Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

TokPortal

NPM · TOKPORTAL-MCP · 2 COMPONENTS

Managed TikTok/Instagram/YouTube accounts + video posting at scale, operated by human managers.

−2 this week 80 Trust /100

Last scanned (4 hours ago)

Scores higher than 65% of npm servers

Category Marketing and SEO

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 30 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 19 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability63
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 18281 tokens (~198/item across 92 items; 92 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety96
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 6 of 7 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "tokportal_get_bundle_publish_readiness" implies "publish" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
  • An AI judge read all 92 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 −2
    • Stability: pass → 0.83 functional
  • 30 Oct 26 0
    • Package version: 1.14.2 → 1.17.1 functional
  • 29 Oct 26 0
    • Stability: 0.97 → pass security
  • 28 Oct 26 0
    • Stability: pass → 0.97 functional
  • 17 Oct 26 +2
    • Stability: 0.87 → pass security
  • 15 Oct 26 −2
    • Stability: pass → 0.83 functional
  • 14 Oct 26 0
    • Stability: 0.97 → pass security
  • 13 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/tokportal-mcp@1.17.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 92 packages
Packages resolved 92
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 92 exposed · ~18,281 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
tokportal_add_edit_slots ~217

Add VIDEO-editing slots to a bundle. Buys video-editing slots — professional editing of a video by the account manager — and debits credits immediately (see `video_edit` in getCreditCosts). Non-refundable, with no cancellation path; confirm the exact cost with the user before calling. `edits_quantity` cannot exceed the bundle's `videos_quantity`, one video consumes at most one slot, and a slot is only consumed when that video carries `editing_instructions`. This has nothing to do with editing an account profile — use createAccountEditRequest for that.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_add_video_slots ~171

Add video slots to a bundle. Buys additional video slots on an existing bundle and debits credits immediately (see `video_upload` in getCreditCosts). The slots are non-refundable and there is no cancellation path for this purchase — confirm the exact cost with the user before calling. Configure the new positions with configureBundleVideo, then publish them.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_approve_comment_task ~139

Approve a manually confirmed comment task. Approves and finalizes an owned manually_confirmed task. Execution is blocked while TokPortal Coverage is inactive; inspect MANAGED_ACCOUNT_TASK_BLOCKED and reactivate a recoverable account first.

NameTypeReqDescription
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesComment task ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_batch_configure_bundle_videos ~506

Configure video slots in bulk. Configures many video slots in one call after a single account-level Coverage preflight. Partial success: this call returns HTTP 200 even when some or all rows are rejected. Read `configured`, `results` and `errors[]` and never infer success from the status code — rows breaking the 3-videos-per-day cap or the minimum lead time fail individually while the rest succeed, and the paid options they carry are only charged for the rows that succeeded. An `auto_publish` failure never fails the request; inspect `auto_publish.blockers`. TOP-LEVEL ONLY on this endpoint: one publish attempt per call, applying to every video in it. auto_publish inside videos[] is rejected with a hint telling you to move it out — it is per-video only on the single-slot PUT /bundles/{id}/videos/{position}. Each row's `target_publish_date` is the first day of a 2-day window whose end is derived (that day + 1); `target_publish_end_date` is refused on this endpoint. Publish-time date guard: any slot whose target date has already reached today or the past is moved forward to the earliest allowed day (today+1 with a delivered or existing account, today+3 while the account is still being created, in UTC), respecting the 3-videos-per-day-per-bundle cap — an overflowing day spills to the next one. Slots still in the future are NOT moved. This never fails the publish. When something moved, the response carries `adjusted_videos` — one entry per moved slot, `{video_id, position, previous_date, new_date}` — and `adjusted_videos_note`. Read them back instead of assuming the schedule you sent survived. Requires active TokPortal Coverage on the resolved saved account, or permanent grandfathering: a due period renews automatically at the account's stored rate immediately before execution, and nothing starts if it cannot renew. See getAccountManagedSubscription.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_can_refresh_account_analytics ~76

Check analytics refresh availability. Reports whether a manual analytics refresh is currently allowed and when the next one will be. Call it before refreshAccountAnalytics / refreshAnalyticsAccount to avoid a 429 cooldown (6 h for connected accounts, 24 h for the public fallback).

NameTypeReqDescription
idstringyesSaved account ID.

No output schema declared.

