Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ViralCat

REMOTE · VIRAL-CAT.COM

Schedule and publish social posts across platforms, with drafts, media uploads and analytics.

Available components

−1 this week 89 Trust /100

Last scanned (18 hours ago)

Scores higher than 97% of remote servers

Reachable. Last reached 4 Nov 2026.

Category Marketing and SEO

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security89
Transport & Reachability100
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3683 tokens (~175/item across 21 items; 21 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management97
  • Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 76% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 21 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 −1
    • Stability: pass → 0.97 functional
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 3 Nov 26 0
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 2 Nov 26 0
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 1 Nov 26 0
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 31 Oct 26 0
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 30 Oct 26 0
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 29 Oct 26 0
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
  • 28 Oct 26 +1
    • Stability: 0.97 → pass security
    • This server's schema is too large to store in full, so we cannot compare its tools day to day functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Probed https://viral-cat.com/api/mcp/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=viral-cat.com CN=YR2,O=Let's Encrypt,C=US 17 Sept 2026 16 Dec 2026 RSA 2048 SHA256-RSA 52761b58c7c880acdb6346e63973fad4eb2
SANs: viral-cat.com
CN=YR2,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA 4ebd24947e24d394802d84a52fd5b319
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of viral-cat.com. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
viral-cat.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Challenged, unverified

The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.

Result Challenged, unverified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://viral-cat.com/.well-known/oauth-protected-resource"

Bearer error="invalid_token", error_description="No authorization provided", resource_metadata="https://viral-cat.com/.well-known/oauth-protected-resource"
Header Value
strict-transport-security max-age=63072000; includeSubDomains; preload
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin
permissions-policy camera=(), microphone=(), geolocation=()

Protected resource metadata

Document https://viral-cat.com/.well-known/oauth-protected-resource
Retrieved No
Problem metadata_http_error

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://viral-cat.com/api/mcp/mcp Verified 200
http (plaintext) http://viral-cat.com/api/mcp/mcp HTTPS enforced 308 https://viral-cat.com/api/mcp/mcp
MCP tools · 21 exposed · ~3,683 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
campaign_summary ~85

Per-brand campaign rollup (brands are ViralCat's campaign unit): posted/scheduled/failed/draft counts, platforms used, next scheduled date, last posted date, and auto-post settings. Optionally scope to one brand_id.

NameTypeReqDescription
brand_idstring––
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.

No output schema declared.

No examples provided.

cancel_post ~191

WRITE (safe): cancel a queued post, or move it to a new slot. Omit scheduled_date to CANCEL (status -> cancelled; the publisher ignores it). Pass scheduled_date to RESCHEDULE to that time instead (ISO 8601, at least 15 minutes out; a draft keeps its draft status). Works on draft or scheduled posts (cancel or reschedule); also works on FAILED posts but cancel-only (omit scheduled_date) — this is the way to clear a dead failed-post backlog, since failed has no other exit. Posts already posting/posted/cancelled are immutable. Get post ids from content_queue, list_posts or diagnose_failures.

NameTypeReqDescription
post_idintegeryesPost id to cancel or reschedule (from content_queue)
scheduled_datestring–Omit to cancel. Provide to reschedule: ISO 8601, at least 15 minutes in the future

No output schema declared.

No examples provided.

content_queue ~74

The forward content pipeline: drafts awaiting approval first, then scheduled posts in publish order. Use to review what is queued before it goes out, and to find draft ids for schedule_post.

NameTypeReqDescription
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.
limitinteger––

No output schema declared.

No examples provided.

create_brand ~174

WRITE (gated): create a brand (content profile) so create_draft and schedule_post have something to target. Every other write here needs a brand_id, so an agent had no way to set one up. Returns the brand_id and the Drive folder the publisher will read its media from (Viral-Cat/_Res/{name}/Vids). Publishes nothing and reaches no audience.

NameTypeReqDescription
content_typestring–What the publisher should expect to find for this brand.
cta_urlstring–Link included in posts.
descriptionstring––
hashtagsarray–Brand hashtags appended to captions unless skip_hashtags is set.
namestringyesBrand name. Also names its Drive media folder, so keep it filesystem-friendly.
website_urlstring––

No output schema declared.

No examples provided.

create_draft ~290

WRITE (safe): create a DRAFT post for a brand. Drafts are never picked up by the publisher, so nothing goes live; a human approves in the dashboard or promotes it later with schedule_post. scheduled_date is a proposed slot (default: 7 days out).

