Skip to content

PostWire

by Perufitlife · remote · local (npm) · no sign-in to list tools · v0.3.5 · published by GitHub user Perufitlife

Writes a native post per network from one idea and publishes it: TikTok, Instagram, YouTube & more

Deletes · 2Changes · 10

21 tools: 2 can delete or cancel things, 10 change things and 9 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http postwire https://postwire.io/api/mcp

Findings

Matches of fixed checks, with the text they matched.

3 info
  • The description mentions "credentials".

    Matched text

    description: "...whether it connects with OAuth or with credentials (fields, plus optional_fields), and kin..."

    What this check looks for
  • The description is 3,583 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."

    What this check looks for
  • The description is 2,720 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

21 tools

Deletes or cancels 2Claude Code: deny
  • cancel_scheduled_postCancels a queued or held post, or withdraws one waiting for approval, so it is never published (a withdrawn post's approval links stop working).No findings

    Why it is in this group

    • The name "cancel_scheduled_post" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancels a queued or held post, or withdraws one waiting for approval, so it is never published (a withdrawn post's approval links stop working). Only works before it starts publishing. Takes the id of the scheduled post.

    Annotations the server declares

    • title: Cancel a scheduled post
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • post_to_socialPublishes a post immediately and publicly to the listed platforms through the social accounts connected to the user's PostWire account.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "post_to_social" says "post": a word for a change.
    • The description's first verb is "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "post_to_social" says "post": it sends or publishes something to other people.

    Findings

    • Info

      The description is 3,583 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."

      What this check looks for
    Description, as the server wrote it
    Publishes a post immediately and publicly to the listed platforms through the social accounts connected to the user's PostWire account. A published post cannot be withdrawn from PostWire. Accepts one text for all platforms or a separate per_platform draft for each. YouTube requires video_url; TikTok requires video_url or photos (photo_url or media); Instagram requires a photo or video, and two or more media items make a carousel. Every platform must already be connected; otherwise nothing is published and the error names the missing ones. The same payload sent twice within 2 minutes is refused as a duplicate unless idempotency_key differs. When a platform is connected in more than one brand and brand_id is omitted, nothing is published and the error lists the brands. Returns { posted, published_to, results: [{ platform, ok, id?, url?, account?, error? }] }, where account and published_to name the handle and brand each post went to. After the account's first post through this connection, next_step proposes a week of posts on the same topic for the text networks it went to (its topic and platforms); nothing is queued until the person asks for it. The plan sets how many networks one post goes out to (Free: 2): only the first platforms in the list are published and each of the others comes back with ok: false, held: true and code networks_per_post (its version was written and not sent), listed in held_networks with a one-sentence held_message, and message_for_user says it in plain words for the person; every network can still be connected and written for. TikTok and Instagram videos may still be processing when this returns (status processing, no url yet). When the networks-per-post or the monthly post limit stops a platform, the result also names the plan that lifts it, its price and a checkout link, and, for a free account that has not had one, a link to Pro with the first month 50% off (trial_offer: paid today, then the regular monthly price, cancel anytime). Such an account also gets the trial link once after its first post from an assistant, with a one-sentence trial_message. X (Twitter) is a pay-per-use add-on on paid plans: each X post uses X credits (1 for a plain post, 10 for a post with a link, +1 per image or video) from the plan's monthly X credits, then from top-up credits; a post without enough credits is not sent to X and its result says how to get more. An X thread: per_platform.x.thread is the list of posts after per_platform.x.text (up to 25, each at most 280 characters as X counts them, a link counts 23); per_platform.x.reply is one more post under the last one, the usual place for a link. Each post of a thread or reply is an X post: it uses credits by the same rule and counts toward the daily X limit, and the whole chain is reserved before anything is sent. Write a thread only when the user asks for one. The X result then has thread.tweets (every post's id), thread_url, and thread.status: complete, or pending when X refused a later post (the first post stays published and PostWire retries the rest on its own). If the brand's approval rules or a limit on this API key or connected app hold the post, nothing is published: the result has status "pending_approval", the post's id and approval_id, who was notified and a review link, and the post goes out once a person approves it from the emailed link or the PostWire dashboard — an AI assistant or an API key cannot approve it. A limit on this key or app can also refuse a post with code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached.

