posterly
NPM · POSTERLY-MCP-SERVER · 2 COMPONENTS · SCANNED SEP 25
Validate, schedule, publish, and analyze social content across 18 platforms with posterly.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 96 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency19
- Repository check failed: the declared repository URL returned HTTP 404. See how to fix → View diagnostics → Fail
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 11296 tokens (~150/item across 75 items; 75 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage93
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 79% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 75 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the posterly MCP server?
posterly runs locally as an npm package, launched with npx -y posterly-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · posterly-mcp-server
claude mcp add awpthorp-posterly -- npx -y posterly-mcp-server
{
"mcpServers": {
"awpthorp-posterly": {
"command": "npx",
"args": [
"-y",
"posterly-mcp-server"
]
}
}
} {
"servers": {
"awpthorp-posterly": {
"command": "npx",
"args": [
"-y",
"posterly-mcp-server"
]
}
}
} codex mcp add awpthorp-posterly -- npx -y posterly-mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"awpthorp-posterly": {
"type": "local",
"command": [
"npx",
"-y",
"posterly-mcp-server"
],
"enabled": true
}
}
} openclaw mcp add awpthorp-posterly --command npx --arg -y --arg posterly-mcp-server
mcp_servers:
awpthorp-posterly:
command: "npx"
args: ["-y", "posterly-mcp-server"] {
"McpServers": {
"awpthorp-posterly": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"posterly-mcp-server"
]
}
}
} assistant mcp add awpthorp-posterly -t stdio -c npx -a -y posterly-mcp-server
{
"mcpServers": {
"awpthorp-posterly": {
"command": "npx",
"args": [
"-y",
"posterly-mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 22 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Sept 26 −3
- Stability: pass → 0.77 functional
- 19 Sept 26 +1
- Stability: 0.97 → pass security
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 −3
- Stability: pass → 0.80 functional
- 12 Sept 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Sept 2026 · Analysed npm/posterly-mcp-server@0.27.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 96 packages
| Packages resolved | 96 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
list_google_business_media ~147
List the photos and videos on a Google Business Profile gallery (the media shown on Maps and Search) for one location/account or every accessible GBP location. This is separate from media attached to a post. Returns each item's resource name, category, format, and URLs.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | – | Google Business account ID from list_accounts. |
| location_id | string | – | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| workspace_id | string | – | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
list_google_business_reviews ~145
List Google Business Profile reviews for one location/account or every accessible GBP location. Supports rating and unanswered-only filters.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | – | Google Business account ID from list_accounts. |
| location_id | string | – | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| rating | integer | – | Filter to a 1-5 star rating. |
| unanswered | boolean | – | Only return reviews without owner replies. |
| workspace_id | string | – | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
list_oauth_clients ~34
List self-serve OAuth developer clients owned by the user. These are public PKCE clients for third-party app integrations.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_platforms ~71
List posterly platform integrations, posting capabilities, content/media limits, settings schemas, helper tools, and analytics support. Use include_planned to show future integration possibilities from the Postiz parity audit.
| Name | Type | Req | Description |
|---|---|---|---|
| include_planned | boolean | – | Include planned integrations such as reddit, medium, skool, whop. |
No output schema declared.
No examples provided.
list_post_suggestions ~129
List proactive post suggestions: evidence-based weekly drafts posterly writes in each account's learned voice, each with a rationale tying it back to what has performed well for that account. Filter by account_id and status (pending, scheduled, dismissed; default pending). Read-only; requires a Pro plan or higher. Use dismiss_suggestion to hide one.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string|number | – | Filter to one social account ID (from list_accounts). |
| limit | integer | – | Max suggestions to return (default 20). |
| status | string | – | Suggestion status to list (default pending). |
No output schema declared.
No examples provided.
list_posts ~185
List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, or workspace_id. If workspace_id is omitted, posts across every workspace the caller is a member of are returned.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Filter to a specific social account ID (from list_accounts). |
| limit | number | – | Number of posts to return (default 20, max 100) |
| platform | string | – | Filter by platform: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, hashnode, wordpress, lemmy. |
| status | string | – | Filter by status: draft, scheduled, published, failed |
| workspace_id | string | – | Filter to posts in a specific workspace (get IDs via whoami). |
No output schema declared.
