PostWire
by Perufitlife · remote · local (npm) · no sign-in to list tools · v0.3.5 · published by GitHub user Perufitlife
Writes a native post per network from one idea and publishes it: TikTok, Instagram, YouTube & more
21 tools: 2 can delete or cancel things, 10 change things and 9 only read.
Scanned Oct 21, 2026
- Deletes or cancels2Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things10Claude Code: ask: see these tools
- Only reads9Claude Code: allow: see these tools
3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http postwire https://postwire.io/api/mcpFindings
Matches of fixed checks, with the text they matched.
- Infolist_platforms
The description mentions "credentials".
What this check looks forMatched text
description: "...whether it connects with OAuth or with credentials (fields, plus optional_fields), and kin..."
- Infopost_to_social
The description is 3,583 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."
- Infoschedule_post
The description is 2,720 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
21 tools
Deletes or cancels 2Claude Code: deny
cancel_scheduled_postCancels a queued or held post, or withdraws one waiting for approval, so it is never published (a withdrawn post's approval links stop working).No findings
Why it is in this group
- The name "cancel_scheduled_post" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Cancels a queued or held post, or withdraws one waiting for approval, so it is never published (a withdrawn post's approval links stop working). Only works before it starts publishing. Takes the id of the scheduled post.
Annotations the server declares
- title: Cancel a scheduled post
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
post_to_socialPublishes a post immediately and publicly to the listed platforms through the social accounts connected to the user's PostWire account.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "post_to_social" says "post": a word for a change.
- The description's first verb is "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "post_to_social" says "post": it sends or publishes something to other people.
Findings
- Info
The description is 3,583 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."
Description, as the server wrote it Publishes a post immediately and publicly to the listed platforms through the social accounts connected to the user's PostWire account. A published post cannot be withdrawn from PostWire. Accepts one text for all platforms or a separate per_platform draft for each. YouTube requires video_url; TikTok requires video_url or photos (photo_url or media); Instagram requires a photo or video, and two or more media items make a carousel. Every platform must already be connected; otherwise nothing is published and the error names the missing ones. The same payload sent twice within 2 minutes is refused as a duplicate unless idempotency_key differs. When a platform is connected in more than one brand and brand_id is omitted, nothing is published and the error lists the brands. Returns { posted, published_to, results: [{ platform, ok, id?, url?, account?, error? }] }, where account and published_to name the handle and brand each post went to. After the account's first post through this connection, next_step proposes a week of posts on the same topic for the text networks it went to (its topic and platforms); nothing is queued until the person asks for it. The plan sets how many networks one post goes out to (Free: 2): only the first platforms in the list are published and each of the others comes back with ok: false, held: true and code networks_per_post (its version was written and not sent), listed in held_networks with a one-sentence held_message, and message_for_user says it in plain words for the person; every network can still be connected and written for. TikTok and Instagram videos may still be processing when this returns (status processing, no url yet). When the networks-per-post or the monthly post limit stops a platform, the result also names the plan that lifts it, its price and a checkout link, and, for a free account that has not had one, a link to Pro with the first month 50% off (trial_offer: paid today, then the regular monthly price, cancel anytime). Such an account also gets the trial link once after its first post from an assistant, with a one-sentence trial_message. X (Twitter) is a pay-per-use add-on on paid plans: each X post uses X credits (1 for a plain post, 10 for a post with a link, +1 per image or video) from the plan's monthly X credits, then from top-up credits; a post without enough credits is not sent to X and its result says how to get more. An X thread: per_platform.x.thread is the list of posts after per_platform.x.text (up to 25, each at most 280 characters as X counts them, a link counts 23); per_platform.x.reply is one more post under the last one, the usual place for a link. Each post of a thread or reply is an X post: it uses credits by the same rule and counts toward the daily X limit, and the whole chain is reserved before anything is sent. Write a thread only when the user asks for one. The X result then has thread.tweets (every post's id), thread_url, and thread.status: complete, or pending when X refused a later post (the first post stays published and PostWire retries the rest on its own). If the brand's approval rules or a limit on this API key or connected app hold the post, nothing is published: the result has status "pending_approval", the post's id and approval_id, who was notified and a review link, and the post goes out once a person approves it from the emailed link or the PostWire dashboard — an AI assistant or an API key cannot approve it. A limit on this key or app can also refuse a post with code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached.