NameTypeReqDescription
brand_idstringyes–
captionstring–Post body. Omit to inherit the brand's taglines.
platformstringyesTarget platform, e.g. youtube, tiktok, instagram
reply_textstring–Follow-up reply posted under the main post. On X this is where a link belongs: a URL in the post body costs up to 94% of the reach (near-total on a non-Premium account), while the same URL one reply…
scheduled_datestring–Proposed ISO 8601 slot, e.g. 2026-07-15T09:00:00Z
skip_hashtagsboolean–true = publish the caption as-is with NO brand hashtags appended; false = always append them. Omit to auto-detect: long hand-authored captions (>280 chars, no '#') skip hashtags. The result's hashtag…

No output schema declared.

No examples provided.

create_media_upload ~301

WRITE (gated): open a Google Drive upload session for media you hold locally, so a clip rendered on your own machine never has to be published publicly just so ViralCat can fetch it back. Returns an uploadUrl - PUT the bytes to it yourself (no auth header) and Drive stores the file; the response Location/id is the fileId for create_draft or schedule_post. When brand is given the file lands in the folder the generator actually reads for that media type: Viral-Cat/_Res/{brand}/Imgs for an image, Vids for a video, Music for audio. Without brand it defaults to the Viral-Cat folder. Video, image or audio up to 100MB. Publishes nothing and reaches no audience.

NameTypeReqDescription
brandstring–Brand whose _Res/{brand} folder should receive the file. Ignored when folder_id is given.
file_namestringyesName to save as in Drive, e.g. "ducktax-short.mp4".
folder_idstring–Destination Drive folder id, overriding brand.
kindstring–Which brand folder receives the file: Vids, Imgs or Music. Omit to route by media type, which is almost always right.
mime_typestringyesMedia type of the file, e.g. "video/mp4".
size_bytesintegeryesExact byte length of the file. Drive rejects a mismatch.

No output schema declared.

No examples provided.

diagnose_failures ~122

Group failed posts by platform + normalized failure reason: counts, date range, affected brands, a sample raw error, a recoverable flag (retry_failed_posts can re-queue it) and a concrete suggested fix per group. Answers "what is broken and why" in one call. Read-only.

NameTypeReqDescription
daysinteger–Rolling window of failed posts to analyze
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.
platformstring–Scope to a single platform, e.g. pinterest

No output schema declared.

No examples provided.

get_brand_details ~97

Full content profile for one brand: description, taglines, hashtags, CTA/website URL, niche (category/subcategory), content type, target platforms, and active discount. Use this to write on-brand captions BEFORE calling create_draft or schedule_post. Read-only; returns no secrets.

NameTypeReqDescription
brand_idstringyes–
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.

No output schema declared.

No examples provided.

get_pipeline_summary ~90

High-level snapshot of the posting pipeline: active brand count, a status breakdown (how many scheduled/posted/failed/etc.), a per-platform breakdown, how many posts are due in the next 7 days, and the next scheduled date. Use for 'how's the pipeline?' style questions.

NameTypeReqDescription
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.

No output schema declared.

No examples provided.

list_brands ~130

List brands (content profiles), newest first, with per-brand post counts (posted/scheduled) and the next scheduled date. Use to see which brands exist and how active each is. Excludes archived brands. Returns `total` (all active brands) next to `count` (rows returned): when `truncated` is true the roster was cut off by `limit`, so raise it (max 50) before concluding a brand does not exist.

NameTypeReqDescription
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.
limitinteger––

No output schema declared.

No examples provided.

list_connections ~79

List connected platform accounts (channels) and their health: platform, account username, connected flag, posting-enabled flag, and token expiry. Use to check which platforms are wired up and whether any connection has expired. Never returns access or refresh tokens.

NameTypeReqDescription
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.

No output schema declared.

No examples provided.

list_posts ~143

List posts across all platforms, newest scheduled first. Each row is one publication on one platform. Filter by status (draft|scheduled|posting|posted|failed|cancelled) and/or platform (youtube|tiktok|instagram|...). Returns caption, brand name, permalink, error message when present, and publishWarning for posts that succeeded with an anomaly (e.g. published without media).

NameTypeReqDescription
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.
limitinteger––
platformstring–Filter to a single platform, e.g. youtube or tiktok
statusstring––

No output schema declared.

