ViralCat
REMOTE · VIRAL-CAT.COM
Schedule and publish social posts across platforms, with drafts, media uploads and analytics.
Available components
Last scanned (18 hours ago)
Scores higher than 97% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3683 tokens (~175/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
- Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 76% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 −1
- Stability: pass → 0.97 functional
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
- 3 Nov 26 0
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
- 2 Nov 26 0
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
- 1 Nov 26 0
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
- 31 Oct 26 0
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
- 30 Oct 26 0
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
- 29 Oct 26 0
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
- 28 Oct 26 +1
- Stability: 0.97 → pass security
- This server's schema is too large to store in full, so we cannot compare its tools day to day functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://viral-cat.com/api/mcp/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=viral-cat.com | CN=YR2,O=Let's Encrypt,C=US | 17 Sept 2026 | 16 Dec 2026 | RSA 2048 | SHA256-RSA | 52761b58c7c880acdb6346e63973fad4eb2 |
| SANs: viral-cat.com | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of viral-cat.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| viral-cat.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://viral-cat.com/.well-known/oauth-protected-resource"
Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://viral-cat.com/.well-known/oauth-protected-resource" | Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Protected resource metadata
| Document | https://viral-cat.com/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | No |
| Problem | metadata_http_error |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://viral-cat.com/api/mcp/mcp | Verified | 200 | |
| http (plaintext) | http://viral-cat.com/api/mcp/mcp | HTTPS enforced | 308 | https://viral-cat.com/api/mcp/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
campaign_summary ~85
Per-brand campaign rollup (brands are ViralCat's campaign unit): posted/scheduled/failed/draft counts, platforms used, next scheduled date, last posted date, and auto-post settings. Optionally scope to one brand_id.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | – | – |
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
No output schema declared.
No examples provided.
cancel_post ~191
WRITE (safe): cancel a queued post, or move it to a new slot. Omit scheduled_date to CANCEL (status -> cancelled; the publisher ignores it). Pass scheduled_date to RESCHEDULE to that time instead (ISO 8601, at least 15 minutes out; a draft keeps its draft status). Works on draft or scheduled posts (cancel or reschedule); also works on FAILED posts but cancel-only (omit scheduled_date) — this is the way to clear a dead failed-post backlog, since failed has no other exit. Posts already posting/posted/cancelled are immutable. Get post ids from content_queue, list_posts or diagnose_failures.
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | integer | yes | Post id to cancel or reschedule (from content_queue) |
| scheduled_date | string | – | Omit to cancel. Provide to reschedule: ISO 8601, at least 15 minutes in the future |
No output schema declared.
No examples provided.
content_queue ~74
The forward content pipeline: drafts awaiting approval first, then scheduled posts in publish order. Use to review what is queued before it goes out, and to find draft ids for schedule_post.
| Name | Type | Req | Description |
|---|---|---|---|
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
| limit | integer | – | – |
No output schema declared.
No examples provided.
create_brand ~174
WRITE (gated): create a brand (content profile) so create_draft and schedule_post have something to target. Every other write here needs a brand_id, so an agent had no way to set one up. Returns the brand_id and the Drive folder the publisher will read its media from (Viral-Cat/_Res/{name}/Vids). Publishes nothing and reaches no audience.
| Name | Type | Req | Description |
|---|---|---|---|
| content_type | string | – | What the publisher should expect to find for this brand. |
| cta_url | string | – | Link included in posts. |
| description | string | – | – |
| hashtags | array | – | Brand hashtags appended to captions unless skip_hashtags is set. |
| name | string | yes | Brand name. Also names its Drive media folder, so keep it filesystem-friendly. |
| website_url | string | – | – |
No output schema declared.
No examples provided.
create_draft ~290
WRITE (safe): create a DRAFT post for a brand. Drafts are never picked up by the publisher, so nothing goes live; a human approves in the dashboard or promotes it later with schedule_post. scheduled_date is a proposed slot (default: 7 days out).