Annotations the server declares
- title: Publish a post now
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
Changes things 10Claude Code: ask
bulk_scheduleChecks, and on request schedules, many posts at once: a CSV file's text (csv) or a list of rows (rows), each row one post with the columns date ("2026-10-12 09:00" in the row's or …Reads text others writeNo findings
Why it is in this group
- The name "bulk_schedule" says "schedule": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Checks, and on request schedules, many posts at once: a CSV file's text (csv) or a list of rows (rows), each row one post with the columns date ("2026-10-12 09:00" in the row's or the upload's timezone, an ISO time with offset, or "next_slot"), networks ("linkedin, x"), text, optional text_<network> (each network its own text), media_urls (https links; video: or document: prefix), alt_text, first_comment (LinkedIn, Bluesky, Mastodon), x_reply and x_thread (X), title, brand and label. dry_run defaults to true: nothing is scheduled and the result lists, for every row, the time it would go out, its networks, each network's length as that network counts it, the X credits it would use, whether it would wait for approval or be held by the plan, and its errors and warnings. With dry_run false the upload is scheduled whole or not at all: if any row has an error nothing is scheduled (code bulk_rows_invalid) and each row says what to fix. The plan limits rows per upload (Free 20, Starter 500, Pro 1,000, Agency 2,000, Scale 5,000); on Free, posts past the 3 scheduled at a time are saved as held. The same upload twice is refused (code bulk_already_scheduled) unless allow_duplicate is true. The result has batch_id; DELETE /api/bulk/{batch_id} undoes the whole upload. Write the rows for the user when they describe a content plan; show them the dry run before scheduling.
Annotations the server declares
- title: Schedule many posts at once (CSV or rows)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_brandCreates a new, empty brand (a separate business with its own connected social accounts) on the PostWire account and returns its id.No findings
Why it is in this group
- The name "create_brand" says "create": a word for a change.
Description, as the server wrote it Creates a new, empty brand (a separate business with its own connected social accounts) on the PostWire account and returns its id. The plan limits the number of brands; at the limit nothing is created and the response names the plan that includes more brands, its monthly price and a checkout link.
Annotations the server declares
- title: Create a brand
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_connect_linkCreates a one-hour link the user opens in a browser to connect social accounts (TikTok, Instagram, YouTube, Facebook Pages, LinkedIn, Bluesky…) to their PostWire account: the page …No findings
Why it is in this group
- The name "create_connect_link" says "create": a word for a change.
Description, as the server wrote it Creates a one-hour link the user opens in a browser to connect social accounts (TikTok, Instagram, YouTube, Facebook Pages, LinkedIn, Bluesky…) to their PostWire account: the page shows each network as a button, signs in to it on the network's own page, and then offers the next one, so several networks can be connected from one link. Nothing is connected until the user completes it on the page. With platform the page offers only that network; with brand_id the accounts are connected to that brand. Instagram opens with Log in with Instagram (a Business or Creator account, no Facebook Page needed), and the page also offers connecting through a Facebook Page. Returns the url of that page and message_for_user: one plain sentence telling the person what to do.
Annotations the server declares
- title: Get a link to connect a social account
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_recurring_postSets up a post that repeats on a schedule: daily, weekly on some weekdays, or monthly on some days of the month (31 falls on the last day of shorter months; -1 = the last day), eve…Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_recurring_post" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "create_recurring_post" says "create" and "post": it writes something other people read.
Description, as the server wrote it Sets up a post that repeats on a schedule: daily, weekly on some weekdays, or monthly on some days of the month (31 falls on the last day of shorter months; -1 = the last day), every N days, weeks or months, at 1-4 times a day in a timezone (daylight saving handled), from a start date until an end date or for a number of times. variants (a list of texts) are used in turn, so the same text does not repeat every time. The duplicate guard (guard_days, default 3, 0 = off) skips a network where the same text went out in the last guard_days when an occurrence is published: networks flag repeated posts. Occurrences are put in the queue up to 7 days ahead as ordinary scheduled posts (each can be edited or canceled alone), and go through the brand's approval rules and the plan's limits like any post. On every paid plan (Starter 25, Pro 100, Agency 500, Scale 2,000 at a time); not on Free. Returns the recurring post with its next occurrences and any warnings (for example: one text every day with a 3-day guard would be skipped).
