: unverified → pass security
    • Maintenance: unverified → pass functional
    • Stability: unverified → 0.23 functional
    • Schema quality: unverified → good functional
    • MCP protocol: unverified → pass functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Licence: MIT functional
  • 31 Jul 26 +13
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 0
    • Tool coverage: unverified → 100 functional
    • Package version: 0.27.0 → 0.27.1 functional
  • 28 Jul 26 −19
    • Tool coverage: 100 → unverified functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 19

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 95 packages

95 packages in the resolved dependency tree · 95 deprecated · 29 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 75 exposed · ~11,296 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
list_google_business_media ~147

List the photos and videos on a Google Business Profile gallery (the media shown on Maps and Search) for one location/account or every accessible GBP location. This is separate from media attached to a post. Returns each item's resource name, category, format, and URLs.

NameTypeReqDescription
account_idintegerGoogle Business account ID from list_accounts.
location_idstringGoogle Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
workspace_idstringFilter to a workspace ID from whoami.

No output schema declared.

No examples provided.

list_google_business_reviews ~145

List Google Business Profile reviews for one location/account or every accessible GBP location. Supports rating and unanswered-only filters.

NameTypeReqDescription
account_idintegerGoogle Business account ID from list_accounts.
location_idstringGoogle Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
ratingintegerFilter to a 1-5 star rating.
unansweredbooleanOnly return reviews without owner replies.
workspace_idstringFilter to a workspace ID from whoami.

No output schema declared.

No examples provided.

list_oauth_clients ~34

List self-serve OAuth developer clients owned by the user. These are public PKCE clients for third-party app integrations.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_platforms ~71

List posterly platform integrations, posting capabilities, content/media limits, settings schemas, helper tools, and analytics support. Use include_planned to show future integration possibilities from the Postiz parity audit.

NameTypeReqDescription
include_plannedbooleanInclude planned integrations such as reddit, medium, skool, whop.

No output schema declared.

No examples provided.

list_post_suggestions ~129

List proactive post suggestions: evidence-based weekly drafts posterly writes in each account's learned voice, each with a rationale tying it back to what has performed well for that account. Filter by account_id and status (pending, scheduled, dismissed; default pending). Read-only; requires a Pro plan or higher. Use dismiss_suggestion to hide one.

NameTypeReqDescription
account_idstring|numberFilter to one social account ID (from list_accounts).
limitintegerMax suggestions to return (default 20).
statusstringSuggestion status to list (default pending).

No output schema declared.

No examples provided.

list_posts ~185

List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, or workspace_id. If workspace_id is omitted, posts across every workspace the caller is a member of are returned.

NameTypeReqDescription
account_idstringFilter to a specific social account ID (from list_accounts).
limitnumberNumber of posts to return (default 20, max 100)
platformstringFilter by platform: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, hashnode, wordpress, lemmy.
statusstringFilter by status: draft, scheduled, published, failed
workspace_idstringFilter to posts in a specific workspace (get IDs via whoami).

No output schema declared.

No examples provided.

list_webhooks ~43

List API webhook subscriptions, their event filters, active state, and most recent delivery status.

NameTypeReqDescription
workspace_idstringFilter to a workspace ID from whoami.

No output schema declared.

No examples provided.

pause_subscription ~66

Pause the authenticated user's posterly subscription for 30 days (one pause allowed per 90-day cooldown). Billing action; requires the billing:write scope. Only call after the user explicitly confirms.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms pausing the subscription.

No output schema declared.

No examples provided.

reply_google_business_review ~172

Post or update the owner reply on a Google Business Profile review. WRITE: show the review, location, and exact reply text to the user, then pass confirm=true only after explicit confirmation.

NameTypeReqDescription
account_idintegerGoogle Business account ID from list_accounts.
commentstringyesExact owner reply text to post.
confirmbooleanyesMust be true after explicit user confirmation.
location_idstringGoogle Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
review_namestringyesFull Google review resource name.
workspace_idstringFilter to a workspace ID from whoami.

No output schema declared.

No examples provided.

resume_subscription ~28

Resume the authenticated user's paused posterly subscription, restoring active billing. Requires the billing:write scope.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

run_video_function ~101

Run a read-only Veo helper function before generation: list_input_modes, estimate_cost, or validate_request. This does not generate video or spend credits.

