JuzPost
by juzpost.com · remote · no sign-in to list tools · v1.0.0 · published by com.juzpost
Draft, schedule and publish social posts to X, LinkedIn, Instagram, TikTok, YouTube and more
19 tools: 3 can delete or cancel things, 8 change things and 8 only read.
Scanned Oct 21, 2026
- Deletes or cancels3Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things8Claude Code: ask: see these tools
- Only reads8Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http juzpost https://www.juzpost.com/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnupload_file
The server marks "upload_file" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "upload_file" says "upload": a word for a change.
- Infoget_context
The description mentions "credential".
What this check looks forMatched text
description: "...mentions a plan or quota. Returns user, credential, workspace, plan, billing, entitlements..."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
19 tools
Deletes or cancels 3Claude Code: deny
delete_postPermanently deletes a draft post and its target rows.No findings
Why it is in this group
- The name "delete_post" says "delete": a word for removing or ending something.
- The description says "Permanently deletes".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently deletes a draft post and its target rows. Use this only when the user explicitly asks to discard a draft. Returns deleted=true, the post id and what the deleted draft was (title, caption, type, media count). Does NOT delete scheduled or published posts (returns an error), and does NOT remove anything already published on a platform.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- title: Delete a draft post
schedule_postSchedules a post to one or more accounts at publish_at (ISO 8601 UTC), or publishes immediately with publish_now=true.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "schedule_post" says "schedule": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "schedule_post" says "schedule" and "post": it writes something other people read.
Description, as the server wrote it Schedules a post to one or more accounts at publish_at (ISO 8601 UTC), or publishes immediately with publish_now=true. This publishes to real accounts. One call does it all: without post_id it creates the post from the content and settings given and schedules it; with post_id it schedules that draft, applying any fields sent first. It takes everything the composer can set: caption, title, media, accounts, per-account text (account_overrides, channel_overrides), per-account media and covers, per-account times, and each platform's settings. With post_id, the per-account maps change only the accounts they name, as in update_post: every other account keeps what the draft has. account_ids is the complete list: an account left out is removed. Each platform setting says whether it is required, an account default or optional; a Pinterest account needs pinterest.board_id, from list_options. Every problem on every account is refused in one error, before anything is armed. Use this only after the user has confirmed the content, the accounts and the time. A refused call writes nothing: no draft is created and no draft is changed. Pass the same idempotency_key on a retry without post_id so a network error never makes two posts; with post_id a retry is safe as is. Returns success, post_id and results[] with one row per account (platform, username, status, error). Call get_post afterwards to show exactly what was scheduled. Does NOT publish now unless publish_now is true.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
- title: Schedule a post
update_postEdits a draft or a scheduled post, the same edit the composer makes: caption, title, description, hashtags, type, media keys, cover, accounts, per-account text, media and covers, p…Can send data outNo findings
Why it is in this group
- The name "update_post" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- outboundThe name "update_post" says "update" and "post": it writes something other people read.
Description, as the server wrote it Edits a draft or a scheduled post, the same edit the composer makes: caption, title, description, hashtags, type, media keys, cover, accounts, per-account text, media and covers, platform settings, and the time. Only the fields passed change; media_keys: null clears the media. The per-account maps (account_overrides, channel_overrides, media_by_account, cover_by_account, each platform's settings) change only the accounts they name: send just the accounts you are changing, and every other account keeps its text, media and settings. An account's entry is its whole text or settings; account_overrides: { id: null } clears that account's text. account_ids is the complete list: an account left out is removed from the post. A scheduled post is checked the way schedule_post checks one, and nothing is written when it is refused. It can no longer be edited from 10 minutes before its first account fires, or once an account has started preparing (an Instagram or Pinterest video prepares earlier). publish_at on a scheduled post moves it; on a draft it is the time the draft keeps. Use this when the user revises a post before it goes out. Returns the updated post and warnings[] for any platform caption limit the new content exceeds. Does NOT edit published or failed posts (returns an error), and does NOT ingest URLs; use upload_media first.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
- title: Update a post
Changes things 8Claude Code: ask
create_postCreates a draft post with everything the composer saves: caption, title, description, hashtags, media, the accounts it goes to, per-account text (account_overrides, channel_overrid…Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_post" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "create_post" says "create" and "post": it writes something other people read.
