Skip to content
anlyon.devby Anlyon

Social Media Data API: Posts, Profiles, Comments, Search and Mentions

com.duoleads.social/social-media-datasocial.duoleads.comstreamable-httpv1.0.0Scanned

Social media posts, profiles, comments, search and mentions across 10 platforms. Pay per call (x402)

26 tools: 19 change things and 7 only read.

Tools: 0 delete, 0 irreversible, 19 write, 7 read.
  • Reads private data · 1
  • Reads text others write · 26
  • Can send data out · 5
  • 5 findings

Anlyon alternative

19 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

26 tools

Changes things 19Claude Code: ask
  • bluesky_postsBluesky Account Posts Feed: the latest public posts and replies of one Bluesky account (a handle such as name.bsky.social, a DID or a bsky.app profile URL), reposts left out.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "bluesky_posts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "bluesky_posts" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "bluesky_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "bluesky_posts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Bluesky Account Posts Feed: the latest public posts and replies of one Bluesky account (a handle such as name.bsky.social, a DID or a bsky.app profile URL), reposts left out. Per post the text, likes, replies, reposts, language, media links, time and URL in the shared social schema; next_cursor pages back through the feed. Bad input is free; not found or no match is not charged. Price: $0.01 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • bluesky_profileBluesky Profile Lookup: one public Bluesky account by handle, DID or bsky.app URL: display name, bio, follower, following and post counts, verification, avatar link, creation time …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Bluesky Profile Lookup: one public Bluesky account by handle, DID or bsky.app URL: display name, bio, follower, following and post counts, verification, avatar link, creation time and DID, in the shared social schema. Bad input is free; not found or no match is not charged. Price: $0.01 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • facebook_adsFacebook Ad Library Search: search the public Meta Ad Library by keyword for ads on Facebook and Instagram.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Facebook Ad Library Search: search the public Meta Ad Library by keyword for ads on Facebook and Instagram. Per ad the page name, ad text, active status, start and end dates, publisher platforms, call to action, landing link and media links in the shared social schema; next_cursor gives the next page. Competitor ad research. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • hackernews_threadHacker News Comments & Threads: one Hacker News story or comment by id or news.ycombinator.com URL with its direct replies (up to 8 per call, next_cursor for more), deleted and dea…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hacker News Comments & Threads: one Hacker News story or comment by id or news.ycombinator.com URL with its direct replies (up to 8 per call, next_cursor for more), deleted and dead replies skipped. Per item the text as plain text, author, score, reply count, parent and time in the shared social schema. Bad input is free; not found or no match is not charged. Price: $0.01 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • instagram_profileInstagram Profile & Posts: one public Instagram account by handle or URL: name, bio, followers, following, post count, verification, then its recent posts and reels with caption, l…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Instagram Profile & Posts: one public Instagram account by handle or URL: name, bio, followers, following, post count, verification, then its recent posts and reels with caption, likes, comments, views, image link and time, in the shared social schema; next_cursor pages through the full post feed. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • linkedin_companyLinkedIn Company Page Data: one LinkedIn company page by URL or page name: name, description, industry, size, employee count, headquarters, website, founding year, type, specialtie…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    LinkedIn Company Page Data: one LinkedIn company page by URL or page name: name, description, industry, size, employee count, headquarters, website, founding year, type, specialties and logo link, plus its recent posts (posts=1 adds the post feed with next_cursor). Company pages only, personal profiles are refused for free. B2B research. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • linkedin_profileLinkedIn Profile Lookup: one public LinkedIn profile by linkedin.com/in/ URL: name, followers, about text and photo link in the shared social schema.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    LinkedIn Profile Lookup: one public LinkedIn profile by linkedin.com/in/ URL: name, followers, about text and photo link in the shared social schema. Experience, education and contact data are not returned. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • reddit_commentsReddit Post Comments: one Reddit post by id or URL with its comment thread (up to 3 reply levels, deleted and removed comments left out).Reads text others write1 finding