No examples provided.

tokportal_cancel_account_managed_subscription ~154

Pause TokPortal Coverage. Immediately blocks new and ongoing TokPortal work for the account. Payments are not refunded. If a paid or included current period remains, reactivation is free until its original end. Otherwise it costs exactly the unpaid 30-day periods at the rate returned by the Coverage status endpoint.

NameTypeReqDescription
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesSaved account ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_configure_bundle_account ~362

Configure bundle account profile. Sets the profile of an account that has NOT been delivered yet: username, visible name, biography, profile picture, and link-in-bio on Instagram bundles. Only valid while the bundle is `pending_setup` or `configured` — unpublish first to edit after publishing, and use createAccountEditRequest for an account that is already delivered. This is a full replacement: any field you omit is written back as null, so re-send the whole profile when you change one part of it. `link_in_bio` is stored on Instagram bundles only. On any other platform it is accepted but not stored, and the response says so explicitly through `_warnings` while echoing `link_in_bio: null` — read both back. For backward compatibility this endpoint also accepts the exact purchased advanced_warming_terms list, but PUT /bundles/{id}/warming-terms is the recommended one-shot deferred-target endpoint because it remains available at any account status. Requires active TokPortal Coverage on the resolved saved account, or permanent grandfathering: a due period renews automatically at the account's stored rate immediately before execution, and nothing starts if it cannot renew. See getAccountManagedSubscription. A new account that has not produced a saved account yet remains configurable before delivery.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_configure_bundle_video ~465

Configure a video slot. Configures one slot as a video, carousel, or story, and schedules it. A story (TikTok/Instagram only) is a single video OR a single image (provide exactly one of video_url or story_image_url), has no description, and is verified by an account-manager screenshot. Platform-specific fields are only stored on their own platform: `tiktok_sound_url` on TikTok, every `instagram_*` field on Instagram, every `youtube_*` field on YouTube. A field belonging to another platform is accepted and not stored, but it is no longer discarded in silence: the response lists those names in `ignored_fields`, next to `platform`, with an `ignored_fields_note` explaining why. Check `ignored_fields` on every 200 — an empty or absent list is the only proof that everything you sent landed. Some options are paid and charged the first time they are set, never refunded: story_repost_url, instant_repost_as_story, and setting either volume field. Scheduling: `target_publish_date` is the FIRST day of a 2-day publishing window, never a fixed date — the end day is derived as that day + 1 and cannot be chosen, so `target_publish_end_date` is refused here with a hint pointing at PATCH. The window that was actually stored comes back as `target_publish_start_date` / `target_publish_end_date`. `auto_publish` is per-video HERE and top-level-only on the batch endpoint. Requires active TokPortal Coverage on the resolved saved account, or permanent grandfathering: a due period renews automatically at the account's stored rate immediately before execution, and nothing starts if it cannot renew. See getAccountManagedSubscription.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.
positionintegeryes1-based video slot position.

No output schema declared.

No examples provided.

tokportal_configure_bundle_warming_terms ~291

Configure the niche targets of a count-only Advanced Niche Warming purchase. Only for a bundle created with advanced_warming_terms_count (deferred targets). To warm an account that is already delivered, use rewarmAccount instead; this endpoint answers 404 WARMING_SESSION_NOT_FOUND when there is no count-only purchase to configure. Must provide EXACTLY the purchased number of targets. One-shot: once configured the targets cannot be changed. Unlike PUT /bundles/{id}/account, this stays available at any account status after the manager accepted the mission or submitted the account, in which case the warming session starts immediately. Requires active TokPortal Coverage on the resolved saved account, or permanent grandfathering: a due period renews automatically at the account's stored rate immediately before execution, and nothing starts if it cannot renew. See getAccountManagedSubscription. A new account that has not produced a saved account yet remains configurable before delivery.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_create_account_edit_request ~322

Request profile edits for a delivered account. Requests profile changes on an account that is already delivered and debits 8 credits. This is the ONLY way to change a delivered account's public username, visible name, biography, picture or link-in-bio: addEditSlots is unrelated (it buys video-editing slots) and configureBundleAccount only works before the account is delivered. Besides the username and visible name, supply at least one of requested_biography, requested_profile_picture_url or requested_link_in_bio — a request that changes nothing else is rejected. Only one request can be open per account at a time (409 otherwise); check getAccountEditRequest first. Active TokPortal Coverage and a routable active account manager are required. TokPortal uses the account's current active manager, then its still-active manager relationship, then eligible non-cancelled order history. Completed bundles remain eligible without a delivery-age limit; cancelled orders are never restored. Assignment, debit, and task creation are atomic, so an unavailable manager never costs credits. The task appears directly in that manager's calendar.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesSaved account ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_create_analytics_report ~392