Annotations the server declares
- title: Set up a recurring post
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_upload_linkCreates a single-use link, valid for 24 hours, to a PostWire page where the user picks one photo or video from any device (JPG, PNG, WebP, GIF, MP4, MOV or WebM, up to 1 GB; big vi…No findings
Why it is in this group
- The name "create_upload_link" says "create": a word for a change.
Description, as the server wrote it Creates a single-use link, valid for 24 hours, to a PostWire page where the user picks one photo or video from any device (JPG, PNG, WebP, GIF, MP4, MOV or WebM, up to 1 GB; big videos upload in parts automatically). The file stays in the account's PostWire media storage while a scheduled post needs it, is deleted the day after that post is published, and 7 days after upload if no post uses it (2 days on the Free plan; so post or schedule it soon). A file attached to a chat does not reach PostWire; this page is how it gets there. Returns the page url, an upload_id for checking the upload's status, and message_for_user: one plain sentence telling the person what to open and do.
Annotations the server declares
- title: Get a link to upload a photo or video
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
generate_postsWrites one draft per platform from a single idea, adapted to each network's rules (character limit, hashtags, title and tags for YouTube, hook-first caption for TikTok and Reels, l…Can send data outNo findings
Why it is in this group
- The name "generate_posts" says "generate": a word for a change.
What it can reach
- outboundThe name "generate_posts" says "generate" and "post": it writes something other people read.
Description, as the server wrote it Writes one draft per platform from a single idea, adapted to each network's rules (character limit, hashtags, title and tags for YouTube, hook-first caption for TikTok and Reels, link placement for LinkedIn, Slack formatting, plain text for Nostr). For the blogs (wordpress, devto, hashnode) the draft is a full article: title (<= 70 characters), summary (120-160 characters), a Markdown body with H2 sections, and 3-5 tags (Dev.to: 4). Nothing is published. Returns { drafts: { <platform>: { text, title?, tags?, summary?, thread?, first_comment? } } } and, if the writer skipped a platform, { missing: [...] }. thread (the posts after text) comes back when the user asks for a thread (X, Bluesky, Mastodon), or on Bluesky and Mastodon when the idea is too long for one post there; first_comment comes with it when the idea has a link (LinkedIn, X, Bluesky, Mastodon), so the link goes in the first comment. Counts toward the account's daily AI limit.
Annotations the server declares
- title: Write a native draft for each platform
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
make_video_from_textMakes a short vertical video from the words of a post, for networks that take only video (YouTube) or video or photos (TikTok): an MP4 of 1080x1920, 8 to 12 seconds, H.264 with AAC…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Makes a short vertical video from the words of a post, for networks that take only video (YouTube) or video or photos (TikTok): an MP4 of 1080x1920, 8 to 12 seconds, H.264 with AAC sound. The first line appears as a large heading and up to two more sentences appear one after another over a softly moving plain background, with royalty-free background music or silence; an optional footer line (for example the brand's name) sits under the text. Emoji, links and trailing hashtags are left out and no PostWire mark is added. Draws Latin, Greek and Cyrillic text. No AI is used and nothing is published. The file stays in the account's PostWire media storage while a scheduled post needs it, is deleted the day after that post is published, and 7 days after upload if no post uses it (2 days on the Free plan; so post or schedule it soon). Returns media_url (an https URL valid for 6 hours, renewed when the post goes out, that works as video_url), duration_s, text_on_video (the lines shown) and message_for_user. Up to 10 videos an hour per account, and per day 10 on the Free plan and 60 on paid plans.
Annotations the server declares
- title: Make a short video from a post's words
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
plan_weekWrites one post per day for 1 to 7 days from a single topic, each day from a different angle and each platform in its own native format, and queues them to be published publicly at…Reads text others writeNo findings
Why it is in this group
- The description's first verb is "write": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Writes one post per day for 1 to 7 days from a single topic, each day from a different angle and each platform in its own native format, and queues them to be published publicly at the given hour on each day starting tomorrow, through the connected accounts. Text only: platforms that require a video or photo (TikTok, YouTube, Instagram) are refused. Every platform must already be connected. The whole week counts as one AI draft toward the daily AI limit. Every day is written; days that do not fit in the plan's monthly post limit or in its scheduled-posts limit (Free: 3 waiting at a time) are saved as held (never published on the current plan; each says held_for) and are scheduled automatically when the plan is upgraded; the result then also gives that plan, its price and a checkout link. On a plan with a networks-per-post limit (Free: 2) each day goes out to the first platforms only, named in held_networks. Returns the queued and held items with their id, time and a preview of each platform's text; any of them can be canceled before it runs. If the brand's approval rules or a limit on this API key or connected app hold the post, nothing is published: the result has status "pending_approval", the post's id and approval_id, who was notified and a review link, and the post goes out once a person approves it from the emailed link or the PostWire dashboard — an AI assistant or an API key cannot approve it. A limit on this key or app can also refuse a post with code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached.
