Skip to content

app.sprkly/sprkly

by sprkly.app · remote · no sign-in to list tools · v1.0.0 · published by app.sprkly

Schedule, publish and track social posts across TikTok, Instagram, Threads and YouTube Shorts.

Deletes · 1Final · 2Changes · 12

29 tools: 1 can delete or cancel things, 2 do something that can't be undone, 12 change things and 14 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http sprkly https://sprkly.app/api/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "sprkly_list_scheduled_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "sprkly_list_scheduled_posts" says "list": a word for reading.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

29 tools

Deletes or cancels 1Claude Code: deny
  • sprkly_delete_scheduled_postRemove a post from the queue.No findings

    Why it is in this group

    • The name "sprkly_delete_scheduled_post" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove a post from the queue. This is a soft delete. The user can restore it from the Deleted tab for 30 days. Posts that have already published cannot be deleted this way. Always confirm with the user before calling.

    Annotations the server declares

    • title: Delete a scheduled post
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 2Claude Code: ask
  • sprkly_reply_to_commentPost one public reply under an Instagram comment, from the account that got the comment.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "sprkly_reply_to_comment" says "reply": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "sprkly_reply_to_comment" says "reply": it sends or publishes something to other people.
    Description, as the server wrote it
    Post one public reply under an Instagram comment, from the account that got the comment. Everyone can see it and it cannot be taken back, so show the user the words first. Take comment_id from sprkly_get_inbox_thread. If the answer says Instagram did not confirm, do not send it again: tell the user to check the post. Needs inbox access.

    Annotations the server declares

    • title: Reply to a comment
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • sprkly_reply_to_dmSend one Instagram DM to a person who messaged this account, from the account owner.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "sprkly_reply_to_dm" says "reply": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "sprkly_reply_to_dm" says "reply": it sends or publishes something to other people.
    Description, as the server wrote it
    Send one Instagram DM to a person who messaged this account, from the account owner. It cannot be taken back, so show the user the words first. Instagram only allows it within 24 hours of their last message. Replying pauses automations for this person for 5 minutes, like replying in the app. If the answer says Instagram did not confirm, do not send it again: tell the user to check the chat. Needs inbox access.

    Annotations the server declares

    • title: Reply to a DM
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 12Claude Code: ask
  • sprkly_add_media_from_urlDownload an image or video from a public link into sprkly and get a media_id back, for reuse across several posts.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "sprkly_add_media_from_url" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Download an image or video from a public link into sprkly and get a media_id back, for reuse across several posts. You usually do NOT need this: sprkly_schedule_post accepts a link directly in media_urls and pulls it into storage itself whenever the target platform requires that. Reach for this tool only when the user wants one media_id to attach to more than one post. Google Drive and Dropbox share links are converted automatically; the file must be shared publicly. Limit 50 MB.

    Annotations the server declares

    • title: Add media from a URL
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sprkly_create_automation_from_templateSet up one ready-made automation on one Instagram account and turn it on.Reads text others writeNo findings

    Why it is in this group

    • The name "sprkly_create_automation_from_template" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Set up one ready-made automation on one Instagram account and turn it on. This is the same as Go live in the app. It starts replying to real people right away, so show the user the template, the account, the word and the link first. Pass template_id from sprkly_list_automation_templates and profile_id from sprkly_list_profiles. If asks_for has post, pass post_id: a published Instagram post on that account. If it does not, leave post_id out. If asks_for has link, pass a full https link. keyword is optional and defaults to the template's word. message is optional and replaces the DM, or the public reply on a template that only replies in the comments. The coupon template is refused until message holds the real code instead of YOUR-CODE. Use sprkly_pause_automation to stop it.

    Annotations the server declares

    • title: Set up an automation
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • sprkly_draft_postCompose a caption from a content hint and save it as a draft in sprkly, shaped to the tightest caption limit among the target platforms.Can send data outNo findings

    Why it is in this group

    • The name "sprkly_draft_post" says "post": a word for a change.

    What it can reach

    • outboundThe name "sprkly_draft_post" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Compose a caption from a content hint and save it as a draft in sprkly, shaped to the tightest caption limit among the target platforms. Returns a draft id; the draft appears under /drafts for the user to review.

    Annotations the server declares

    • title: Draft a post
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sprkly_export_automation_templateDownload one Instagram auto reply as a shareable template.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Download one Instagram auto reply as a shareable template. The file holds the trigger, the keyword and the message, and never a post id, a profile id or any account details, so it is safe to send to someone else. An auto reply that is still a draft has nothing published to export. Needs a connected Instagram account.