Create analytics web report. Creates a shareable Analytics v2 web report and returns its bearer-like access token and URL. The body is validated before anything is rendered, so a malformed request fails with INVALID_FIELD instead of quietly producing a wrong report for your end client. `from` and `to` are calendar dates in YYYY-MM-DD; a full ISO timestamp is accepted and truncated to its date, and anything else is refused rather than treated as "no filter" (which used to widen the report to the account's entire history). An inverted window (`from` after `to`) is refused too. `template` is a published enum — executive, agency, creator, minimal, growth, board — and an unknown value is refused instead of becoming executive. `brandAccent` must be #rrggbb (#rgb is expanded); named colours, rgb() and 8-digit hex are refused instead of being replaced by the TokPortal default. White-labelling still depends on entitlement: `brandName` and `brandAccent` only apply on the full analytics tier with a Farmer plan, and are otherwise reset. The response carries `applied` — the template, brand name, brand accent and the exact date window the report covers — plus `canBrand`, so read those back instead of inspecting the rendered report. Do not send Idempotency-Key. The successful response contains a secret and is never stored in the replay ledger. A request with the header is rejected with IDEMPOTENCY_KEY_NOT_ALLOWED_FOR_SENSITIVE_RESPONSE (400) before any ledger claim or operation execution.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…

No output schema declared.

No examples provided.

tokportal_create_bundle ~621

Create a bundle. Creates and pays an account-only, account-and-videos, or videos-only bundle in one atomic creation checkout. Credits are debited immediately on a successful POST, not when the bundle is published, and THERE IS NO CANCELLATION OR REFUND PATH — read getCreditCosts and getCreditBalance and confirm the total with the user before calling. One bundle produces exactly one account; order several accounts with createBundlesBulk. TikTok and Instagram only: a YouTube bundle is rejected with YOUTUBE_DELAYED even though getCreditCosts lists a YouTube price. Advanced Niche Warming requires wants_advanced_warming: true ALONGSIDE advanced_warming_terms or advanced_warming_terms_count; targets sent without the flag are refused with ADVANCED_WARMING_FLAG_REQUIRED, never charged and dropped. Send the term list or the count, not two quantities that disagree (ADVANCED_WARMING_COUNT_MISMATCH), and send distinct terms — anything removed by cleanup fails the call with ADVANCED_WARMING_TERMS_REJECTED rather than silently reducing what you receive and pay for. Credit cost is calculated server-side from the workspace cohort and any contract_bundle_allowance returned by getCreditCosts. A qualifying allowance slot is consumed in the same transaction as the credit debit; failed requests consume nothing. The exact new-customer and saved-account cutoff is the immutable production PRE-migration instant returned by getCreditCosts. A real TikTok or Instagram saved account created on or after that cutoff receives its first 30 days of TokPortal Coverage included unless the creation response marks it contractually exempt, and Coverage then recurs every 30 days per account at the managed_account_subscription price. For Advanced Niche Warming, pass advanced_warming_terms now, or buy a target count with advanced_warming_terms_count at the effective workspace rate and configure the targets later via PUT /bundles/{id}/warming-terms — one or the other, always with wants_advanced_warming: tru…

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_create_bundles_bulk ~559

Create bundles in bulk. Creates and pays several bundles in one atomic creation checkout. Credits are debited immediately on a successful POST, not at publication, and THERE IS NO CANCELLATION OR REFUND PATH — read getCreditCosts and getCreditBalance and confirm the total with the user before calling, because the loss is multiplied by accounts_count and platforms. Each bundle produces exactly one account. Warming targets and credits are charged per account, not per batch. Advanced Niche Warming requires wants_advanced_warming: true ALONGSIDE advanced_warming_terms or advanced_warming_terms_count; targets sent without the flag are refused with ADVANCED_WARMING_FLAG_REQUIRED for the whole batch, never charged and dropped. Send the term list or the count, not two quantities that disagree (ADVANCED_WARMING_COUNT_MISMATCH), and send distinct terms — anything removed by cleanup fails the call with ADVANCED_WARMING_TERMS_REJECTED. The complete batch is checked against rolling workspace capacity and any contract_bundle_allowance returned by getCreditCosts. Qualifying allowance slots are consumed in deterministic bundle-ID order in the same transaction as all debits; if any bundle fails, the entire batch rolls back and consumes nothing, so never split a 429 capacity-cooldown batch into parallel calls. A batch crossing the final allowance slot receives the contract price only for the remaining qualifying bundles. For Advanced Niche Warming, pass advanced_warming_terms, using the same terms for every account, or buy a per-account target count with advanced_warming_terms_count and configure each bundle's targets later via PUT /bundles/{id}/warming-terms — one or the other, always with wants_advanced_warming: true. Every bundle is returned in pending_setup with no username: each one still needs configureBundleAccount and publishBundle before any work starts. Delivered videos are approved automatically for every bundle in the batch unless you send auto_finalize_videos: false — t…