NameTypeReqDescription
functionNamestringyesHelper function name from get_video_options.tools.
identifierstringyesVideo generator identifier from get_video_options.
paramsobjectFunction parameters. estimate_cost accepts model, duration_seconds, resolution, and output. validate_request accepts a generate_video-style payload.

No output schema declared.

No examples provided.

start_signup ~226

Start the public Posterly paid signup flow for a user before Posterly API access exists. Returns a Posterly checkout handoff URL and signup poll URL. The user must handle payment and password setup in the browser. Do not ask for card details or a Posterly password in chat.

NameTypeReqDescription
api_addonbooleanAlways true for AI agent setup because MCP/API access requires the API add-on.
debugbooleanWhen true, include the raw signup response JSON for debugging. Keep false for normal user-facing agent flows.
emailstringyesUser email address to sign up. Confirm this with the user before calling.
intervalstringBilling interval. Public agent signup currently supports monthly billing.
namestringOptional user or workspace name to pass into Posterly signup.
return_pathstringWhere Posterly should continue after checkout and password setup.
sourcestringSource label for analytics and support diagnostics.
tierstringPosterly plan to start. Use starter unless the user explicitly chooses another plan.

No output schema declared.

No examples provided.

submit_agent_feedback ~102

Submit bounded private operational telemetry after a concrete posterly workflow outcome. This does not alter product content but writes a private feedback event. Never include API keys, prompts, captions, media URLs, personal data, or fabricated outcomes.

NameTypeReqDescription
clientstring
commentstring
contextobject
error_code
outcomestringyes
sourcestringyes
toolstringyes

No output schema declared.

No examples provided.

suggest_google_business_review_reply ~186

Generate short, brand-aware AI reply suggestions for a Google review. Uses the AI Caption Assist allowance; does not post the reply.

NameTypeReqDescription
account_idintegerOptional Google Business account ID for brand voice context.
business_namestring
countinteger
location_idstringGoogle Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco…
review_textstringReview text. Leave empty for rating-only reviews.
reviewer_namestring
star_ratingnumberyesReview rating from 1 to 5.
tonestring
workspace_idstringFilter to a workspace ID from whoami.

No output schema declared.

No examples provided.

test_webhook ~67

Send a signed webhook.test delivery to a webhook URL. OUTBOUND SIDE EFFECT: get explicit confirmation before sending a test request.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms the test delivery.
webhook_idstringyesWebhook ID from list_webhooks.

No output schema declared.

No examples provided.

trigger_platform_helper ~129

Run account-specific platform helper discovery. Available helpers: linkedin.recent_mentions, pinterest.boards, tiktok.creator_info, x.quota.

NameTypeReqDescription
account_idstringConnected social account ID when the helper needs account context.
helperstringyes
paramsobject
platformstringPlatform hint when no account_id is supplied. Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, dev…

No output schema declared.

No examples provided.

update_oauth_client ~106

Update a self-serve OAuth developer client. WRITE: confirm changed redirect URIs, scopes, and active state before calling.

NameTypeReqDescription
allowed_redirect_urisarray
client_idstringyes
client_namestring
confirmbooleanyesMust be true after explicit user confirmation.
default_scopesarray
descriptionstring
homepagestring
is_activeboolean

No output schema declared.

No examples provided.

update_post ~378

Update a scheduled or draft post. DESTRUCTIVE WRITE - overwrites the existing post's caption/media/schedule. Cannot edit published or currently publishing posts. REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media) and the PROPOSED changes, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each edit needs its own confirmation.

NameTypeReqDescription
captionstringNew caption/text content
confirmbooleanyesMust be true after explicit user confirmation of the proposed post update.
instagram_settingsobjectInstagram-specific updates: post_type, collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_url, reel_thumb_offset.
media_urlstringNew media URL. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this tool runs.
media_urlsarrayNew media URLs for carousel. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved.
platform_settingsobjectPlatform-specific settings to merge into the post. Prefer this over raw metadata.
post_idnumberyesThe post ID to update
post_typestringNew post type: text, image, video, carousel, reel, story, story_series, document, photo, or cover_photo
scheduled_atstringNew scheduled time (ISO 8601, e.g. 2026-03-10T09:00:00Z)

No output schema declared.

No examples provided.

update_post_release_id ~107

Set or repair an external release_id and optional group_id on a post. WRITE: call get_post first, show the target post and release/group IDs, then pass confirm=true only after explicit confirmation.