    Annotations the server declares

    • title: Export an auto reply template
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_import_automation_templateRead an auto reply template, and optionally set it up.No findings

    Why it is in this group

    • The name "sprkly_import_automation_template" says "import": a word for a change.
    Description, as the server wrote it
    Read an auto reply template, and optionally set it up. With no profile_id NOTHING is written: the template is checked and handed back, which is the safe first call. With a profile_id the automation is created, and it goes live when the trigger can be satisfied. A trigger that watches one post (a keyword on a post, or every comment on a post) needs post_id as well. Without one it saves as a draft that sends nothing until a post is chosen. A keyword on any post and a Profile DM need no post_id. A template that DMs every commenter on the whole account is turned off and is refused. Needs a connected Instagram account.

    Annotations the server declares

    • title: Import an auto reply template
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sprkly_list_scheduled_postsThe post queue, newest first, with a caption preview, targets, status and failure reason.Reads text others write1 finding

    Why it is in this group

    • The name "sprkly_list_scheduled_posts" says "list": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe name "sprkly_list_scheduled_posts" says "list" and "post": it reads posts, which other people can write.

    Findings

    • Warn

      The server marks "sprkly_list_scheduled_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "sprkly_list_scheduled_posts" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    The post queue, newest first, with a caption preview, targets, status and failure reason. Supports a status filter and cursor pagination.

    Annotations the server declares

    • title: List scheduled posts
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_pause_automationStop an automation from replying, on every account it runs on.No findings

    Why it is in this group

    • The description's first verb is "stop": a word for a change.
    Description, as the server wrote it
    Stop an automation from replying, on every account it runs on. Nothing is deleted. sprkly_resume_automation turns it back on. Any account that could not be changed is named in failed.

    Annotations the server declares

    • title: Pause an automation
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sprkly_request_post_approvalHold a draft or scheduled post for the owner's approval.Can send data outNo findings

    Why it is in this group

    • The name "sprkly_request_post_approval" says "request": a word for a change.

    What it can reach

    • outboundThe name "sprkly_request_post_approval" says "request" and "post": it writes something other people read.
    Description, as the server wrote it
    Hold a draft or scheduled post for the owner's approval. Moves it to pending_approval, where it never publishes on its own, emails the owner an Approve link, and returns an approval id to poll with sprkly_get_post_approval_status. Asking again for a post that is already waiting returns the same request. Approved posts go back to scheduled (a post past its time goes out in about 2 minutes); rejected posts become drafts with the owner's notes. To hold a NEW post, pass requires_approval to sprkly_schedule_post instead. Power plan only: other plans get upgrade_required.

    Annotations the server declares

    • title: Request human approval
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • sprkly_resume_automationTurn a paused automation back on, on every account it runs on.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Turn a paused automation back on, on every account it runs on. It starts replying to real people again. A draft has to be finished in sprkly first. An automation that hit its "stop after this many people" limit stays off.

    Annotations the server declares

    • title: Resume an automation
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • sprkly_schedule_postQueue a post for publishing, in ONE call.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "sprkly_schedule_post" says "schedule": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "sprkly_schedule_post" says "schedule" and "post": it writes something other people read.
    Description, as the server wrote it
    Queue a post for publishing, in ONE call. Attach media by passing the user's link straight to media_urls: sprkly downloads it into storage itself for the platforms that need that, so no upload tool has to run first. Runs the same quota, duplicate-content and platform pre-flight checks as the sprkly app. Instagram and TikTok require media at submission time; YouTube and TikTok require a title, and TikTok also requires platform_meta.tiktok.privacyLevel — just send the level the user asked for and this tool names the allowed values if it is not one of them. It reads the real bytes of the media and the response says what will actually publish on each platform (a Reel, a 3-slide carousel, a photo set, a Page feed video) plus anything worth passing on: relay that to the user. Confirm the date, time and target accounts with the user first. If a target platform has more than one connected account and profile_ids is not given, the tool returns needsAccountChoice with the options instead of scheduling — put that choice to the user, then re-call.

    Annotations the server declares

    • title: Schedule a post
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • sprkly_update_scheduled_postChange the caption, publish time, target accounts or attached media on a post that has not published yet.Can send data outNo findings

    Why it is in this group

    • The name "sprkly_update_scheduled_post" says "update": a word for a change.

    What it can reach

    • outboundThe name "sprkly_update_scheduled_post" says "update" and "post": it writes something other people read.
    Description, as the server wrote it
    Change the caption, publish time, target accounts or attached media on a post that has not published yet. Posts with status "scheduled", "pending_approval" or "draft" can be edited, and the status never changes here: editing a post that waits for approval does not approve it, and a rejected post stays a draft until you request approval again. A post waiting for approval can only target one account.