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_create_comment_tasks ~327

Create comment tasks. Creates one comment task or a partial-success batch of up to 200. Each accepted task costs 1 credit. The target is any public TikTok or Instagram video, including a third party's — that is the intended use — while the posting account must be one of your own delivered accounts and its platform must match the target's (COMMENT_PLATFORM_MISMATCH otherwise). Deduplicate locally on (saved_account_id, target URL, comment_text): two different Idempotency-Keys carrying the same comment bill twice. The saved account must be client-owned, manager-assigned, and allowed to execute tasks by TokPortal Coverage, unless it is permanently grandfathered. TokPortal locks and revalidates the account and Coverage before the accepted-task debit and all accepted inserts commit in one transaction. Rejected rows are never charged. Read credits_charged instead of calculating it from the request, and read meta.rejected_count and each row's reason rather than inferring success from the 201. Send an Idempotency-Key and reuse the same key, method, path, and body after an uncertain transport result so the completed response is replayed without a second charge.

NameTypeReqDescription
body–yesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_create_video_ad_code_request ~285

Request an ad code (TikTok Spark Code / Instagram Partner Code) for a finalized video. Requests an ad code (TikTok Spark Code or Instagram Partner Code) for one finalized video and debits 7 credits, which are not refundable. The platform is resolved from the video itself and cannot be chosen. The video must be finalized on TikTok or Instagram with a live post link. Active TokPortal Coverage and a routable active account manager are required. TokPortal uses the account's current active manager, then its still-active manager relationship, then eligible non-cancelled order history. Completed bundles remain eligible without a delivery-age limit; cancelled orders are never restored. Assignment, debit, and task creation are atomic. Only one open request per video is allowed, so a request made on the wrong video cannot be replaced until it closes. Poll the GET endpoint to retrieve the code once the manager submits it.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesVideo ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_create_webhook_endpoint ~234

Create a webhook endpoint. Creates a webhook endpoint and returns its signing secret once — store it, because a lost secret can only be replaced by deleting the endpoint and creating a new one. Call listWebhookEvents before choosing `events`: it returns the description, trigger condition and payload schema of each event, and several names are counter-intuitive. In particular account.published fires when YOU publish the order, not when the account is delivered — the delivery signal is account.in_review, and account.finalized fires when the account review is approved. Do not send Idempotency-Key. The successful response contains a secret and is never stored in the replay ledger. A request with the header is rejected with IDEMPOTENCY_KEY_NOT_ALLOWED_FOR_SENSITIVE_RESPONSE (400) before any ledger claim or operation execution.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…

No output schema declared.

No examples provided.

tokportal_delete_comment_task ~179

Cancel a pending comment task. Cancels an owned task only while its status is pending. The terminal transition and refund of the task's exact stored credit cost commit atomically and are idempotent. Current tasks refund 1 credit; credits_refunded remains authoritative for historical tasks. Cancellation remains available when Coverage is paused because it stops pending work rather than executing it. Reuse the same Idempotency-Key after an uncertain transport result.

NameTypeReqDescription
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesComment task ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_delete_webhook_endpoint ~126

Delete a webhook endpoint. Permanently deletes a webhook endpoint and invalidates its signing secret. Events that could not be delivered are not queued for a replacement endpoint.