No examples provided.
list_webhooks ~43
List API webhook subscriptions, their event filters, active state, and most recent delivery status.
| Name | Type | Req | Description |
|---|---|---|---|
| workspace_id | string | – | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
pause_subscription ~66
Pause the authenticated user's posterly subscription for 30 days (one pause allowed per 90-day cooldown). Billing action; requires the billing:write scope. Only call after the user explicitly confirms.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after the user explicitly confirms pausing the subscription. |
No output schema declared.
No examples provided.
reply_google_business_review ~172
Post or update the owner reply on a Google Business Profile review. WRITE: show the review, location, and exact reply text to the user, then pass confirm=true only after explicit confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | – | Google Business account ID from list_accounts. |
| comment | string | yes | Exact owner reply text to post. |
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| location_id | string | – | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| review_name | string | yes | Full Google review resource name. |
| workspace_id | string | – | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
resume_subscription ~28
Resume the authenticated user's paused posterly subscription, restoring active billing. Requires the billing:write scope.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
run_video_function ~101
Run a read-only Veo helper function before generation: list_input_modes, estimate_cost, or validate_request. This does not generate video or spend credits.
| Name | Type | Req | Description |
|---|---|---|---|
| functionName | string | yes | Helper function name from get_video_options.tools. |
| identifier | string | yes | Video generator identifier from get_video_options. |
| params | object | – | Function parameters. estimate_cost accepts model, duration_seconds, resolution, and output. validate_request accepts a generate_video-style payload. |
No output schema declared.
No examples provided.
start_signup ~226
Start the public Posterly paid signup flow for a user before Posterly API access exists. Returns a Posterly checkout handoff URL and signup poll URL. The user must handle payment and password setup in the browser. Do not ask for card details or a Posterly password in chat.
| Name | Type | Req | Description |
|---|---|---|---|
| api_addon | boolean | – | Always true for AI agent setup because MCP/API access requires the API add-on. |
| debug | boolean | – | When true, include the raw signup response JSON for debugging. Keep false for normal user-facing agent flows. |
| string | yes | User email address to sign up. Confirm this with the user before calling. | |
| interval | string | – | Billing interval. Public agent signup currently supports monthly billing. |
| name | string | – | Optional user or workspace name to pass into Posterly signup. |
| return_path | string | – | Where Posterly should continue after checkout and password setup. |
| source | string | – | Source label for analytics and support diagnostics. |
| tier | string | – | Posterly plan to start. Use starter unless the user explicitly chooses another plan. |
No output schema declared.
No examples provided.
submit_agent_feedback ~102
Submit bounded private operational telemetry after a concrete posterly workflow outcome. This does not alter product content but writes a private feedback event. Never include API keys, prompts, captions, media URLs, personal data, or fabricated outcomes.
| Name | Type | Req | Description |
|---|---|---|---|
| client | string | – | – |
| comment | string | – | – |
| context | object | – | – |
| error_code | – | – | – |
| outcome | string | yes | – |
| source | string | yes | – |
| tool | string | yes | – |
No output schema declared.
No examples provided.
suggest_google_business_review_reply ~186
Generate short, brand-aware AI reply suggestions for a Google review. Uses the AI Caption Assist allowance; does not post the reply.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | integer | – | Optional Google Business account ID for brand voice context. |
| business_name | string | – | – |
| count | integer | – | – |
| location_id | string | – | Google Business numeric location id (the location_id/platform_user_id from list_accounts, e.g. "197940849675145390"). NOT the ChIJ... Place ID returned by get_google_business_review_link. Prefer acco… |
| review_text | string | – | Review text. Leave empty for rating-only reviews. |
| reviewer_name | string | – | – |
| star_rating | number | yes | Review rating from 1 to 5. |
| tone | string | – | – |
| workspace_id | string | – | Filter to a workspace ID from whoami. |
No output schema declared.