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | yes | – |
| caption | string | – | Post body. Omit to inherit the brand's taglines. |
| platform | string | yes | Target platform, e.g. youtube, tiktok, instagram |
| reply_text | string | – | Follow-up reply posted under the main post. On X this is where a link belongs: a URL in the post body costs up to 94% of the reach (near-total on a non-Premium account), while the same URL one reply… |
| scheduled_date | string | – | Proposed ISO 8601 slot, e.g. 2026-07-15T09:00:00Z |
| skip_hashtags | boolean | – | true = publish the caption as-is with NO brand hashtags appended; false = always append them. Omit to auto-detect: long hand-authored captions (>280 chars, no '#') skip hashtags. The result's hashtag… |
No output schema declared.
No examples provided.
create_media_upload ~301
WRITE (gated): open a Google Drive upload session for media you hold locally, so a clip rendered on your own machine never has to be published publicly just so ViralCat can fetch it back. Returns an uploadUrl - PUT the bytes to it yourself (no auth header) and Drive stores the file; the response Location/id is the fileId for create_draft or schedule_post. When brand is given the file lands in the folder the generator actually reads for that media type: Viral-Cat/_Res/{brand}/Imgs for an image, Vids for a video, Music for audio. Without brand it defaults to the Viral-Cat folder. Video, image or audio up to 100MB. Publishes nothing and reaches no audience.
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | Brand whose _Res/{brand} folder should receive the file. Ignored when folder_id is given. |
| file_name | string | yes | Name to save as in Drive, e.g. "ducktax-short.mp4". |
| folder_id | string | – | Destination Drive folder id, overriding brand. |
| kind | string | – | Which brand folder receives the file: Vids, Imgs or Music. Omit to route by media type, which is almost always right. |
| mime_type | string | yes | Media type of the file, e.g. "video/mp4". |
| size_bytes | integer | yes | Exact byte length of the file. Drive rejects a mismatch. |
No output schema declared.
No examples provided.
diagnose_failures ~122
Group failed posts by platform + normalized failure reason: counts, date range, affected brands, a sample raw error, a recoverable flag (retry_failed_posts can re-queue it) and a concrete suggested fix per group. Answers "what is broken and why" in one call. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| days | integer | – | Rolling window of failed posts to analyze |
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
| platform | string | – | Scope to a single platform, e.g. pinterest |
No output schema declared.
No examples provided.
get_brand_details ~97
Full content profile for one brand: description, taglines, hashtags, CTA/website URL, niche (category/subcategory), content type, target platforms, and active discount. Use this to write on-brand captions BEFORE calling create_draft or schedule_post. Read-only; returns no secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | yes | – |
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
No output schema declared.
No examples provided.
get_pipeline_summary ~90
High-level snapshot of the posting pipeline: active brand count, a status breakdown (how many scheduled/posted/failed/etc.), a per-platform breakdown, how many posts are due in the next 7 days, and the next scheduled date. Use for 'how's the pipeline?' style questions.
| Name | Type | Req | Description |
|---|---|---|---|
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
No output schema declared.
No examples provided.
list_brands ~130
List brands (content profiles), newest first, with per-brand post counts (posted/scheduled) and the next scheduled date. Use to see which brands exist and how active each is. Excludes archived brands. Returns `total` (all active brands) next to `count` (rows returned): when `truncated` is true the roster was cut off by `limit`, so raise it (max 50) before concluding a brand does not exist.
| Name | Type | Req | Description |
|---|---|---|---|
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
| limit | integer | – | – |
No output schema declared.
No examples provided.
list_connections ~79
List connected platform accounts (channels) and their health: platform, account username, connected flag, posting-enabled flag, and token expiry. Use to check which platforms are wired up and whether any connection has expired. Never returns access or refresh tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
No output schema declared.
No examples provided.
list_posts ~143
List posts across all platforms, newest scheduled first. Each row is one publication on one platform. Filter by status (draft|scheduled|posting|posted|failed|cancelled) and/or platform (youtube|tiktok|instagram|...). Returns caption, brand name, permalink, error message when present, and publishWarning for posts that succeeded with an anomaly (e.g. published without media).
| Name | Type | Req | Description |
|---|---|---|---|
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
| limit | integer | – | – |
| platform | string | – | Filter to a single platform, e.g. youtube or tiktok |
| status | string | – | – |
No output schema declared.
No examples provided.
post_performance ~145
Publish-outcome metrics over a rolling window (default 30 days): posted/failed/cancelled totals, success rate, per-platform breakdown, and the most recent published posts with permalinks plus their latest stored engagement snapshot (views/likes/comments/shares; available for youtube/tiktok/twitter/threads). Snapshots are stored, not live: call refresh_post_metrics first if the numbers must be current. Optionally scope by brand_id and/or platform.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | – | – |
| days | integer | – | – |
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
| platform | string | – | – |
No output schema declared.