NameTypeReqDescription
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesWebhook endpoint ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_dispute_comment_task ~148

Dispute a manually confirmed comment task. Returns an owned manually_confirmed task to pending corrections. Execution is blocked while TokPortal Coverage is inactive; inspect MANAGED_ACCOUNT_TASK_BLOCKED and reactivate a recoverable account first.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesComment task ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_export_analytics_report_html ~309

Export analytics report HTML. Creates a standalone downloadable HTML analytics report from the same body as createAnalyticsReport, and validates it identically: `from` and `to` are YYYY-MM-DD (a full ISO timestamp is truncated to its date, anything else is refused with INVALID_FIELD rather than treated as no filter), an inverted window is refused, `template` is the published enum (executive, agency, creator, minimal, growth, board) and an unknown value is refused instead of becoming executive, and `brandAccent` must be #rrggbb or #rgb. The body of the response is the HTML document itself, so what was applied travels in headers: X-TokPortal-Report-Template, X-TokPortal-Report-Can-Brand, X-TokPortal-Report-Brand-Name, X-TokPortal-Report-From, X-TokPortal-Report-To, alongside X-TokPortal-Export-Rows and X-TokPortal-Export-Accounts. Read those headers to confirm the window and the branding actually used.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_export_analytics_videos ~162

Export analytics videos CSV. CSV export of post-level analytics for the selected accounts and date range. Requires the Creator tier or above. Call getAnalyticsContract before interpreting these numbers: top-line values are lifetime per-post totals, connected-account values are rolling windows, the two intentionally do not mirror each other, and your access tier may redact metrics — a missing field means unavailable, never zero.

NameTypeReqDescription
accountstring–Repeatable account filter.
countrystring–Repeatable country filter.
fromstring–query parameter from
platformstring–Repeatable platform filter.
qstring–Search query.
tostring–query parameter to
workspacestring–query parameter workspace

No output schema declared.

No examples provided.

tokportal_finalize_bundle_account ~107

Finalize account review. Approves an in-review account and marks it finalized.

NameTypeReqDescription
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_finalize_bundle_video ~209

Finalize video review. Approves a delivered video and releases the account manager's payout — the review window cannot be reopened afterwards. Only valid while the slot is `in_review`. Any slot left in review is auto-finalized about 72 hours after entering it, so act inside that window. Requires active TokPortal Coverage on the resolved saved account, or permanent grandfathering: a due period renews automatically at the account's stored rate immediately before execution, and nothing starts if it cannot renew. See getAccountManagedSubscription.

NameTypeReqDescription
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.
positionintegeryes1-based video slot position.

No output schema declared.

No examples provided.

tokportal_fix_bundle_video_download ~188

Fix a broken video download. Replaces a manager-flagged broken video or carousel download URL and clears the download-issue flag. Requires active TokPortal Coverage on the resolved saved account, or permanent grandfathering: a due period renews automatically at the account's stored rate immediately before execution, and nothing starts if it cannot renew. See getAccountManagedSubscription.

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.
positionintegeryes1-based video slot position.

No output schema declared.

No examples provided.

tokportal_generate_warming_terms ~185

Generate Advanced Niche Warming search terms. Generates platform-appropriate Advanced Niche Warming search terms (niche targets) from a free-text niche description (max 1000 characters). This is free and no credits are charged. Call it before buying warming rather than inventing terms: pass the result to advanced_warming_terms (bundle creation or PUT /bundles/{id}/warming-terms deferred configuration) or to search_terms (rewarmAccount).

NameTypeReqDescription
bodyobjectyesJSON request body.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_get_account ~68

Get a delivered account. Returns one delivered account: handle, platform, Coverage state, ban state and warming summary. A `saved_account_id` invalidated by a remake returns 404 — re-read the bundle to get the new one.

NameTypeReqDescription
idstringyesSaved account ID.

No output schema declared.

No examples provided.

tokportal_get_account_analytics ~102

Get account analytics compatibility view. Legacy compatibility view of one account's analytics, kept for older integrations. New code should call getAnalyticsAccount instead. Call getAnalyticsContract before interpreting these numbers: top-line values are lifetime per-post totals, connected-account values are rolling windows, the two intentionally do not mirror each other, and your access tier may redact metrics — a missing field means unavailable, never zero.

NameTypeReqDescription
idstringyesSaved account ID.

No output schema declared.

No examples provided.

tokportal_get_account_edit_request ~68

Get active account edit request. Returns the account's profile edit requests, newest first, with their status and credit cost. Only one request can be open per account at a time, so check here before calling createAccountEditRequest.

NameTypeReqDescription
idstringyesSaved account ID.

No output schema declared.