Annotations the server declares
- title: Plan and schedule a week of posts
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
replicate_top_postWrites new drafts, one per platform, that reuse the structure, opening type, length, format and tone of one of the account's published posts, on a new topic or a new angle; the ref…Can send data outNo findings
Why it is in this group
- The name "replicate_top_post" says "post": a word for a change.
What it can reach
- outboundThe name "replicate_top_post" says "post": it sends or publishes something to other people.
Description, as the server wrote it Writes new drafts, one per platform, that reuse the structure, opening type, length, format and tone of one of the account's published posts, on a new topic or a new angle; the reference post's sentences are not reused. Nothing is published or scheduled. Takes the id of a published post of the account (the ids that the account's post performance results list). Counts toward the account's daily AI limit. Available depending on the account's plan. Returns { drafts: { <platform>: { text, title?, tags? } }, reference }.
Annotations the server declares
- title: Draft new posts modelled on a top post
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
schedule_postQueues a post to be published at a future time (run_at, ISO 8601 with timezone, up to 365 days ahead), or in the brand's next free queue slot (run_at "next_slot": the earliest week…Reads text others writeCan send data out1 finding
Why it is in this group
- The name "schedule_post" says "schedule": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "schedule_post" says "schedule" and "post": it writes something other people read.
Findings
- Info
The description is 2,720 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...h code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached."
Description, as the server wrote it Queues a post to be published at a future time (run_at, ISO 8601 with timezone, up to 365 days ahead), or in the brand's next free queue slot (run_at "next_slot": the earliest weekly slot all its platforms share that no other waiting post of the brand uses; the result gives the time chosen) through the connected accounts. Takes the same content fields as publishing now. Every platform must already be connected and media must suit each platform, or it is refused now instead of failing later. When a platform is connected in more than one brand and brand_id is omitted, nothing is queued and the error lists the brands. Returns the queued item with its id and, for each platform, the handle and brand it will publish to. The plan sets how many posts can wait in the queue at once (Free: 3): past that the post is not refused but saved as held (code queue_limit, status held) — kept, never published on the current plan, and scheduled automatically when the plan is upgraded; the result then also gives that plan, its price and a checkout link. On a plan with a networks-per-post limit (Free: 2) only the first platforms are published when it runs; the result names the others in held_networks. A queued or held post can be canceled before it runs. X (Twitter) is a pay-per-use add-on on paid plans: each X post uses X credits (1 for a plain post, 10 for a post with a link, +1 per image or video) from the plan's monthly X credits, then from top-up credits; a post without enough credits is not sent to X and its result says how to get more. An X thread: per_platform.x.thread is the list of posts after per_platform.x.text (up to 25, each at most 280 characters as X counts them, a link counts 23); per_platform.x.reply is one more post under the last one, the usual place for a link. Each post of a thread or reply is an X post: it uses credits by the same rule and counts toward the daily X limit, and the whole chain is reserved before anything is sent. Write a thread only when the user asks for one. The X result then has thread.tweets (every post's id), thread_url, and thread.status: complete, or pending when X refused a later post (the first post stays published and PostWire retries the rest on its own). If the brand's approval rules or a limit on this API key or connected app hold the post, nothing is published: the result has status "pending_approval", the post's id and approval_id, who was notified and a review link, and the post goes out once a person approves it from the emailed link or the PostWire dashboard — an AI assistant or an API key cannot approve it. A limit on this key or app can also refuse a post with code key_network_not_allowed, key_brand_not_allowed or key_monthly_cap_reached.
Annotations the server declares
- title: Schedule a post
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Only reads 9Claude Code: allow
get_post_performanceReturns what the account's own numbers say works, over the last 90 days, computed from the numbers each network reports (no estimates): the published posts ranked against the media…Reads text others writeNo findings
Why it is in this group
- The name "get_post_performance" says "get": a word for reading.
What it can reach
- untrusted-inputThe name "get_post_performance" says "get" and "post": it reads posts, which other people can write.