No examples provided.
preflight_check ~250
READ-ONLY: validate a post BEFORE it is scheduled or published, so a problem is caught up front instead of discovered as a failure afterwards. Checks the exact things that produced the failed-post backlog: incompatible media for the platform (e.g. video to Pinterest), a disconnected or unrefreshable platform token (LinkedIn has no refresh token on this API tier and needs a manual browser reconnect roughly every 60 days — that's an expected state, not a bug), Facebook posting to an account with no Page (impossible via the Graph API), content referencing an already-passed date/season/promo code, and X/Twitter free-tier monthly write-cap headroom. Pass post_id to check one existing post; omit it to scan the forward queue (draft + scheduled, soonest first) and return only posts that have at least one issue.
| Name | Type | Req | Description |
|---|---|---|---|
| include_samples | boolean | – | Include sample users (email contains "sample"). Default: real data only. |
| limit | integer | – | Queue-scan mode only: how many upcoming posts to check. |
| post_id | integer | – | Check one existing post (id from list_posts or content_queue). Omit to scan the whole upcoming queue instead. |
No output schema declared.
No examples provided.
reconnect_platform ~123
WRITE (safe): attempt a server-side token refresh for a platform whose access token has lapsed, updating the stored connection's token/expiry. Works without a browser when a refresh token is on file (twitter/youtube/google_drive self-heal this way); returns needsManualReauth + a dashboard link when the platform genuinely requires a manual browser reconnect (e.g. threads). Cannot publish or touch content, only refreshes credentials; safe to retry. Never exposes tokens.
| Name | Type | Req | Description |
|---|---|---|---|
| platform | string | yes | Platform to reconnect, e.g. twitter, youtube, google_drive |
No output schema declared.
No examples provided.
refresh_post_metrics ~142
WRITE (gated): fetch current engagement (views/likes/comments/shares) for already-published posts and store today's snapshot, then read it back with post_performance. This is the only way to update the numbers without opening the dashboard Stats tab. Supported platforms: youtube, tiktok, twitter, threads; LinkedIn and the rest expose no engagement API. A 60-minute cooldown applies per account and protects X's free-tier read quota, so a call inside it returns skipped:true and changes nothing. Publishes nothing and reaches no audience.
| Name | Type | Req | Description |
|---|---|---|---|
| include_samples | boolean | – | Include sample users. Default false: real accounts only, matching every read tool. |
No output schema declared.
No examples provided.
reschedule_post ~134
WRITE (gated): move ONE post to a new future slot (ISO 8601, at least 15 minutes out). Unlike cancel_post this also accepts FAILED posts: a failed post is re-queued (status -> scheduled, error cleared). Draft and scheduled posts keep their status. Refuses posts that would structurally fail again (archived brand, incompatible media, Facebook with no Page).
| Name | Type | Req | Description |
|---|---|---|---|
| post_id | integer | yes | Post id (from list_posts, content_queue or diagnose_failures) |
| scheduled_date | string | yes | New slot, ISO 8601, at least 15 minutes in the future |
No output schema declared.
No examples provided.
retry_failed_posts ~252
WRITE (gated): bulk re-queue recoverable failed posts (default reason classes: token_expired, missed_window, platform_transient_error, drive_media_missing). dry_run DEFAULTS TO TRUE and only returns the plan; pass dry_run=false to actually reschedule. Retries are staggered per platform (spacing_minutes apart) and capped at limit, so a bulk retry cannot dogpile a platform API. Posts that would structurally fail again (archived brand, incompatible media, Facebook with no Page) are skipped with the reason. Use diagnose_failures first to see what is recoverable.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | true = plan only, change nothing (the default) |
| limit | integer | – | – |
| platform | string | – | Scope to a single platform |
| reasons | array | – | Failure reason classes to retry. Default: token_expired, missed_window, platform_transient_error, drive_media_missing. Non-retryable classes are rejected. |
| spacing_minutes | integer | – | Gap between retries on the same platform |
| start_at | string | – | ISO 8601 start of the retry window, at least 15 minutes out. Default: ~20 minutes from now. |
No output schema declared.