No examples provided.

tokportal_get_account_managed_subscription ~189

Get TokPortal Coverage status. Returns the effective TokPortal Coverage status, current 30-day period, account-specific rate, unpaid periods, task access, and an exact timestamped reactivation quote for one eligible saved account. At current_period_end, status and task_access change immediately even if recorded_status remains included or active for a few minutes until the renewal worker persists the transition; period_expired makes that boundary explicit. A zero-credit quote is valid. Use its current_period_end and lock_version snapshot for reactivation. An eligible TikTok or Instagram account created before the global Coverage cutoff is grandfathered and has no subscription record. A missing record can also mean the account is not Coverage-eligible or has not reached delivery, so clients must not infer grandfathering from a generic 404. Coverage is independent from bundle completion or closure.

NameTypeReqDescription
idstringyesSaved account ID.

No output schema declared.

No examples provided.

tokportal_get_analytics_account ~115

Get account analytics drilldown. Analytics v2 drilldown for one account: current metrics, top posts and demographics. This is the current endpoint; getAccountAnalytics is the older compatibility shape of the same data. Call getAnalyticsContract before interpreting these numbers: top-line values are lifetime per-post totals, connected-account values are rolling windows, the two intentionally do not mirror each other, and your access tier may redact metrics — a missing field means unavailable, never zero.

NameTypeReqDescription
idstringyesSaved account ID.

No output schema declared.

No examples provided.

tokportal_get_analytics_contract ~39

Get analytics data contract. Returns the Analytics v2 contract, current access payload, metric semantics, freshness targets, and redaction rules.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

tokportal_get_analytics_dashboard ~141

Get analytics dashboard. Portfolio-level analytics across your accounts for a date range. Call getAnalyticsContract before interpreting these numbers: top-line values are lifetime per-post totals, connected-account values are rolling windows, the two intentionally do not mirror each other, and your access tier may redact metrics — a missing field means unavailable, never zero.

NameTypeReqDescription
accountstring–Repeatable account filter.
countrystring–Repeatable country filter.
fromstring–query parameter from
platformstring–Repeatable platform filter.
tostring–query parameter to
workspacestring–query parameter workspace

No output schema declared.

No examples provided.

tokportal_get_analytics_series ~180

Get analytics time series. Daily or weekly time series for one metric, built from stored snapshots and date-scoped rollups — never a live fetch. `mode` selects cumulative totals, per-period gains, or raw snapshot values. Series are excluded on the Starter tier. Call getAnalyticsContract before interpreting these numbers: top-line values are lifetime per-post totals, connected-account values are rolling windows, the two intentionally do not mirror each other, and your access tier may redact metrics — a missing field means unavailable, never zero.

NameTypeReqDescription
accountstring–Repeatable account filter.
fromstring–query parameter from
granularitystring–query parameter granularity
metricstring–query parameter metric
modestring–query parameter mode
tostring–query parameter to

No output schema declared.

No examples provided.

tokportal_get_bundle ~68

Get a bundle. Full state of one bundle: status, account configuration, video slot counts, warming purchase, cancellation and remake history, and `next_action`. A remade bundle keeps the same id while its `saved_account_id` changes.

NameTypeReqDescription
idstringyesBundle ID.

No output schema declared.

No examples provided.

tokportal_get_bundle_account ~69

Get bundle account configuration. Returns the current account-profile configuration of a bundle (username, visible name, biography, picture) and its listing status. Read it before configureBundleAccount to see what is already set and whether the profile is still editable.

NameTypeReqDescription
idstringyesBundle ID.

No output schema declared.

No examples provided.

tokportal_get_bundle_publish_readiness ~102

Check bundle publish readiness. Returns every current publish blocker without mutating the bundle, settling Coverage, or debiting credits. MANAGED_ACCOUNT_TASK_BLOCKED includes details.account_id and details.reason. Fetch GET /accounts/{account_id}/managed-subscription for the authoritative state and exact reactivation quote. A due included or active period can temporarily appear blocked until renewal is settled by cron or an approved mutation.

NameTypeReqDescription
idstringyesBundle ID.

No output schema declared.

No examples provided.

tokportal_get_bundle_video ~111

Get video slot configuration. Returns one video slot's configuration, schedule, review status and post link, plus `platform_signals` (TikTok not-recommended flag, AI label, sound status — null until the live post has been checked). Use it to check whether a slot is still inside its review window before finalizing it, or whether the platform is distributing the post at all.

NameTypeReqDescription
idstringyesBundle ID.
positionintegeryes1-based video slot position.

No output schema declared.