    Why it is in this group

    • The name "reddit_comments" says "comment": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "reddit_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "reddit_comments" says "comment": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Reddit Post Comments: one Reddit post by id or URL with its comment thread (up to 3 reply levels, deleted and removed comments left out). Per comment the text, author, upvotes, parent, subreddit, time and permalink in the shared social schema; next_cursor gives more comments. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • social_accountsCreator & Brand Account Search: find creator and brand accounts on TikTok, Instagram or Threads by name or keyword.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creator & Brand Account Search: find creator and brand accounts on TikTok, Instagram or Threads by name or keyword. Only verified accounts or accounts with 10,000+ followers are returned (the rest counted in filtered_out); Threads search gives no follower counts and Instagram only for its first 10 results, so beyond those only verified accounts qualify. Per account the handle, name, bio, followers, following, posts and verification. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • social_audienceAudience & Engagement Stats: numbers only for one TikTok, Instagram, YouTube or Threads account, or X when its key is enabled: followers, following, posts, and the average likes, c…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Audience & Engagement Stats: numbers only for one TikTok, Instagram, YouTube or Threads account, or X when its key is enabled: followers, following, posts, and the average likes, comments and views over its last 20 posts, with the engagement rate in percent. No follower names, no post text. Influencer vetting and benchmarking. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • social_mentionsSocial Mentions & Sentiment: daily mention counts, distinct authors and mean VADER sentiment for a brand, product or topic over the last 1-7 days, plus the top 10 co-occurring term…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Social Mentions & Sentiment: daily mention counts, distinct authors and mean VADER sentiment for a brand, product or topic over the last 1-7 days, plus the top 10 co-occurring terms. Sources: Bluesky and Hacker News, plus Reddit and X (latest, newest first) when available. One page per source: days beyond its reach come back truncated (coverage_from). Aggregate only, no text, no authors; a day under 20 known authors is suppressed. Bad input is free; not found or no match is not charged. Price: $0.01 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • threads_postsThreads Posts & Replies: the recent public posts of one Threads account by handle or threads.com URL.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "threads_posts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "threads_posts" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "threads_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "threads_posts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Threads Posts & Replies: the recent public posts of one Threads account by handle or threads.com URL. Per post the text, likes, replies, reposts, time and URL, with the author's handle and verification, in the shared social schema. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • tiktok_followersTikTok Followers List: the public followers of one TikTok account by handle, one page per call with next_cursor.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    TikTok Followers List: the public followers of one TikTok account by handle, one page per call with next_cursor. Per follower the handle, name, bio, followers, following, posts and verification in the shared social schema. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • tiktok_followingTikTok Following List: the public accounts one TikTok account follows, by handle, one page per call with next_cursor.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    TikTok Following List: the public accounts one TikTok account follows, by handle, one page per call with next_cursor. Per account the handle, name, bio, followers, following, posts and verification in the shared social schema. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • tiktok_videosTikTok Profile & Videos: the latest public videos of one TikTok account by handle or tiktok.com/@ URL.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    TikTok Profile & Videos: the latest public videos of one TikTok account by handle or tiktok.com/@ URL. Per video the caption, plays, likes, comments, shares, language, cover image link, time and URL, with the creator's name, verification and followers, in the shared social schema; next_cursor pages back. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • x_postsX User Tweets Timeline: the latest public tweets of one X (Twitter) account by handle or x.com URL, newest first.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "x_posts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "x_posts" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "x_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "x_posts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    X User Tweets Timeline: the latest public tweets of one X (Twitter) account by handle or x.com URL, newest first. Per tweet the text, author handle and name, verification, followers, likes, replies, retweets, views, language, reply or quote parent, time and URL in the shared social schema; next_cursor gives the next page. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • x_profileX User Profile Lookup: one public X (Twitter) account by handle or x.com URL: display name, bio, followers, following, post count, verification, avatar link and creation time, in t…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    X User Profile Lookup: one public X (Twitter) account by handle or x.com URL: display name, bio, followers, following, post count, verification, avatar link and creation time, in the shared social schema. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • youtube_commentsYouTube Video Comments: the public comments on one YouTube video by id or URL.Reads text others write1 finding

    Why it is in this group

    • The name "youtube_comments" says "comment": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "youtube_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "youtube_comments" says "comment": a word for a change.

      What this check looks for
    Description, as the server wrote it
    YouTube Video Comments: the public comments on one YouTube video by id or URL. Per comment the text, author channel handle, verification, likes, reply count, time and link in the shared social schema; next_cursor gives the next page. Audience feedback and sentiment research. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
  • youtube_transcriptYouTube Transcript & Captions: the caption transcript of one YouTube video by id or URL (watch, shorts, live, youtu.be): the full text plus timed segments with start and end in mil…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    YouTube Transcript & Captions: the caption transcript of one YouTube video by id or URL (watch, shorts, live, youtu.be): the full text plus timed segments with start and end in milliseconds and the caption language. Video to text for summaries and research. A video without captions is not charged. Bad input is free; not found or no match is not charged. Price: $0.02 per successful call, paid over x402 (USDC on Base); pass the payment in _meta["x402/payment"].