No examples provided.
test_webhook ~67
Send a signed webhook.test delivery to a webhook URL. OUTBOUND SIDE EFFECT: get explicit confirmation before sending a test request.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after the user explicitly confirms the test delivery. |
| webhook_id | string | yes | Webhook ID from list_webhooks. |
No output schema declared.
No examples provided.
trigger_platform_helper ~129
Run account-specific platform helper discovery. Available helpers: linkedin.recent_mentions, pinterest.boards, tiktok.creator_info, x.quota.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Connected social account ID when the helper needs account context. |
| helper | string | yes | – |
| params | object | – | – |
| platform | string | – | Platform hint when no account_id is supplied. Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, dev… |
No output schema declared.
No examples provided.
update_oauth_client ~106
Update a self-serve OAuth developer client. WRITE: confirm changed redirect URIs, scopes, and active state before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| allowed_redirect_uris | array | – | – |
| client_id | string | yes | – |
| client_name | string | – | – |
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| default_scopes | array | – | – |
| description | string | – | – |
| homepage | string | – | – |
| is_active | boolean | – | – |
No output schema declared.
No examples provided.
update_post ~378
Update a scheduled or draft post. DESTRUCTIVE WRITE - overwrites the existing post's caption/media/schedule. Cannot edit published or currently publishing posts. REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media) and the PROPOSED changes, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each edit needs its own confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| caption | string | – | New caption/text content |
| confirm | boolean | yes | Must be true after explicit user confirmation of the proposed post update. |
| instagram_settings | object | – | Instagram-specific updates: post_type, collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_url, reel_thumb_offset. |
| media_url | string | – | New media URL. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this tool runs. |
| media_urls | array | – | New media URLs for carousel. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. |
| platform_settings | object | – | Platform-specific settings to merge into the post. Prefer this over raw metadata. |
| post_id | number | yes | The post ID to update |
| post_type | string | – | New post type: text, image, video, carousel, reel, story, story_series, document, photo, or cover_photo |
| scheduled_at | string | – | New scheduled time (ISO 8601, e.g. 2026-03-10T09:00:00Z) |
No output schema declared.
No examples provided.
update_post_release_id ~107
Set or repair an external release_id and optional group_id on a post. WRITE: call get_post first, show the target post and release/group IDs, then pass confirm=true only after explicit confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| group_id | string | – | Optional external group/campaign ID. |
| post_id | integer | yes | The post ID to update. |
| release_id | string | yes | External release ID to store on the post. |
No output schema declared.
No examples provided.
update_post_status ~128
Pause, resume/schedule, or move a post back to draft. DESTRUCTIVE WRITE: changes whether content will publish. REQUIRED BEFORE CALLING: Fetch the post with `get_post`, show the user current status and proposed status/scheduled_at, then get explicit confirmation. Pass confirm=true only after that confirmation.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after explicit user confirmation. |
| post_id | number | yes | The post ID to update. |
| scheduled_at | string | – | ISO 8601 datetime. Required when scheduling a draft. |
| status | string | yes | Target status. |
No output schema declared.
No examples provided.
update_webhook ~113
Update a webhook URL, events, workspace, description, or active state. WRITE WITH OUTBOUND SIDE EFFECTS: list the current webhook first and get explicit confirmation before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | yes | Must be true after the user explicitly confirms the webhook update. |
| description | – | – | – |
| events | array | – | – |
| is_active | boolean | – | – |
| url | string | – | – |
| webhook_id | string | yes | Webhook ID from list_webhooks. |
| workspace_id | string|null | – | – |
No output schema declared.