- untrusted-inputThe description's first sentence says "return" and "post": it reads posts, which other people can write.
Description, as the server wrote it Returns what the account's own numbers say works, over the last 90 days, computed from the numbers each network reports (no estimates): the published posts ranked against the median of the same social account on the same network, each with its network, brand, link, excerpt, metric (views where the network reports them, otherwise likes + reposts + replies), value, that median, n (posts in the median), a verdict (winner at 2x the median or more, under at half or less) and what the post had (format, first-line type, question, emoji, number up front, day and time, length, hashtags); best_times: the time of day and day of week whose posts did best, with the size of the effect and both sample sizes, or — below 8 measured posts or without a clear difference — two hours to post at to learn it; streak: weeks in a row with at least one post; headline_pattern: the strongest pattern, as a sentence with its numbers; next: three concrete suggestions for the next post, each with the numbers behind it; competitors: public accounts the user watches (YouTube, Bluesky, Mastodon; TikTok captions only), their posts against their own median and what their best posts share; measurable: what each network lets PostWire read, and why the rest is not measurable. Posts younger than 24 hours are not ranked; patterns need at least 10 measured posts and 3 per group. Depending on the account's plan it also returns every pattern, the per-network detail and which formats to double down on or rethink; on a plan without them, locked.patterns_preview says which further patterns are ready and how large each effect is, without the winning value. Read-only; nothing here uses AI.
Annotations the server declares
- title: Show what works: best posts, times and patterns
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_post_statusReturns the status and link of a published post, by platform and the post id returned when it was published.Reads text others writeNo findings
Why it is in this group
- The name "get_post_status" says "get": a word for reading.
What it can reach
- untrusted-inputThe name "get_post_status" says "get" and "post": it reads posts, which other people can write.
- untrusted-inputThe description's first sentence says "return" and "post": it reads posts, which other people can write.
Description, as the server wrote it Returns the status and link of a published post, by platform and the post id returned when it was published. For a post that is waiting for approval or scheduled, pass the id PostWire returned for it (platform can then be omitted): the status is pending_approval (with who was asked and the review link), rejected (with the reason), scheduled, or each network's result once it went out. For TikTok and YouTube it asks the platform for the processing status and returns the public link once there is one. For an Instagram video returned as "processing", pass the id it returned: the answer is processing, published (with its id and link) or failed (with the reason). For networks that publish immediately it returns status "published" and, where the id allows it, the post's link (Telegram channels, including private ones as t.me/c/<channel>/<message>; Bluesky; LinkedIn; Facebook).
Annotations the server declares
- title: Check a post's publishing status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_upgrade_linkReturns PostWire's paid plans with their monthly price and what each includes (posts a month, brands, AI drafts a day, networks per post, scheduled posts at a time), the account's …Reads text others writeNo findings
Why it is in this group
- The name "get_upgrade_link" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "return" and "post": it reads posts, which other people can write.
Description, as the server wrote it Returns PostWire's paid plans with their monthly price and what each includes (posts a month, brands, AI drafts a day, networks per post, scheduled posts at a time), the account's current plan, and a checkout link for one plan (the next plan up when none is given). The link opens a Stripe payment page in the browser and nothing is charged unless the user pays there; for an account that already has a subscription it opens the plan page of the PostWire dashboard.
Annotations the server declares
- title: Show plans and get an upgrade link
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_uploaded_fileReturns the status of a file uploaded through a PostWire upload link, by upload_id: "waiting" until the file has arrived, then "done" with its media_url (an https URL valid for 6 h…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_uploaded_file" says "get": a word for reading.
What it can reach
- private-dataThe name "get_uploaded_file" says "get" and "file": it reads files.
- private-dataThe description's first sentence says "return" and "file": it reads files.
- untrusted-inputThe description's first sentence says "return" and "post": it reads posts, which other people can write.
Description, as the server wrote it Returns the status of a file uploaded through a PostWire upload link, by upload_id: "waiting" until the file has arrived, then "done" with its media_url (an https URL valid for 6 hours, renewed when the post goes out, that works as video_url or photo_url), kind (photo or video), size and content type.
Annotations the server declares
- title: Check an uploaded file
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_x_creditsShows what posting to X (Twitter) costs this account and what it has left.No findings
Why it is in this group
- The name "get_x_credits" says "get": a word for reading.