No examples provided.

post_performance ~145

Publish-outcome metrics over a rolling window (default 30 days): posted/failed/cancelled totals, success rate, per-platform breakdown, and the most recent published posts with permalinks plus their latest stored engagement snapshot (views/likes/comments/shares; available for youtube/tiktok/twitter/threads). Snapshots are stored, not live: call refresh_post_metrics first if the numbers must be current. Optionally scope by brand_id and/or platform.

NameTypeReqDescription
brand_idstring––
daysinteger––
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.
platformstring––

No output schema declared.

No examples provided.

preflight_check ~250

READ-ONLY: validate a post BEFORE it is scheduled or published, so a problem is caught up front instead of discovered as a failure afterwards. Checks the exact things that produced the failed-post backlog: incompatible media for the platform (e.g. video to Pinterest), a disconnected or unrefreshable platform token (LinkedIn has no refresh token on this API tier and needs a manual browser reconnect roughly every 60 days — that's an expected state, not a bug), Facebook posting to an account with no Page (impossible via the Graph API), content referencing an already-passed date/season/promo code, and X/Twitter free-tier monthly write-cap headroom. Pass post_id to check one existing post; omit it to scan the forward queue (draft + scheduled, soonest first) and return only posts that have at least one issue.

NameTypeReqDescription
include_samplesboolean–Include sample users (email contains "sample"). Default: real data only.
limitinteger–Queue-scan mode only: how many upcoming posts to check.
post_idinteger–Check one existing post (id from list_posts or content_queue). Omit to scan the whole upcoming queue instead.

No output schema declared.

No examples provided.

reconnect_platform ~123

WRITE (safe): attempt a server-side token refresh for a platform whose access token has lapsed, updating the stored connection's token/expiry. Works without a browser when a refresh token is on file (twitter/youtube/google_drive self-heal this way); returns needsManualReauth + a dashboard link when the platform genuinely requires a manual browser reconnect (e.g. threads). Cannot publish or touch content, only refreshes credentials; safe to retry. Never exposes tokens.

NameTypeReqDescription
platformstringyesPlatform to reconnect, e.g. twitter, youtube, google_drive

No output schema declared.

No examples provided.

refresh_post_metrics ~142

WRITE (gated): fetch current engagement (views/likes/comments/shares) for already-published posts and store today's snapshot, then read it back with post_performance. This is the only way to update the numbers without opening the dashboard Stats tab. Supported platforms: youtube, tiktok, twitter, threads; LinkedIn and the rest expose no engagement API. A 60-minute cooldown applies per account and protects X's free-tier read quota, so a call inside it returns skipped:true and changes nothing. Publishes nothing and reaches no audience.

NameTypeReqDescription
include_samplesboolean–Include sample users. Default false: real accounts only, matching every read tool.

No output schema declared.

No examples provided.

reschedule_post ~134

WRITE (gated): move ONE post to a new future slot (ISO 8601, at least 15 minutes out). Unlike cancel_post this also accepts FAILED posts: a failed post is re-queued (status -> scheduled, error cleared). Draft and scheduled posts keep their status. Refuses posts that would structurally fail again (archived brand, incompatible media, Facebook with no Page).

NameTypeReqDescription
post_idintegeryesPost id (from list_posts, content_queue or diagnose_failures)
scheduled_datestringyesNew slot, ISO 8601, at least 15 minutes in the future

No output schema declared.

No examples provided.

retry_failed_posts ~252

WRITE (gated): bulk re-queue recoverable failed posts (default reason classes: token_expired, missed_window, platform_transient_error, drive_media_missing). dry_run DEFAULTS TO TRUE and only returns the plan; pass dry_run=false to actually reschedule. Retries are staggered per platform (spacing_minutes apart) and capped at limit, so a bulk retry cannot dogpile a platform API. Posts that would structurally fail again (archived brand, incompatible media, Facebook with no Page) are skipped with the reason. Use diagnose_failures first to see what is recoverable.

NameTypeReqDescription
dry_runboolean–true = plan only, change nothing (the default)
limitinteger––
platformstring–Scope to a single platform
reasonsarray–Failure reason classes to retry. Default: token_expired, missed_window, platform_transient_error, drive_media_missing. Non-retryable classes are rejected.
spacing_minutesinteger–Gap between retries on the same platform
start_atstring–ISO 8601 start of the retry window, at least 15 minutes out. Default: ~20 minutes from now.