    Annotations the server declares

    • title: Reschedule or edit a post
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sprkly_upload_mediaUpload files the user has on their machine (slides, photos, a short video) into sprkly and get a media_id for each.No findings

    Why it is in this group

    • The name "sprkly_upload_media" says "upload": a word for a change.
    Description, as the server wrote it
    Upload files the user has on their machine (slides, photos, a short video) into sprkly and get a media_id for each. LINK MODE is the way to send a file from disk. Send files, one entry per file with its filename, sha256 and size_bytes. You get back one uploadUrl per file. PUT the bytes to it: curl -sS -X PUT --data-binary @01.jpg "<uploadUrl>". Each PUT answers JSON with mediaId. Links last 15 minutes. Up to 50 MB per file and 35 files per call. The bytes never pass through you, so a whole carousel costs a few hundred tokens. INLINE MODE is for tiny files only (a few KB): data_base64 plus filename, 25 MB at most. base64 costs about one token per character, so never inline a real slide. When files is sent, data_base64 and filename are ignored. For a public link use media_urls on sprkly_schedule_post instead. The same bytes sent twice return the same media_id.

    Annotations the server declares

    • title: Upload a file as media
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 14Claude Code: allow
  • sprkly_get_account_summaryPlan tier, trial state, connected account count, scheduled post counts by status, and the next three upcoming posts.Reads text others writeNo findings

    Why it is in this group

    • The name "sprkly_get_account_summary" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Plan tier, trial state, connected account count, scheduled post counts by status, and the next three upcoming posts. Never returns tokens or secrets.

    Annotations the server declares

    • title: Get account summary
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_get_analyticsHow the user's published posts actually performed: total views and engagement, week-on-week / month-on-month / year-on-year change, their best posting hour, weekday and content cat…Reads text others writeNo findings

    Why it is in this group

    • The name "sprkly_get_analytics" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    How the user's published posts actually performed: total views and engagement, week-on-week / month-on-month / year-on-year change, their best posting hour, weekday and content category, and the top posts behind those numbers. Every recommendation carries a `samples` count — say how thin the evidence is rather than presenting a one-post pattern as a finding. Every period-on-period percentage carries the post counts and raw totals it came from: quote those, because a big percentage off a tiny base is not a big change. `topPosts` is grouped by platform and ranked only inside each group; `relativeToPlatformBest` compares a post with others on its OWN platform and never across platforms, so use the absolute `value` and its `metric` label to weigh one platform against another. Instagram contributes reach, saves, shares and views only for accounts connected or reconnected with the insights permission, and likes and comments only for the rest. Threads and Facebook produce no metrics at all. Read `coverage` before comparing platforms, and never rank platforms on a metric one of them lacks.

    Annotations the server declares

    • title: Get post performance
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_get_automation_usageFor each Instagram account: how many people automations have messaged this month, the plan's monthly limit for that account, and when the count resets.No findings

    Why it is in this group

    • The name "sprkly_get_automation_usage" says "get": a word for reading.
    Description, as the server wrote it
    For each Instagram account: how many people automations have messaged this month, the plan's monthly limit for that account, and when the count resets. ready is false when Instagram has not given the messaging permission yet.

    Annotations the server declares

    • title: Get automation usage
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_get_billing_summarySubscription status, current plan, period end, purchased handles and the last few billing events.No findings

    Why it is in this group

    • The name "sprkly_get_billing_summary" says "get": a word for reading.
    Description, as the server wrote it
    Subscription status, current plan, period end, purchased handles and the last few billing events. No payment method details; the Stripe customer id is truncated.

    Annotations the server declares

    • title: Get billing summary
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_get_inbox_threadOne conversation, oldest message first: their DMs and comments, your replies, and what automations sent.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sprkly_get_inbox_thread" says "get": a word for reading.

    What it can reach

    • private-dataThe name "sprkly_get_inbox_thread" says "get" and "inbox": it reads mail.
    • private-dataThe description's first sentence says "conversation": it reads messages.
    • untrusted-inputThe name "sprkly_get_inbox_thread" says "get" and "inbox": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    One conversation, oldest message first: their DMs and comments, your replies, and what automations sent. Each comment people left carries the comment_id that sprkly_reply_to_comment answers under. dm_window says whether a DM answer is still allowed: Instagram only allows one within 24 hours of their last message. Needs inbox access.