No examples provided.
upload_media ~275
Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB. This writes to the user's media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe - it's the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements. IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path - never guess paths.
| Name | Type | Req | Description |
|---|---|---|---|
| base64_data | string | – | Base64-encoded file data. PREFERRED for images shared directly in chat - extract the image data as base64 and pass it here. |
| content_type | string | – | MIME type (auto-detected from filename if omitted) |
| file_path | string | – | Absolute local filesystem path (e.g. /Users/name/photo.jpg). Only use when the user gives you an explicit path. Do NOT guess paths for images uploaded in chat. |
| filename | string | yes | Filename with extension (e.g. photo.jpg, video.mp4) |
No output schema declared.
No examples provided.
upload_media_from_url ~114
Fetch an image or video from a public HTTPS URL into Posterly storage. Returns a URL that can be used with create_post. You can also pass public HTTP(S) media URLs directly to create_post/update_post; use this tool when you want to upload once and reuse the returned Posterly URL.
| Name | Type | Req | Description |
|---|---|---|---|
| content_type | string | – | Optional MIME type override. |
| filename | string | – | Optional filename override. |
| url | string | yes | Public HTTPS URL for the image or video. Local/private network URLs are blocked. |
No output schema declared.
No examples provided.
validate_post ~627
Validate and normalize one post without creating it. This does not create records, copy remote media, consume post-item/storage quota, reserve X quota, emit webhooks, or enqueue publication. Third-party media may return remote_media_not_materialized because live create performs storage copy and final byte validation. Use this before showing the final preview and asking for confirmation to call create_post.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | – | Social account ID (from list_accounts) |
| caption | string | – | The post caption/text content. Ignored when `thread_posts` is provided. |
| instagram_settings | object | – | Instagram-specific settings: post_type (post/feed/story/reel/carousel), collaborators, user_tags, first_comment, media_alt_texts, is_trial_reel, graduation_strategy (defaults to MANUAL), reel_cover_u… |
| media_url | string | – | Media URL to attach. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. Short-lived signed URLs must still be live when this too… |
| media_urls | array | – | Multiple media URLs for carousel or multi-image posts. Posterly storage URLs are used as-is; third-party HTTP(S) URLs are copied into Posterly storage before the post is saved. For TikTok, 2 or more… |
| platform | string | – | Platform name (required with username). Supported: instagram, facebook, tiktok, twitter, linkedin, youtube, pinterest, threads, google_business, telegram, bluesky, discord, slack, mastodon, devto, ha… |
| platform_settings | object | – | Platform-specific settings for the selected account. Use this for non-Instagram settings and prefer it over raw metadata. |
| post_type | string | – | Optional post type: text, image, video, carousel, reel, story, story_series, document, photo, cover_photo, x_thread, or threads_thread. Omit it for auto-detection from media. For TikTok photo posts,… |
| scheduled_at | string | – | ISO 8601 datetime for scheduling (e.g. 2026-03-05T09:00:00Z). Omit for immediate publish. |
| thread_posts | array | – | For X or Threads only: array of 2+ strings, one per post in the thread. The first entry leads, the rest reply in order. When set, the platform must be twitter or threads. |
| username | string | – | Account username (alternative to account_id) |
| workspace_id | string | – | Workspace ID to assign the post to (from whoami). If omitted, uses the account's workspace or the caller's default workspace. |
No output schema declared.
No examples provided.
whoami ~81
Return the authenticated user, API key scopes, the default (personal) workspace, and every workspace the caller can post in. ALWAYS call this at the start of a session before creating, listing, or scheduling posts - posts created without an explicit workspace_id land in the default workspace shown here, and confirming with the user first prevents posts from appearing in the wrong workspace.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
What is the posterly MCP server?
posterly is an MCP server listed in the public MCP registry as io.github.awpthorp/posterly. Validate, schedule, publish, and analyze social content across 18 platforms with posterly. This page covers its npm package (posterly-mcp-server).
Is the posterly MCP server safe to use?
posterly scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the posterly MCP server expose?
posterly exposes 75 tools: get_agent_signup_info, start_signup, get_signup_session, get_mcp_status, whoami, and 70 more. Their descriptions and schemas cost roughly 11,296 tokens of context every time the server is loaded.
Is the posterly MCP server still maintained?
posterly is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the posterly MCP server under?
posterly declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.