No output schema declared.

No examples provided.

schedule_post ~286

WRITE (gated): queue a post for FUTURE publishing, at least 15 minutes out (immediate posting is not available over MCP). Either pass post_id to promote an existing draft, or brand_id + platform to create a new scheduled post. The publishing cron sends it at the scheduled time.

NameTypeReqDescription
brand_idstring––
captionstring––
platformstring––
post_idinteger–Draft post id to promote (from content_queue)
reply_textstring–Follow-up reply posted under the main post. On X this is where a link belongs: a URL in the post body costs up to 94% of the reach (near-total on a non-Premium account), while the same URL one reply…
scheduled_datestringyesISO 8601, at least 15 minutes in the future
skip_hashtagsboolean–true = publish the caption as-is with NO brand hashtags appended; false = always append them. Omit to auto-detect: long hand-authored captions (>280 chars, no '#') skip hashtags. When promoting a dra…

No output schema declared.

No examples provided.

update_brand ~311

WRITE (gated): correct a brand's content profile: description, taglines, hashtags, CTA and website links, content type, and the auto-post switch. This is the repair path for a brand carrying wrong copy, which otherwise makes every caption for it wrong, and the off switch for a brand whose generator is posting against your content rules. Only the fields you pass change; the rest keep their stored values. Cannot rename a brand (the name also names its Drive media folder) and cannot touch posting frequency/day or discount settings. Queues nothing and publishes nothing itself.

NameTypeReqDescription
auto_post_enabledboolean–false = stop the content generator booking posts for this brand from its next cycle; true = let it resume. This is the only way to stop a brand auto-posting without opening the dashboard. Already-sch…
brand_idstringyes–
content_typestring–What the publisher should expect to find for this brand.
cta_urlstring–Link included in posts. Pass an empty string to clear it.
descriptionstring–What the product actually is. The generator writes captions from this, so a wrong description makes every post wrong.
hashtagsarray–Brand hashtags appended to captions unless skip_hashtags is set.
taglinesarray–Short lines the publisher rotates through when a post has no caption of its own.
website_urlstring––

No output schema declared.

No examples provided.

upload_media ~264

WRITE (gated): fetch a public media URL and store it in the connected Google Drive, returning the Drive fileId to pass to create_draft or schedule_post. This uploads to YOUR OWN Drive; it publishes nothing and reaches no audience. Accepts video, image or audio up to 100MB. With brand, files land in the folder the generator actually reads for that media type: Viral-Cat/_Res/{brand}/Imgs for an image, Vids for a video, Music for audio. Without brand it defaults to the Viral-Cat folder, and folder_id overrides both.

NameTypeReqDescription
brandstring–Brand whose _Res/{brand} folder should receive the file. Ignored when folder_id is given.
file_namestring–Name to save as. Omit to take it from the URL.
folder_idstring–Destination Drive folder id, overriding brand. Omit to use the Viral-Cat folder.
kindstring–Which brand folder receives the file: Vids, Imgs or Music. Omit to route by media type, which is almost always right.
source_urlstringyesPublic https URL of the media to store, e.g. a rendered Short. Must be reachable without auth.

No output schema declared.

No examples provided.

Install

How do I install the ViralCat MCP server?

ViralCat is a hosted endpoint at https://viral-cat.com/api/mcp/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · viral-cat.com

# add to Claude Code
claude mcp add --transport http com-viral-cat-viral-cat 'https://viral-cat.com/api/mcp/mcp'
Common questions

What is the ViralCat MCP server?

ViralCat is an MCP server listed in the public MCP registry as com.viral-cat/viral-cat. Schedule and publish social posts across platforms, with drafts, media uploads and analytics. This page covers its hosted endpoint (https://viral-cat.com/api/mcp/mcp).

Is the ViralCat MCP server safe to use?

ViralCat scores 89 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ViralCat MCP server expose?

ViralCat exposes 21 tools: list_brands, get_brand_details, list_posts, get_pipeline_summary, list_connections, and 16 more. Their descriptions and schemas cost roughly 3,683 tokens of context every time the server is loaded.

Does the ViralCat MCP server require authentication?

Yes. ViralCat asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the ViralCat MCP server still maintained?

ViralCat is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.