No examples provided.
schedule_post ~286
WRITE (gated): queue a post for FUTURE publishing, at least 15 minutes out (immediate posting is not available over MCP). Either pass post_id to promote an existing draft, or brand_id + platform to create a new scheduled post. The publishing cron sends it at the scheduled time.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_id | string | – | – |
| caption | string | – | – |
| platform | string | – | – |
| post_id | integer | – | Draft post id to promote (from content_queue) |
| reply_text | string | – | Follow-up reply posted under the main post. On X this is where a link belongs: a URL in the post body costs up to 94% of the reach (near-total on a non-Premium account), while the same URL one reply… |
| scheduled_date | string | yes | ISO 8601, at least 15 minutes in the future |
| skip_hashtags | boolean | – | true = publish the caption as-is with NO brand hashtags appended; false = always append them. Omit to auto-detect: long hand-authored captions (>280 chars, no '#') skip hashtags. When promoting a dra… |
No output schema declared.
No examples provided.
update_brand ~311
WRITE (gated): correct a brand's content profile: description, taglines, hashtags, CTA and website links, content type, and the auto-post switch. This is the repair path for a brand carrying wrong copy, which otherwise makes every caption for it wrong, and the off switch for a brand whose generator is posting against your content rules. Only the fields you pass change; the rest keep their stored values. Cannot rename a brand (the name also names its Drive media folder) and cannot touch posting frequency/day or discount settings. Queues nothing and publishes nothing itself.
| Name | Type | Req | Description |
|---|---|---|---|
| auto_post_enabled | boolean | – | false = stop the content generator booking posts for this brand from its next cycle; true = let it resume. This is the only way to stop a brand auto-posting without opening the dashboard. Already-sch… |
| brand_id | string | yes | – |
| content_type | string | – | What the publisher should expect to find for this brand. |
| cta_url | string | – | Link included in posts. Pass an empty string to clear it. |
| description | string | – | What the product actually is. The generator writes captions from this, so a wrong description makes every post wrong. |
| hashtags | array | – | Brand hashtags appended to captions unless skip_hashtags is set. |
| taglines | array | – | Short lines the publisher rotates through when a post has no caption of its own. |
| website_url | string | – | – |
No output schema declared.
No examples provided.
upload_media ~264
WRITE (gated): fetch a public media URL and store it in the connected Google Drive, returning the Drive fileId to pass to create_draft or schedule_post. This uploads to YOUR OWN Drive; it publishes nothing and reaches no audience. Accepts video, image or audio up to 100MB. With brand, files land in the folder the generator actually reads for that media type: Viral-Cat/_Res/{brand}/Imgs for an image, Vids for a video, Music for audio. Without brand it defaults to the Viral-Cat folder, and folder_id overrides both.
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | Brand whose _Res/{brand} folder should receive the file. Ignored when folder_id is given. |
| file_name | string | – | Name to save as. Omit to take it from the URL. |
| folder_id | string | – | Destination Drive folder id, overriding brand. Omit to use the Viral-Cat folder. |
| kind | string | – | Which brand folder receives the file: Vids, Imgs or Music. Omit to route by media type, which is almost always right. |
| source_url | string | yes | Public https URL of the media to store, e.g. a rendered Short. Must be reachable without auth. |
No output schema declared.
No examples provided.
How do I install the ViralCat MCP server?
ViralCat is a hosted endpoint at https://viral-cat.com/api/mcp/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · viral-cat.com
claude mcp add --transport http com-viral-cat-viral-cat 'https://viral-cat.com/api/mcp/mcp'
What is the ViralCat MCP server?
ViralCat is an MCP server listed in the public MCP registry as com.viral-cat/viral-cat. Schedule and publish social posts across platforms, with drafts, media uploads and analytics. This page covers its hosted endpoint (https://viral-cat.com/api/mcp/mcp).
Is the ViralCat MCP server safe to use?
ViralCat scores 89 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ViralCat MCP server expose?
ViralCat exposes 21 tools: list_brands, get_brand_details, list_posts, get_pipeline_summary, list_connections, and 16 more. Their descriptions and schemas cost roughly 3,683 tokens of context every time the server is loaded.
Does the ViralCat MCP server require authentication?
Yes. ViralCat asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the ViralCat MCP server still maintained?
ViralCat is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.