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • idempotentHint: false
Only reads 7Show 7 read-only tools

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

130 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write26
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out5
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__social-media-data__people_search"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

5 warn
  • Warnbluesky_posts

    The server marks "bluesky_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "bluesky_posts" says "post": a word for a change.

    What this check looks for
  • Warnx_posts

    The server marks "x_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "x_posts" says "post": a word for a change.

    What this check looks for
  • Warnreddit_comments

    The server marks "reddit_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "reddit_comments" says "comment": a word for a change.

    What this check looks for
  • Warnyoutube_comments

    The server marks "youtube_comments" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "youtube_comments" says "comment": a word for a change.

    What this check looks for
  • Warnthreads_posts

    The server marks "threads_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":true}; The name "threads_posts" says "post": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http social-media-data https://social.duoleads.com/mcp
claude mcp add --transport http social-media-data https://social.duoleads.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__social-media-data__bluesky_search",
      "mcp__social-media-data__hackernews_search",
      "mcp__social-media-data__x_search",
      "mcp__social-media-data__reddit_search",
      "mcp__social-media-data__tiktok_search",
      "mcp__social-media-data__social_search",
      "mcp__social-media-data__people_search"
    ],
    "ask": [
      "mcp__social-media-data__bluesky_posts",
      "mcp__social-media-data__bluesky_profile",
      "mcp__social-media-data__hackernews_thread",
      "mcp__social-media-data__social_mentions",
      "mcp__social-media-data__x_posts",
      "mcp__social-media-data__x_profile",
      "mcp__social-media-data__reddit_comments",
      "mcp__social-media-data__tiktok_videos",
      "mcp__social-media-data__instagram_profile",
      "mcp__social-media-data__youtube_transcript",
      "mcp__social-media-data__youtube_comments",
      "mcp__social-media-data__threads_posts",
      "mcp__social-media-data__facebook_ads",
      "mcp__social-media-data__social_audience",
      "mcp__social-media-data__social_accounts",
      "mcp__social-media-data__linkedin_company",
      "mcp__social-media-data__tiktok_followers",
      "mcp__social-media-data__tiktok_following",
      "mcp__social-media-data__linkedin_profile"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as social-media-data. Review it before you use it.

Capability tags behind 26 rules
  • mcp__social-media-data__bluesky_search untrusted-input
  • mcp__social-media-data__bluesky_posts untrusted-input, outbound
  • mcp__social-media-data__bluesky_profile untrusted-input
  • mcp__social-media-data__hackernews_search untrusted-input
  • mcp__social-media-data__hackernews_thread untrusted-input
  • mcp__social-media-data__social_mentions untrusted-input
  • mcp__social-media-data__x_search untrusted-input
  • mcp__social-media-data__x_posts untrusted-input, outbound
  • mcp__social-media-data__x_profile untrusted-input
  • mcp__social-media-data__reddit_search untrusted-input
  • mcp__social-media-data__reddit_comments untrusted-input
  • mcp__social-media-data__tiktok_videos untrusted-input
  • mcp__social-media-data__tiktok_search untrusted-input
  • mcp__social-media-data__instagram_profile untrusted-input
  • mcp__social-media-data__youtube_transcript untrusted-input
  • mcp__social-media-data__youtube_comments untrusted-input
  • mcp__social-media-data__threads_posts untrusted-input, outbound
  • mcp__social-media-data__facebook_ads untrusted-input
  • mcp__social-media-data__social_search untrusted-input
  • mcp__social-media-data__social_audience untrusted-input
  • mcp__social-media-data__social_accounts untrusted-input
  • mcp__social-media-data__linkedin_company untrusted-input, outbound
  • mcp__social-media-data__people_search private-data, untrusted-input
  • mcp__social-media-data__tiktok_followers untrusted-input
  • mcp__social-media-data__tiktok_following untrusted-input
  • mcp__social-media-data__linkedin_profile untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.duoleads.social/social-media-data/verify?hash=771a7606b42ed79f63b17f386c9a1c025fb4ad37aa62522f6ee73d63c201f171" | jq -e '.changed == false'

Pinned hash 771a7606b42e, from Oct 26, 2026, 15:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.duoleads.social/social-media-data/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.duoleads.social/social-media-data
[![anlyon.dev](https://anlyon.dev/badge/com.duoleads.social/social-media-data.svg)](https://anlyon.dev/servers/com.duoleads.social/social-media-data)

Source: MCP Registry. Synced Oct 26, 2026, 16:17 UTC.