Description, as the server wrote it Creates a draft post with everything the composer saves: caption, title, description, hashtags, media, the accounts it goes to, per-account text (account_overrides, channel_overrides), per-account media and covers, and each platform's settings. Media can be public URLs (downloaded and stored server-side) or media keys from upload_media. Use this only once you have the full brief from the user: the post type, the text, and the media if the type needs it. `type` is required and is never guessed: use the type the user stated (text, image, video or blog); if they did not say, ask them before calling this tool. A blog post goes to WordPress: title is required and becomes the page heading. Put the body in description, as HTML; it is sent exactly as written. Plain text also works: blank lines become paragraphs. WordPress keeps p, br, hr, h2 to h6 (with id), ul, ol, li, blockquote, strong, em, a (href, rel, target, title), code, pre, abbr, time, figure, figcaption, the table tags and img (src, alt, width, height). Do not use h1 (the title is already the page heading), script or style (WordPress removes the tag but leaves its text visible). The first image is the featured image; any others are added under the body in order. Images only, no video. Then schedule_post puts the draft on the calendar. To schedule straight away, call schedule_post with the content instead: it creates and schedules in one call. Pass the same idempotency_key on a retry so a network error never makes two drafts. Returns the draft (post) plus warnings[] naming any platform whose caption limit the content exceeds, and created=false when the idempotency_key matched an existing draft. Does NOT schedule or publish anything.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- title: Create a draft post
create_upload_urlReserves storage for one file and returns a presigned upload_url (valid 1 day) plus the media_key it will be stored under.No findings
Why it is in this group
- The name "create_upload_url" says "create": a word for a change.
Description, as the server wrote it Reserves storage for one file and returns a presigned upload_url (valid 1 day) plus the media_key it will be stored under. Images up to 20 MB, videos up to 200 MB. Use this in Claude Code, a terminal or a script, for a local file or any video: PUT the ORIGINAL file bytes, unmodified, to upload_url with the returned content-type header and exactly `bytes` bytes, then pass media_key to create_post or update_post. Never re-encode, resize or compress the file first. In a chat app that shows cards (Claude.ai, Claude Desktop, Claude mobile) call upload_file instead: the user picks the file and nothing has to be allowed. The PUT goes to the storage host in upload_url (<account>.r2.cloudflarestorage.com). A code sandbox that blocks it needs that host allowed: On Claude.ai a Pro or Max user allows it in Settings → Capabilities; on a Team or Enterprise plan the organization owner adds it in Admin settings → Capabilities → Additional allowed domains. Returns upload_url, media_key, headers and expires_in. Does NOT upload anything by itself, and does NOT accept a URL or base64; use upload_media for those.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- title: Create an upload URL
switch_workspaceA connection acts on one workspace at a time.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it A connection acts on one workspace at a time. This moves it onto another workspace the user belongs to (id or slug from list_workspaces) for every later call, until switched again, and returns the new context. Use this when the user names a workspace other than the current one; confirm with them before switching. Returns switched and the full get_context shape for the new workspace, which says what that workspace's plan allows. Does NOT create workspaces and does NOT touch posts or accounts.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Switch workspace
upload_beginCalled only by the JuzPost upload card, never by the model.No findings
Why it is in this group
- The name "upload_begin" says "upload": a word for a change.
Description, as the server wrote it Called only by the JuzPost upload card, never by the model. Reserves storage for one file and starts a multipart upload. Returns media_key, upload_id, part_size and parts.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- title: Start a card upload
upload_fileShows an upload card where the user picks images or videos from their device (images up to 20 MB, videos up to 200 MB); the card stores the original files in the workspace.1 finding
Why it is in this group
- The name "upload_file" says "upload": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "upload_file" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "upload_file" says "upload": a word for a change.
Description, as the server wrote it Shows an upload card where the user picks images or videos from their device (images up to 20 MB, videos up to 200 MB); the card stores the original files in the workspace. Use this in a chat app that shows cards (Claude.ai, Claude Desktop, Claude mobile) whenever the user attached a file in the chat or wants to add one from their device: you cannot read their attachment, so let them pick it here. When they finish, the card adds each file name and media_key to your context and asks the user to send a message; pass those media_key values to create_post or update_post. Returns nothing to attach by itself. Does NOT work in Claude Code or a terminal (use create_upload_url there) and does NOT take a link (use upload_media).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Upload a file from the device
upload_finishCalled only by the JuzPost upload card, never by the model.No findings
Why it is in this group
- The name "upload_finish" says "upload": a word for a change.