No examples provided.

tokportal_get_comment_pulse ~175

Get comment pulse analytics. Aggregated comment sentiment and themes across your posts, served from the analytics comment cache — never a live fetch. Full analytics tier only. Filters are not combinable: when `post` is supplied it takes precedence and `platform`, `country`, `account`, `workspace`, `from` and `to` are all ignored, and at most 12 post ids are sampled.

NameTypeReqDescription
accountstring–query parameter account
countrystring–query parameter country
fromstring–query parameter from
limitinteger–query parameter limit
platformstring–query parameter platform
poststring–query parameter post
postLimitinteger–query parameter postLimit
tostring–query parameter to

No output schema declared.

No examples provided.

tokportal_get_comment_task ~48

Get a comment task. Returns one owned comment task, including whether inactive TokPortal Coverage currently blocks manager execution and the stable block reason.

NameTypeReqDescription
idstringyesComment task ID.

No output schema declared.

No examples provided.

tokportal_get_credit_balance ~44

Get credit balance. Returns the currently spendable credit balance and upcoming expirations. Check it before any purchase: a 402 on a mutation means this was short.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

tokportal_get_credit_costs ~217

Get credit pricing. Authoritative live credit prices and workspace cohort. Call it immediately before any purchase and never hard-code or recall a price. Not every key is orderable: `youtube_account_creation` is listed for reference only (YouTube bundles are rejected with YOUTUBE_DELAYED), and `niche_warming` and `deep_warming` are legacy prices published for backward compatibility only — they are not products a caller may choose, and `advanced_warming` (Advanced Niche Warming, priced per niche target) is the only warming TokPortal sells. `managed_account_subscription` (TokPortal Coverage) recurs every 30 days per account after the included first period, so a multi-account quote must include it as a monthly cost. There is no dry-run endpoint: assemble the total from this table (account setup + video slots + Advanced Niche Warming targets + edit slots + paid video options), apply the returned cohort and contract_bundle_allowance, and confirm it with the user before creating anything.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

tokportal_get_current_user ~48

Get authenticated user. Returns the authenticated workspace: profile, role, analytics access tier and live credit balance. Call once at the start of a session to learn what this key can do.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

tokportal_get_video_ad_code_request ~71

Get / poll the ad code for a video. Returns the latest ad code request for the video. The `code` field is null until the manager submits it (status `in_review`) or it is delivered (status `finalized`).

NameTypeReqDescription
idstringyesVideo ID.

No output schema declared.

No examples provided.

tokportal_get_video_analytics ~101

Get single video analytics. Lifetime metrics for one tracked post. Interpret them with getAnalyticsContract: these are lifetime per-post totals and deliberately do not match the rolling-window figures shown for a connected account. Also returns `platform_signals` (not recommended, AI label, sound) and `signal_insights` (followers gained, audience split, impression sources, retention curve — Creator tier and above).

NameTypeReqDescription
idstringyesVideo ID.

No output schema declared.

No examples provided.

tokportal_get_warming_session ~90

Get an Advanced Niche Warming session. Returns one Advanced Niche Warming session you own: status, per-term tasks (with 3-calendar-day dispatch in the manager's timezone, verification status, client report and proof video link), and the aggregated report on completion. Created tasks remain open until completed; they do not expire.

NameTypeReqDescription
idstringyesWarming session ID.

No output schema declared.

No examples provided.

tokportal_get_webhook_endpoint ~61

Get a webhook endpoint. Returns one webhook endpoint's URL, subscribed events and enabled state. The signing secret is not returned; if you lost it, delete this endpoint and create a replacement.

NameTypeReqDescription
idstringyesWebhook endpoint ID.

No output schema declared.

No examples provided.

tokportal_import_bundle_videos_csv ~395

Import video slots from CSV. Uploads a CSV file, downloads the referenced media, and configures the available video slots. Partial success: this call returns HTTP 200 even when some or all rows are rejected. Read `imported`, `results` and `errors[]` and never infer success from the status code — rows breaking the 3-videos-per-day cap or the minimum lead time fail individually while the rest succeed. An `auto_publish` failure never fails the request; inspect `auto_publish.blockers`, and `auto_publish.adjusted_videos` when a stale date was moved forward at publish time. The date column is `target_publish_start_date` (note the name: the JSON endpoints call the same value `target_publish_date`) and it is the FIRST day of a 2-day window — the end is derived as that day + 1, so a `target_publish_end_date` column is refused with CSV_PARSE_ERROR rather than dropped. `auto_publish` is a form field on the multipart body and covers the whole import. Coverage is checked before TokPortal fetches or stores any referenced media. Requires active TokPortal Coverage on the resolved saved account, or permanent grandfathering: a due period renews automatically at the account's stored rate immediately before execution, and nothing starts if it cannot renew. See getAccountManagedSubscription.