    Annotations the server declares

    • title: Publish a post now
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Changes things 10Claude Code: ask
  • bulk_scheduleChecks, and on request schedules, many posts at once: a CSV file's text (csv) or a list of rows (rows), each row one post with the columns date ("2026-10-12 09:00" in the row's or …Reads text others writeNo findings

    Why it is in this group

    • The name "bulk_schedule" says "schedule": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Checks, and on request schedules, many posts at once: a CSV file's text (csv) or a list of rows (rows), each row one post with the columns date ("2026-10-12 09:00" in the row's or the upload's timezone, an ISO time with offset, or "next_slot"), networks ("linkedin, x"), text, optional text_<network> (each network its own text), media_urls (https links; video: or document: prefix), alt_text, first_comment (LinkedIn, Bluesky, Mastodon), x_reply and x_thread (X), title, brand and label. dry_run defaults to true: nothing is scheduled and the result lists, for every row, the time it would go out, its networks, each network's length as that network counts it, the X credits it would use, whether it would wait for approval or be held by the plan, and its errors and warnings. With dry_run false the upload is scheduled whole or not at all: if any row has an error nothing is scheduled (code bulk_rows_invalid) and each row says what to fix. The plan limits rows per upload (Free 20, Starter 500, Pro 1,000, Agency 2,000, Scale 5,000); on Free, posts past the 3 scheduled at a time are saved as held. The same upload twice is refused (code bulk_already_scheduled) unless allow_duplicate is true. The result has batch_id; DELETE /api/bulk/{batch_id} undoes the whole upload. Write the rows for the user when they describe a content plan; show them the dry run before scheduling.

    Annotations the server declares

    • title: Schedule many posts at once (CSV or rows)
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_brandCreates a new, empty brand (a separate business with its own connected social accounts) on the PostWire account and returns its id.No findings

    Why it is in this group

    • The name "create_brand" says "create": a word for a change.
    Description, as the server wrote it
    Creates a new, empty brand (a separate business with its own connected social accounts) on the PostWire account and returns its id. The plan limits the number of brands; at the limit nothing is created and the response names the plan that includes more brands, its monthly price and a checkout link.

    Annotations the server declares

    • title: Create a brand
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_recurring_postSets up a post that repeats on a schedule: daily, weekly on some weekdays, or monthly on some days of the month (31 falls on the last day of shorter months; -1 = the last day), eve…Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "create_recurring_post" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "create_recurring_post" says "create" and "post": it writes something other people read.
    Description, as the server wrote it
    Sets up a post that repeats on a schedule: daily, weekly on some weekdays, or monthly on some days of the month (31 falls on the last day of shorter months; -1 = the last day), every N days, weeks or months, at 1-4 times a day in a timezone (daylight saving handled), from a start date until an end date or for a number of times. variants (a list of texts) are used in turn, so the same text does not repeat every time. The duplicate guard (guard_days, default 3, 0 = off) skips a network where the same text went out in the last guard_days when an occurrence is published: networks flag repeated posts. Occurrences are put in the queue up to 7 days ahead as ordinary scheduled posts (each can be edited or canceled alone), and go through the brand's approval rules and the plan's limits like any post. On every paid plan (Starter 25, Pro 100, Agency 500, Scale 2,000 at a time); not on Free. Returns the recurring post with its next occurrences and any warnings (for example: one text every day with a 3-day guard would be skipped).

    Annotations the server declares

    • title: Set up a recurring post
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • generate_postsWrites one draft per platform from a single idea, adapted to each network's rules (character limit, hashtags, title and tags for YouTube, hook-first caption for TikTok and Reels, l…Can send data outNo findings

    Why it is in this group

    • The name "generate_posts" says "generate": a word for a change.