    Annotations the server declares

    • title: Read an inbox conversation
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_get_post_approval_statusWhether a post is awaiting the owner's approval, approved or rejected, with the reviewer's notes, who asked, and timestamps.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sprkly_get_post_approval_status" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe name "sprkly_get_post_approval_status" says "get" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Whether a post is awaiting the owner's approval, approved or rejected, with the reviewer's notes, who asked, and timestamps. A rejected post is a draft again: fix it, then request approval again.

    Annotations the server declares

    • title: Get approval status
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_get_post_statusFull detail for one post: status, targets, scheduled and published times, permalink, and the failure reason if it did not publish.Reads text others writeNo findings

    Why it is in this group

    • The name "sprkly_get_post_status" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe name "sprkly_get_post_status" says "get" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Full detail for one post: status, targets, scheduled and published times, permalink, and the failure reason if it did not publish. Media comes back as mediaIds in slide order, not as links. Ids and profile ids are plumbing: talk to the user about accounts by handle and about posts by their caption, and do not read ids out unless they ask for one.

    Annotations the server declares

    • title: Get post status
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_get_tiktok_posting_optionsThis creator's allowed TikTok privacy levels and interaction settings, fetched live from TikTok.Reads text others writeNo findings

    Why it is in this group

    • The name "sprkly_get_tiktok_posting_options" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    This creator's allowed TikTok privacy levels and interaction settings, fetched live from TikTok. You usually do NOT need this before scheduling: sprkly_schedule_post checks privacyLevel against this same list itself and, when it is wrong, returns the levels that would work. Call this only when the user asks what their options are, or you want to offer them a choice.

    Annotations the server declares

    • title: Get TikTok posting options
    • readOnlyHint: true
    • openWorldHint: true
  • sprkly_list_automation_templatesThe ready-made Instagram automations, the same ones as the template gallery in the app.No findings

    Why it is in this group

    • The name "sprkly_list_automation_templates" says "list": a word for reading.
    Description, as the server wrote it
    The ready-made Instagram automations, the same ones as the template gallery in the app. For example: send a link when people comment a word, answer story replies, ask for a follow first, or collect emails. Each one has an id, a name, a goal, what starts it, and the message it sends. asks_for says what sprkly_create_automation_from_template needs besides the template id and the account: a post, a keyword, a link. Every plan has automations.

    Annotations the server declares

    • title: List automation templates
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_list_automationsEvery Instagram automation on this account that is not archived.No findings

    Why it is in this group

    • The name "sprkly_list_automations" says "list": a word for reading.
    Description, as the server wrote it
    Every Instagram automation on this account that is not archived. Each row has its name, its state (On, Paused or Draft), the Instagram account it runs on, what starts it, and how many DMs and public replies it has sent. One automation on several accounts shows one row per account, all with the same group_id.

    Annotations the server declares

    • title: List automations
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_list_connected_social_accountsEvery ACTIVE social account linked to this sprkly account: platform, handle, follower count, and whether it needs reconnecting.No findings

    Why it is in this group

    • The name "sprkly_list_connected_social_accounts" says "list": a word for reading.
    Description, as the server wrote it
    Every ACTIVE social account linked to this sprkly account: platform, handle, follower count, and whether it needs reconnecting. Disconnected/inactive accounts are never listed, so any profileId returned here is a valid posting target. Never returns access tokens.

    Annotations the server declares

    • title: List connected accounts
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_list_inbox_threadsThe most recent conversations in the sprkly inbox, newest first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "sprkly_list_inbox_threads" says "list": a word for reading.

    What it can reach

    • private-dataThe name "sprkly_list_inbox_threads" says "list" and "inbox": it reads mail.
    • private-dataThe description's first sentence says "conversation": it reads messages.
    • untrusted-inputThe name "sprkly_list_inbox_threads" says "list" and "inbox": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    The most recent conversations in the sprkly inbox, newest first. One row per person per connected account, with their handle, how many of their messages are unread, and the last thing said. Pass unread_only to see only conversations waiting for an answer. Use profile_id and person_id from a row with sprkly_get_inbox_thread to read it. Needs inbox access, which the user allows on its own: a key made with inbox access ticked, or a connection that allowed it.

    Annotations the server declares

    • title: List inbox conversations
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_list_profilesThe profile ids needed to target a post, with each one's platform and handle.Reads text others writeNo findings

    Why it is in this group

    • The name "sprkly_list_profiles" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "post": it reads posts, which other people can write.
    Description, as the server wrote it
    The profile ids needed to target a post, with each one's platform and handle. Call this before sprkly_schedule_post.