Description, as the server wrote it Called only by the JuzPost upload card, never by the model. Completes an upload once every part is stored. Returns media_key, bytes and content_type.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- title: Finish a card upload
upload_mediaStores the original image or video in the workspace from a file the chat app hands over, a public URL (up to 100 MB) or inline base64 (up to 3 MB), checking the real file type and …Reads text others writeCan send data outNo findings
Why it is in this group
- The name "upload_media" says "upload": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Stores the original image or video in the workspace from a file the chat app hands over, a public URL (up to 100 MB) or inline base64 (up to 3 MB), checking the real file type and the storage quota. Use this when the user gives you a link to attach to a post, or when the chat app hands you their attachment as `file` (ChatGPT does); then pass the returned media_key to create_post or update_post. `file` is filled by the chat app with an https download link, never by you: a path you see such as /mnt/user-data/uploads/… is on the user's side and cannot be read here. For a file the user attached or has on their device, call upload_file in a chat app that shows cards (Claude), or create_upload_url in Claude Code or a terminal. Use `base64` only with the original bytes of a small image you read from disk; never draw, reconstruct, re-encode or compress an image you have only seen. Returns media_key, bytes, content_type and source. Does NOT attach the file to any post by itself and does NOT accept private or local-network URLs.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- title: Upload media
upload_partCalled only by the JuzPost upload card, never by the model.No findings
Why it is in this group
- The name "upload_part" says "upload": a word for a change.
Description, as the server wrote it Called only by the JuzPost upload card, never by the model. Stores one part of a file started with upload_begin: the original bytes as base64, exactly part_size bytes except the last part. Returns part_number and bytes.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- title: Send an upload part
Only reads 8Claude Code: allow
get_contextReports who this connection is, the one workspace it acts on (use switch_workspace to change it), the plan, billing state, entitlements, quotas, limits and a plain-language list of…1 finding
Why it is in this group
- The name "get_context" says "get": a word for reading.
Findings
- Info
The description mentions "credential".
What this check looks forMatched text
description: "...mentions a plan or quota. Returns user, credential, workspace, plan, billing, entitlements..."
Description, as the server wrote it Reports who this connection is, the one workspace it acts on (use switch_workspace to change it), the plan, billing state, entitlements, quotas, limits and a plain-language list of what is blocked right now. Use this to see what the connection can do, and after an error mentions a plan or quota. Returns user, credential, workspace, plan, billing, entitlements, quotas, limits and blocked[]. The plan and quotas.subscription belong to the subscription of the workspace owner (ownedBy says whether that is the user) and are counted across every workspace that owner has; quotas.workspace is this workspace alone. Say which is which when reporting numbers. Does NOT change anything. Needs the Solo plan or higher on the current workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Get connection context
get_platform_limitsReturns the full publishing rules for one platform or all of them: caption and title limits and units, media counts, sizes, formats, whether media is required, hashtags, mentions, …Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_platform_limits" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "file": it reads files.
- untrusted-inputThe description's first sentence says "return" and "mention": it reads comments, which other people can write.
Description, as the server wrote it Returns the full publishing rules for one platform or all of them: caption and title limits and units, media counts, sizes, formats, whether media is required, hashtags, mentions, native scheduling, plus the global file rules. Use this before drafting to answer "will this fit on X / Instagram / TikTok". Returns platforms[] (one object per platform, with effectiveBodyLimit) and global. Does NOT look at a specific account; list_accounts carries the per-account effective limits.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Get platform limits
get_postFetches one post with its per-account rows: status, publish time, published time and any error per account.Reads text others writeNo findings
Why it is in this group
- The name "get_post" says "get": a word for reading.
What it can reach
- untrusted-inputThe name "get_post" says "get" and "post": it reads posts, which other people can write.
- untrusted-inputThe description's first sentence says "fetch" and "post": it reads posts, which other people can write.
Description, as the server wrote it Fetches one post with its per-account rows: status, publish time, published time and any error per account. Use this after schedule_post to confirm what happened, or when the user asks why a post failed. Returns the post (content, media, metadata, socialAccountIds) and targets[] with platform and username. Refer to posts by title or caption and to accounts by platform and username when talking to the user; ids are for tool calls. Does NOT retry or change the post.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: Get a post
list_accountsLists the social accounts connected to the workspace, with health, how many posts are queued on each, and the effective limits for that account.Reads text others writeNo findings
Why it is in this group
- The name "list_accounts" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
Description, as the server wrote it Lists the social accounts connected to the workspace, with health, how many posts are queued on each, and the effective limits for that account. Use this to pick the accounts for create_post and schedule_post, or to check whether an account needs reconnecting. Returns accounts[] (id, ref, platform, username, health, scheduledCount, limits, blockedByPlan, and seo for WordPress accounts), nextCursor and hasMore. seo is "yoast" when the WordPress site lets this account write Yoast SEO fields (schedule_post wordpress.seo), and "core" when it does not. health.status is the same as the dashboard: an expired access token that renews itself is still active; only needs_reconnect means the user must reconnect. ref is the account as "platform:handle" (e.g. "x:acme_studio"): pass it wherever a tool takes an account, since it is what the person reads when approving; it is null when the account has no handle, and then the id is used. Does NOT connect or disconnect accounts; that happens in the dashboard.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: List connected accounts
list_groupsLists channel groups (named sets of accounts) with their member account ids.No findings
Why it is in this group
- The name "list_groups" says "list": a word for reading.