    What it can reach

    • outboundThe name "generate_posts" says "generate" and "post": it writes something other people read.
    Description, as the server wrote it
    Writes one draft per platform from a single idea, adapted to each network's rules (character limit, hashtags, title and tags for YouTube, hook-first caption for TikTok and Reels, link placement for LinkedIn, Slack formatting, plain text for Nostr). For the blogs (wordpress, devto, hashnode) the draft is a full article: title (<= 70 characters), summary (120-160 characters), a Markdown body with H2 sections, and 3-5 tags (Dev.to: 4). Nothing is published. Returns { drafts: { <platform>: { text, title?, tags?, summary?, thread?, first_comment? } } } and, if the writer skipped a platform, { missing: [...] }. thread (the posts after text) comes back when the user asks for a thread (X, Bluesky, Mastodon), or on Bluesky and Mastodon when the idea is too long for one post there; first_comment comes with it when the idea has a link (LinkedIn, X, Bluesky, Mastodon), so the link goes in the first comment. Counts toward the account's daily AI limit.

    Annotations the server declares

    • title: Write a native draft for each platform
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • make_video_from_textMakes a short vertical video from the words of a post, for networks that take only video (YouTube) or video or photos (TikTok): an MP4 of 1080x1920, 8 to 12 seconds, H.264 with AAC…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Makes a short vertical video from the words of a post, for networks that take only video (YouTube) or video or photos (TikTok): an MP4 of 1080x1920, 8 to 12 seconds, H.264 with AAC sound. The first line appears as a large heading and up to two more sentences appear one after another over a softly moving plain background, with royalty-free background music or silence; an optional footer line (for example the brand's name) sits under the text. Emoji, links and trailing hashtags are left out and no PostWire mark is added. Draws Latin, Greek and Cyrillic text. No AI is used and nothing is published. The file stays in the account's PostWire media storage while a scheduled post needs it, is deleted the day after that post is published, and 7 days after upload if no post uses it (2 days on the Free plan; so post or schedule it soon). Returns media_url (an https URL valid for 6 hours, renewed when the post goes out, that works as video_url), duration_s, text_on_video (the lines shown) and message_for_user. Up to 10 videos an hour per account, and per day 10 on the Free plan and 60 on paid plans.

    Annotations the server declares

    • title: Make a short video from a post's words
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • plan_weekWrites one post per day for 1 to 7 days from a single topic, each day from a different angle and each platform in its own native format, and queues them to be published publicly at…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Writes one post per day for 1 to 7 days from a single topic, each day from a different angle and each platform in its own native format, and queues them to be published publicly at the given hour on each day starting tomorrow, through the connected accounts. Text only: platforms that require a video or photo (TikTok, YouTube, Instagram) are refused. Every platform must already be connected. The whole week counts as one AI draft toward the daily AI limit. Every day is written; days that do not fit in the plan's monthly post limit or in its scheduled-posts limit (Free: 3 waiting at a time) are saved as held (never published on the current plan; each says held_for) and are scheduled automatically when the plan is upgraded; the result then also gives that plan, its price and a checkout link. On a plan with a networks-per-post limit (Free: 2) each day goes out to the first platforms only, named in held_networks. Returns the queued and held items with their id, time and a preview of each platform's text; any of them can be canceled before it runs. If the brand's approval rules or a limit on this API key or connected app hold the post, nothing is published: the result has status "pending_approval", the post's id and approval_id, who was notified and a review link, and the post goes out once a person approves it from the emailed link or the PostWire dashboard — an AI assistant or an API key cannot approve it. A limit on this key or app can also refuse a post with code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached.

    Annotations the server declares

    • title: Plan and schedule a week of posts
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • replicate_top_postWrites new drafts, one per platform, that reuse the structure, opening type, length, format and tone of one of the account's published posts, on a new topic or a new angle; the ref…Can send data outNo findings

    Why it is in this group

    • The name "replicate_top_post" says "post": a word for a change.

    What it can reach

    • outboundThe name "replicate_top_post" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Writes new drafts, one per platform, that reuse the structure, opening type, length, format and tone of one of the account's published posts, on a new topic or a new angle; the reference post's sentences are not reused. Nothing is published or scheduled. Takes the id of a published post of the account (the ids that the account's post performance results list). Counts toward the account's daily AI limit. Available depending on the account's plan. Returns { drafts: { <platform>: { text, title?, tags? } }, reference }.