    Annotations the server declares

    • title: List posting targets
    • readOnlyHint: true
    • openWorldHint: false
  • sprkly_validate_post_policyCheck a caption against each target platform's posting rules before scheduling: caption length, media requirements, hashtag ceilings, whether links are clickable, required YouTube …No findings

    Why it is in this group

    • The name "sprkly_validate_post_policy" says "validate": a word for reading.
    Description, as the server wrote it
    Check a caption against each target platform's posting rules before scheduling: caption length, media requirements, hashtag ceilings, whether links are clickable, required YouTube titles, and PII or prohibited-content warnings. Pure analysis. Writes nothing.

    Annotations the server declares

    • title: Validate against platform rules
    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

315 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 private-data tools breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Can send data out7
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__sprkly__sprkly_get_inbox_thread",
      "mcp__sprkly__sprkly_get_post_approval_status",
      "mcp__sprkly__sprkly_list_inbox_threads"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:23 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
15
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://sprkly.app/.well-known/oauth-protected-resource/api/mcp
Authorization servers
https://sprkly.app
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 15 tools that change things (1 destructive, 2 irreversible, 12 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://sprkly.app/api/mcp: tools/list returned 29 tools to an anonymous client, including sprkly_delete_scheduled_post (destructive), sprkly_reply_to_comment (irreversible), sprkly_reply_to_dm (irreversible), sprkly_add_media_from_url (write), sprkly_create_automation_from_template (write) and 10 more

    What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http sprkly https://sprkly.app/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__sprkly__sprkly_get_account_summary",
      "mcp__sprkly__sprkly_get_analytics",
      "mcp__sprkly__sprkly_get_automation_usage",
      "mcp__sprkly__sprkly_get_billing_summary",
      "mcp__sprkly__sprkly_get_inbox_thread",
      "mcp__sprkly__sprkly_get_post_approval_status",
      "mcp__sprkly__sprkly_get_post_status",
      "mcp__sprkly__sprkly_get_tiktok_posting_options",
      "mcp__sprkly__sprkly_list_automation_templates",
      "mcp__sprkly__sprkly_list_automations",
      "mcp__sprkly__sprkly_list_connected_social_accounts",
      "mcp__sprkly__sprkly_list_inbox_threads",
      "mcp__sprkly__sprkly_list_profiles",
      "mcp__sprkly__sprkly_validate_post_policy"
    ],
    "ask": [
      "mcp__sprkly__sprkly_add_media_from_url",
      "mcp__sprkly__sprkly_create_automation_from_template",
      "mcp__sprkly__sprkly_draft_post",
      "mcp__sprkly__sprkly_export_automation_template",
      "mcp__sprkly__sprkly_import_automation_template",
      "mcp__sprkly__sprkly_list_scheduled_posts",
      "mcp__sprkly__sprkly_pause_automation",
      "mcp__sprkly__sprkly_reply_to_comment",
      "mcp__sprkly__sprkly_reply_to_dm",
      "mcp__sprkly__sprkly_request_post_approval",
      "mcp__sprkly__sprkly_resume_automation",
      "mcp__sprkly__sprkly_schedule_post",
      "mcp__sprkly__sprkly_update_scheduled_post",
      "mcp__sprkly__sprkly_upload_media"
    ],
    "deny": [
      "mcp__sprkly__sprkly_delete_scheduled_post"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as sprkly. Review it before you use it.

Capability tags behind 18 rules
  • mcp__sprkly__sprkly_add_media_from_url untrusted-input, outbound
  • mcp__sprkly__sprkly_create_automation_from_template untrusted-input
  • mcp__sprkly__sprkly_draft_post outbound
  • mcp__sprkly__sprkly_get_account_summary untrusted-input
  • mcp__sprkly__sprkly_get_analytics untrusted-input
  • mcp__sprkly__sprkly_get_inbox_thread private-data, untrusted-input
  • mcp__sprkly__sprkly_get_post_approval_status private-data, untrusted-input
  • mcp__sprkly__sprkly_get_post_status untrusted-input
  • mcp__sprkly__sprkly_get_tiktok_posting_options untrusted-input
  • mcp__sprkly__sprkly_list_inbox_threads private-data, untrusted-input
  • mcp__sprkly__sprkly_list_profiles untrusted-input
  • mcp__sprkly__sprkly_list_scheduled_posts untrusted-input
  • mcp__sprkly__sprkly_reply_to_comment untrusted-input, outbound
  • mcp__sprkly__sprkly_reply_to_dm untrusted-input, outbound
  • mcp__sprkly__sprkly_request_post_approval outbound
  • mcp__sprkly__sprkly_resume_automation untrusted-input
  • mcp__sprkly__sprkly_schedule_post untrusted-input, outbound
  • mcp__sprkly__sprkly_update_scheduled_post outbound