NameTypeReqDescription
auto_publishboolean–Multipart form field auto_publish.
dry_runboolean–Simulate this call: full validation and the real price, but nothing is created, no credits are debited, and no Idempotency-Key is consumed. Returned identifiers are synthetic and only usable in other…
file_pathstringyesLocal path to upload for multipart field file.
idstringyesBundle ID.
idempotency_keystring–Optional Idempotency-Key header for safe retries.

No output schema declared.

No examples provided.

tokportal_list_account_bans ~410

List ban reports and appeals. Pollable list of validated ban reports for the caller's delivered accounts, covering the whole lifecycle: appeal_pending (platform appeal filed, account unavailable but NOT yet banned), appeal_accepted (account survived), appeal_refused / no_appeal_banned (confirmed ban), and the staff commercial resolution (refund / remake / no_remake with a machine-readable reason_code such as tos_ban). While a report is appeal_pending, do NOT order a replacement account: a duplicate can trigger a ban-evasion strike on the platform, which is why TokPortal itself waits for the appeal. Key your reports on bundle_id — account_id can be null after a staff reset. A resolution of refund returns setup, warming and unused video slots, but not work already delivered and not the Coverage period, and the restored credits expire 60 days after restoration (see the credits.restored event in listWebhookEvents). This is the REST counterpart of the account.banned, account.ban_appeal.submitted, account.ban_appeal.resolved and account.ban_resolution.decided webhook events. Only staff/CM-validated bans appear here — detections from TokPortal's internal health scan are never listed. Poll with the since parameter (updated_at watermark) to pick up new reports and status changes.

NameTypeReqDescription
account_idstring–Filter by saved account ID.
include_screenshotsstring–When true, each report includes a signed 7-day URL of the ban-evidence screenshot when one exists.
pageinteger–Page number.
per_pageinteger–Items per page.
resolutionstring–Filter by staff commercial resolution. 'pending' selects confirmed bans still awaiting the staff decision.
sincestring–Only reports updated at or after this ISO 8601 timestamp. Use the highest updated_at you have seen as a polling watermark.
statusstring–Filter by appeal lifecycle status.

No output schema declared.

No examples provided.

tokportal_list_account_bundles ~91

List bundles for a delivered account. Lists every bundle attached to one delivered account, including cancelled ones. Use it to see an account's full order history before ordering more work on it.

NameTypeReqDescription
idstringyesSaved account ID.
pageinteger–Page number.
per_pageinteger–Items per page.
statusstring–Filter by bundle status.

No output schema declared.

No examples provided.

tokportal_list_account_video_analytics ~151

List post analytics for an account. Post-level analytics for one account, sortable by views, likes, engagement rate or upload date. Values are lifetime per-post totals. Call getAnalyticsContract before interpreting these numbers: top-line values are lifetime per-post totals, connected-account values are rolling windows, the two intentionally do not mirror each other, and your access tier may redact metrics — a missing field means unavailable, never zero.

NameTypeReqDescription
idstringyesSaved account ID.
pageinteger–Page number.
per_pageinteger–Items per page.
sort_bystring–query parameter sort_by
sort_orderstring–query parameter sort_order

No output schema declared.

No examples provided.

Install

How do I install the TokPortal MCP server?

TokPortal runs locally as an npm package, launched with npx -y tokportal-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · tokportal-mcp

# add to Claude Code
claude mcp add com-tokportal-mcp -- npx -y tokportal-mcp
Common questions

What is the TokPortal MCP server?

TokPortal is an MCP server listed in the public MCP registry as com.tokportal/mcp. Managed TikTok/Instagram/YouTube accounts + video posting at scale, operated by human managers. This page covers its npm package (tokportal-mcp).

Is the TokPortal MCP server safe to use?

TokPortal scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the TokPortal MCP server expose?

TokPortal exposes 92 tools: tokportal_get_current_user, tokportal_update_current_user_settings, tokportal_get_account_managed_subscription, tokportal_reactivate_account_managed_subscription, tokportal_cancel_account_managed_subscription, and 87 more. Their descriptions and schemas cost roughly 18,281 tokens of context every time the server is loaded.

Is the TokPortal MCP server still maintained?

TokPortal is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the TokPortal MCP server under?

TokPortal declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.