    Annotations the server declares

    • title: Draft new posts modelled on a top post
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • schedule_postQueues a post to be published at a future time (run_at, ISO 8601 with timezone, up to 365 days ahead), or in the brand's next free queue slot (run_at "next_slot": the earliest week…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "schedule_post" says "schedule": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "schedule_post" says "schedule" and "post": it writes something other people read.

    Findings

    • Info

      The description is 2,720 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."

      What this check looks for
    Description, as the server wrote it
    Queues a post to be published at a future time (run_at, ISO 8601 with timezone, up to 365 days ahead), or in the brand's next free queue slot (run_at "next_slot": the earliest weekly slot all its platforms share that no other waiting post of the brand uses; the result gives the time chosen) through the connected accounts. Takes the same content fields as publishing now. Every platform must already be connected and media must suit each platform, or it is refused now instead of failing later. When a platform is connected in more than one brand and brand_id is omitted, nothing is queued and the error lists the brands. Returns the queued item with its id and, for each platform, the handle and brand it will publish to. The plan sets how many posts can wait in the queue at once (Free: 3): past that the post is not refused but saved as held (code queue_limit, status held) — kept, never published on the current plan, and scheduled automatically when the plan is upgraded; the result then also gives that plan, its price and a checkout link. On a plan with a networks-per-post limit (Free: 2) only the first platforms are published when it runs; the result names the others in held_networks. A queued or held post can be canceled before it runs. X (Twitter) is a pay-per-use add-on on paid plans: each X post uses X credits (1 for a plain post, 10 for a post with a link, +1 per image or video) from the plan's monthly X credits, then from top-up credits; a post without enough credits is not sent to X and its result says how to get more. An X thread: per_platform.x.thread is the list of posts after per_platform.x.text (up to 25, each at most 280 characters as X counts them, a link counts 23); per_platform.x.reply is one more post under the last one, the usual place for a link. Each post of a thread or reply is an X post: it uses credits by the same rule and counts toward the daily X limit, and the whole chain is reserved before anything is sent. Write a thread only when the user asks for one. The X result then has thread.tweets (every post's id), thread_url, and thread.status: complete, or pending when X refused a later post (the first post stays published and PostWire retries the rest on its own). If the brand's approval rules or a limit on this API key or connected app hold the post, nothing is published: the result has status "pending_approval", the post's id and approval_id, who was notified and a review link, and the post goes out once a person approves it from the emailed link or the PostWire dashboard — an AI assistant or an API key cannot approve it. A limit on this key or app can also refuse a post with code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached.

    Annotations the server declares

    • title: Schedule a post
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 9Claude Code: allow
  • get_post_performanceReturns what the account's own numbers say works, over the last 90 days, computed from the numbers each network reports (no estimates): the published posts ranked against the media…Reads text others writeNo findings

    Why it is in this group

    • The name "get_post_performance" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe name "get_post_performance" says "get" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "return" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Returns what the account's own numbers say works, over the last 90 days, computed from the numbers each network reports (no estimates): the published posts ranked against the median of the same social account on the same network, each with its network, brand, link, excerpt, metric (views where the network reports them, otherwise likes + reposts + replies), value, that median, n (posts in the median), a verdict (winner at 2x the median or more, under at half or less) and what the post had (format, first-line type, question, emoji, number up front, day and time, length, hashtags); best_times: the time of day and day of week whose posts did best, with the size of the effect and both sample sizes, or — below 8 measured posts or without a clear difference — two hours to post at to learn it; streak: weeks in a row with at least one post; headline_pattern: the strongest pattern, as a sentence with its numbers; next: three concrete suggestions for the next post, each with the numbers behind it; competitors: public accounts the user watches (YouTube, Bluesky, Mastodon; TikTok captions only), their posts against their own median and what their best posts share; measurable: what each network lets PostWire read, and why the rest is not measurable. Posts younger than 24 hours are not ranked; patterns need at least 10 measured posts and 3 per group. Depending on the account's plan it also returns every pattern, the per-network detail and which formats to double down on or rethink; on a plan without them, locked.patterns_preview says which further patterns are ready and how large each effect is, without the winning value. Read-only; nothing here uses AI.