Description, as the server wrote it Lists channel groups (named sets of accounts) with their member account ids. Use this when the user names a group ("post to my brand accounts") to resolve it to the account ids schedule_post takes. Returns groups[] (id, name, accountIds, accountCount), nextCursor and hasMore. Does NOT create or edit groups.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: List channel groups
list_optionsLists the choices one account offers for a setting the schedule needs, read live from the platform.Reads text others writeNo findings
Why it is in this group
- The name "list_options" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Lists the choices one account offers for a setting the schedule needs, read live from the platform. Requests: list_board (pinterest, ids go in pinterest.board_id); list_post_type (wordpress, ids go in wordpress.post_type). Use this when the user posts to Pinterest: list the boards, ask which one, and pass its id as board_id. Use list_post_type when the user wants a WordPress post published as something other than a blog post (a short story, a page): pass the matching id as post_type; the name lists the taxonomies that type takes in terms. Returns field (where the ids go) and choices[] with id and name. Refer to a choice by its name when talking to the user. Does NOT change anything.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- title: List choices for an account
list_postsLists posts in the workspace: drafts, scheduled, published and failed.Reads text others writeNo findings
Why it is in this group
- The name "list_posts" says "list": a word for reading.
What it can reach
- untrusted-inputThe name "list_posts" says "list" and "post": it reads posts, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
Description, as the server wrote it Lists posts in the workspace: drafts, scheduled, published and failed. Use this to find drafts to schedule, to review the queue, or to find a post id for get_post, update_post or delete_post. Returns posts[] (id, status, type, title, content, mediaUrls, scheduledFor), nextCursor and hasMore. Refer to posts by title or caption when talking to the user; ids are for tool calls. Does NOT include per-account results; call get_post for those.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: List posts
list_workspacesLists every workspace the user belongs to, marks the one this connection acts on, and says what each allows through the connector: none (Free or no plan) or full (Solo, Growth, Pro…No findings
Why it is in this group
- The name "list_workspaces" says "list": a word for reading.
Description, as the server wrote it Lists every workspace the user belongs to, marks the one this connection acts on, and says what each allows through the connector: none (Free or no plan) or full (Solo, Growth, Pro). Use this when the user names another workspace or a tool reports a plan lock; then switch_workspace moves the connection. Returns workspaces[] (id, name, slug, isOwner, current, plan, access). Does NOT switch, create or change any workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- title: List workspaces
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
32 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write8
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out4
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__juzpost__get_platform_limits"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:34 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 11
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- https://www.juzpost.com/.well-known/oauth-protected-resource/mcp
- Authorization servers
- https://www.juzpost.com
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- yes
- Client ID metadata documents
- yes
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 11 tools that change things (3 destructive, 8 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://www.juzpost.com/mcp: tools/list returned 19 tools to an anonymous client, including update_post (destructive), delete_post (destructive), schedule_post (destructive), switch_workspace (write), create_post (write) and 6 more
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http juzpost https://www.juzpost.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__juzpost__get_context",
"mcp__juzpost__list_workspaces",
"mcp__juzpost__list_accounts",
"mcp__juzpost__list_options",
"mcp__juzpost__get_platform_limits",
"mcp__juzpost__list_groups",
"mcp__juzpost__list_posts",
"mcp__juzpost__get_post"
],
"ask": [
"mcp__juzpost__switch_workspace",
"mcp__juzpost__create_post",
"mcp__juzpost__upload_file",
"mcp__juzpost__upload_media",
"mcp__juzpost__create_upload_url",
"mcp__juzpost__upload_begin",
"mcp__juzpost__upload_part",
"mcp__juzpost__upload_finish"
],
"deny": [
"mcp__juzpost__update_post",
"mcp__juzpost__delete_post",
"mcp__juzpost__schedule_post"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as juzpost. Review it before you use it.
Capability tags behind 9 rules
- mcp__juzpost__list_accounts untrusted-input
- mcp__juzpost__list_options untrusted-input
- mcp__juzpost__get_platform_limits private-data, untrusted-input
- mcp__juzpost__list_posts untrusted-input
- mcp__juzpost__get_post untrusted-input
- mcp__juzpost__create_post untrusted-input, outbound
- mcp__juzpost__update_post outbound
- mcp__juzpost__schedule_post untrusted-input, outbound
- mcp__juzpost__upload_media untrusted-input, outbound