NameTypeReqDescription
confirmbooleanyesMust be true after explicit user confirmation.
group_idstringOptional external group/campaign ID.
post_idintegeryesThe post ID to update.
release_idstringyesExternal release ID to store on the post.

No output schema declared.

No examples provided.

update_post_status ~128

Pause, resume/schedule, or move a post back to draft. DESTRUCTIVE WRITE: changes whether content will publish. REQUIRED BEFORE CALLING: Fetch the post with `get_post`, show the user current status and proposed status/scheduled_at, then get explicit confirmation. Pass confirm=true only after that confirmation.

NameTypeReqDescription
confirmbooleanyesMust be true after explicit user confirmation.
post_idnumberyesThe post ID to update.
scheduled_atstringISO 8601 datetime. Required when scheduling a draft.
statusstringyesTarget status.

No output schema declared.

No examples provided.

update_webhook ~113

Update a webhook URL, events, workspace, description, or active state. WRITE WITH OUTBOUND SIDE EFFECTS: list the current webhook first and get explicit confirmation before calling.

NameTypeReqDescription
confirmbooleanyesMust be true after the user explicitly confirms the webhook update.
description
eventsarray
is_activeboolean
urlstring
webhook_idstringyesWebhook ID from list_webhooks.
workspace_idstring|null

No output schema declared.

No examples provided.

upload_media ~275

Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB. This writes to the user's media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe - it's the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements. IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path - never guess paths.

NameTypeReqDescription
base64_datastringBase64-encoded file data. PREFERRED for images shared directly in chat - extract the image data as base64 and pass it here.
content_typestringMIME type (auto-detected from filename if omitted)
file_pathstringAbsolute local filesystem path (e.g. /Users/name/photo.jpg). Only use when the user gives you an explicit path. Do NOT guess paths for images uploaded in chat.
filenamestringyesFilename with extension (e.g. photo.jpg, video.mp4)

No output schema declared.

No examples provided.

upload_media_from_url ~114

Fetch an image or video from a public HTTPS URL into Posterly storage. Returns a URL that can be used with create_post. You can also pass public HTTP(S) media URLs directly to create_post/update_post; use this tool when you want to upload once and reuse the returned Posterly URL.

NameTypeReqDescription
content_typestringOptional MIME type override.
filenamestringOptional filename override.
urlstringyesPublic HTTPS URL for the image or video. Local/private network URLs are blocked.

No output schema declared.

No examples provided.

validate_post ~627

Validate and normalize one post without creating it. This does not create records, copy remote media, consume post-item/storage quota, reserve X quota, emit webhooks, or enqueue publication. Third-party media may return remote_media_not_materialized because live create performs storage copy and final byte validation. Use this before showing the final preview and asking for confirmation to call create_post.

NameTypeReqDescription
account_idstringSocial account ID (from list_accounts)
captionstringThe post caption/text content. Ignored when `thread_posts` is provided.
instagram_settingsobjectInstagram-specific settings: post_type (post/feed/story/reel/carousel), collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_u…
media_urlstringMedia URL to attach. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this too…
media_urlsarrayMultiple media URLs for carousel or multi-image posts. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. For TikTok, 2 or more…
platformstringPlatform name (required with username). Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, ha…
platform_settingsobjectPlatform-specific settings for the selected account. Use this for non-Instagram settings and prefer it over raw metadata.
post_typestringOptional post type: text, image, video, carousel, reel, story, story_series, document, photo, cover_photo, x_thread, or threads_thread. Omit it for auto-detection from media. For TikTok photo posts,…
scheduled_atstringISO 8601 datetime for scheduling (e.g. 2026-03-05T09:00:00Z). Omit for immediate publish.
thread_postsarrayFor X or Threads only: array of 2+ strings, one per post in the thread. The first entry leads, the rest reply in order. When set, the platform must be twitter or threads.
usernamestringAccount username (alternative to account_id)
workspace_idstringWorkspace ID to assign the post to (from whoami). If omitted, uses the account's workspace or the caller's default workspace.

No output schema declared.

No examples provided.

whoami ~81

Return the authenticated user, API key scopes, the default (personal) workspace, and every workspace the caller can post in. ALWAYS call this at the start of a session before creating, listing, or scheduling posts - posts created without an explicit workspace_id land in the default workspace shown here, and confirming with the user first prevents posts from appearing in the wrong workspace.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.