    Annotations the server declares

    • title: Show what works: best posts, times and patterns
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_post_statusReturns the status and link of a published post, by platform and the post id returned when it was published.Reads text others writeNo findings

    Why it is in this group

    • The name "get_post_status" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe name "get_post_status" says "get" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "return" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Returns the status and link of a published post, by platform and the post id returned when it was published. For a post that is waiting for approval or scheduled, pass the id PostWire returned for it (platform can then be omitted): the status is pending_approval (with who was asked and the review link), rejected (with the reason), scheduled, or each network's result once it went out. For TikTok and YouTube it asks the platform for the processing status and returns the public link once there is one. For an Instagram video returned as "processing", pass the id it returned: the answer is processing, published (with its id and link) or failed (with the reason). For networks that publish immediately it returns status "published" and, where the id allows it, the post's link (Telegram channels, including private ones as t.me/c/<channel>/<message>; Bluesky; LinkedIn; Facebook).

    Annotations the server declares

    • title: Check a post's publishing status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_uploaded_fileReturns the status of a file uploaded through a PostWire upload link, by upload_id: "waiting" until the file has arrived, then "done" with its media_url (an https URL valid for 6 h…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_uploaded_file" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_uploaded_file" says "get" and "file": it reads files.
    • private-dataThe description's first sentence says "return" and "file": it reads files.
    • untrusted-inputThe description's first sentence says "return" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Returns the status of a file uploaded through a PostWire upload link, by upload_id: "waiting" until the file has arrived, then "done" with its media_url (an https URL valid for 6 hours, renewed when the post goes out, that works as video_url or photo_url), kind (photo or video), size and content type.

    Annotations the server declares

    • title: Check an uploaded file
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_x_creditsShows what posting to X (Twitter) costs this account and what it has left.No findings

    Why it is in this group

    • The name "get_x_credits" says "get": a word for reading.
    Description, as the server wrote it
    Shows what posting to X (Twitter) costs this account and what it has left. X is a pay-per-use add-on of the paid plans (Starter, Pro, Agency, Scale; not Free, not during a trial): 1 X credit = 1 plain X post, a post with a link uses 10, each image or video adds 1. Returns mode (paid, free, trial or internal), the plan's monthly X credits, used and left, top-up credits, X posts today against the daily limit, the price table, the last movements, and links to buy top-up credits (80 credits for $5, 340 for $20; each opens a Stripe payment page, nothing is charged unless paid there). With text, it also returns how many credits that post would use (with thread or reply: the whole chain).

    Annotations the server declares

    • title: Show my X (Twitter) credits
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_brandsLists the account's brands (one business each) with the social accounts connected to each: platform, the handle, display name, picture and profile link the network reports, when it…Reads text others writeNo findings

    Why it is in this group

    • The name "list_brands" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Lists the account's brands (one business each) with the social accounts connected to each: platform, the handle, display name, picture and profile link the network reports, when it was connected, and whether posts to it need only text, a video, or a photo or video. Also returns the plan's brand limit.

    Annotations the server declares

    • title: List brands and their connected accounts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_platformsLists the social platforms and destinations PostWire can publish to and, for each, whether it connects with OAuth or with credentials (fields, plus optional_fields), and kind "arti…Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "list_platforms" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "credential": it reads secrets.
    • untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...whether it connects with OAuth or with credentials (fields, plus optional_fields), and kin..."

      What this check looks for
    Description, as the server wrote it
    Lists the social platforms and destinations PostWire can publish to and, for each, whether it connects with OAuth or with credentials (fields, plus optional_fields), and kind "article" for the blogs (WordPress, Dev.to, Hashnode), where a post is an article with a title. Does not need a PostWire account.

    Annotations the server declares

    • title: List supported platforms
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_scheduled_postsLists the account's scheduled posts (queued, held, pending_approval = waiting for a person to approve it, publishing, processing = sent and Instagram is still processing the video,…Reads text others writeNo findings

    Why it is in this group

    • The name "list_scheduled_posts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe name "list_scheduled_posts" says "list" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Lists the account's scheduled posts (queued, held, pending_approval = waiting for a person to approve it, publishing, processing = sent and Instagram is still processing the video, done, failed, rejected = not approved, or canceled) with their id, time, platforms and status. Optional from/to limit the time range.

    Annotations the server declares

    • title: List scheduled posts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • my_accountShows the signed-in PostWire account: plan, usage against each plan limit (posts this month, brands, AI drafts today, networks per post, scheduled posts waiting), brands, and which…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "show": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "show" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Shows the signed-in PostWire account: plan, usage against each plan limit (posts this month, brands, AI drafts today, networks per post, scheduled posts waiting), brands, and which social accounts are connected, each with its brand and the handle, display name and picture the network reports for it. When a limit is at least 80 % used, the result includes the plan that raises it, its monthly price and a checkout link. On the free plan it also includes insights_teaser: how many What works patterns are ready and how strong they are. When no social account is connected, it includes a one-hour link to a page where several networks can be connected, and message_for_user: one plain sentence for the person. While the account has not published anything yet, next_step.say_this is one exact sentence the person can say to get the first post out (for example: connect a network and post, or post a first video). A free account that has not had a trial gets trial_offer: Pro now with the first month 50% off ("Get Pro today: first month $14.50 (50% off), then $29/month. Cancel anytime."), its terms in one sentence and its link; a trial that is running is described in trial.

    Annotations the server declares

    • title: Show my PostWire account
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

130 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 private-data tools breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write13
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out5
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__postwire__get_uploaded_file",
      "mcp__postwire__list_platforms"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:54 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
12
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://postwire.io/.well-known/oauth-protected-resource/api/mcp
Authorization servers
https://postwire.io
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
yes
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 12 tools that change things (2 destructive, 10 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://postwire.io/api/mcp: tools/list returned 22 tools to an anonymous client, including post_to_social (destructive), cancel_scheduled_post (destructive), generate_posts (write), schedule_post (write), create_connect_link (write) and 7 more

    What this check looks for

Install

Pinned to version 0.3.5. Values in angle brackets are yours to fill in.

claude mcp add --transport http postwire https://postwire.io/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__postwire__list_platforms",
      "mcp__postwire__my_account",
      "mcp__postwire__list_scheduled_posts",
      "mcp__postwire__get_post_status",
      "mcp__postwire__list_brands",
      "mcp__postwire__get_uploaded_file",
      "mcp__postwire__get_upgrade_link",
      "mcp__postwire__get_x_credits",
      "mcp__postwire__get_post_performance"
    ],
    "ask": [
      "mcp__postwire__generate_posts",
      "mcp__postwire__schedule_post",
      "mcp__postwire__create_connect_link",
      "mcp__postwire__plan_week",
      "mcp__postwire__bulk_schedule",
      "mcp__postwire__create_recurring_post",
      "mcp__postwire__create_brand",
      "mcp__postwire__create_upload_link",
      "mcp__postwire__make_video_from_text",
      "mcp__postwire__replicate_top_post"
    ],
    "deny": [
      "mcp__postwire__post_to_social",
      "mcp__postwire__cancel_scheduled_post"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as postwire. Review it before you use it.

Capability tags behind 15 rules
  • mcp__postwire__list_platforms private-data, untrusted-input
  • mcp__postwire__my_account untrusted-input
  • mcp__postwire__generate_posts outbound
  • mcp__postwire__post_to_social untrusted-input, outbound
  • mcp__postwire__schedule_post untrusted-input, outbound
  • mcp__postwire__list_scheduled_posts untrusted-input
  • mcp__postwire__get_post_status untrusted-input
  • mcp__postwire__plan_week untrusted-input
  • mcp__postwire__bulk_schedule untrusted-input
  • mcp__postwire__create_recurring_post untrusted-input, outbound
  • mcp__postwire__list_brands untrusted-input
  • mcp__postwire__get_uploaded_file private-data, untrusted-input
  • mcp__postwire__get_upgrade_link untrusted-input
  • mcp__postwire__get_post_performance untrusted-input
  • mcp__postwire__replicate_top_post outbound