Description, as the server wrote it Shows what posting to X (Twitter) costs this account and what it has left. X is a pay-per-use add-on of the paid plans (Starter, Pro, Agency, Scale; not Free, not during a trial): 1 X credit = 1 plain X post, a post with a link uses 10, each image or video adds 1. Returns mode (paid, free, trial or internal), the plan's monthly X credits, used and left, top-up credits, X posts today against the daily limit, the price table, the last movements, and links to buy top-up credits (80 credits for $5, 340 for $20; each opens a Stripe payment page, nothing is charged unless paid there). With text, it also returns how many credits that post would use (with thread or reply: the whole chain).
Annotations the server declares
- title: Show my X (Twitter) credits
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_brandsLists the account's brands (one business each) with the social accounts connected to each: platform, the handle, display name, picture and profile link the network reports, when it…Reads text others writeNo findings
Why it is in this group
- The name "list_brands" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
Description, as the server wrote it Lists the account's brands (one business each) with the social accounts connected to each: platform, the handle, display name, picture and profile link the network reports, when it was connected, and whether posts to it need only text, a video, or a photo or video. Also returns the plan's brand limit.
Annotations the server declares
- title: List brands and their connected accounts
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_platformsLists the social platforms and destinations PostWire can publish to and, for each, whether it connects with OAuth or with credentials (fields, plus optional_fields), and kind "arti…Reads private dataReads text others write1 finding
Why it is in this group
- The name "list_platforms" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "credential": it reads secrets.
- untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...whether it connects with OAuth or with credentials (fields, plus optional_fields), and kin..."
Description, as the server wrote it Lists the social platforms and destinations PostWire can publish to and, for each, whether it connects with OAuth or with credentials (fields, plus optional_fields), and kind "article" for the blogs (WordPress, Dev.to, Hashnode), where a post is an article with a title. Does not need a PostWire account.
Annotations the server declares
- title: List supported platforms
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_scheduled_postsLists the account's scheduled posts (queued, held, pending_approval = waiting for a person to approve it, publishing, processing = sent and Instagram is still processing the video,…Reads text others writeNo findings
Why it is in this group
- The name "list_scheduled_posts" says "list": a word for reading.
What it can reach
- untrusted-inputThe name "list_scheduled_posts" says "list" and "post": it reads posts, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
Description, as the server wrote it Lists the account's scheduled posts (queued, held, pending_approval = waiting for a person to approve it, publishing, processing = sent and Instagram is still processing the video, done, failed, rejected = not approved, or canceled) with their id, time, platforms and status. Optional from/to limit the time range.
Annotations the server declares
- title: List scheduled posts
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
my_accountShows the signed-in PostWire account: plan, usage against each plan limit (posts this month, brands, AI drafts today, networks per post, scheduled posts waiting), brands, and which…Reads text others writeNo findings
Why it is in this group
- The description's first verb is "show": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "show" and "post": it reads posts, which other people can write.
Description, as the server wrote it Shows the signed-in PostWire account: plan, usage against each plan limit (posts this month, brands, AI drafts today, networks per post, scheduled posts waiting), brands, and which social accounts are connected, each with its brand and the handle, display name and picture the network reports for it. When a limit is at least 80 % used, the result includes the plan that raises it, its monthly price and a checkout link. On the free plan it also includes insights_teaser: how many What works patterns are ready and how strong they are. When no social account is connected, it includes a one-hour link to a page where several networks can be connected, and message_for_user: one plain sentence for the person. While the account has not published anything yet, next_step.say_this is one exact sentence the person can say to get the first post out (for example: connect a network and post, or post a first video). A free account that has not had a trial gets trial_offer: Pro now with the first month 50% off ("Get Pro today: first month $14.50 (50% off), then $29/month. Cancel anytime."), its terms in one sentence and its link; a trial that is running is described in trial.
Annotations the server declares
- title: Show my PostWire account
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
130 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 private-data tools breaks every one.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write13
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out5
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__postwire__get_uploaded_file",
"mcp__postwire__list_platforms"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:54 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 12
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- https://postwire.io/.well-known/oauth-protected-resource/api/mcp
- Authorization servers
- https://postwire.io
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- yes
- Client ID metadata documents
- yes
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 12 tools that change things (2 destructive, 10 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://postwire.io/api/mcp: tools/list returned 22 tools to an anonymous client, including post_to_social (destructive), cancel_scheduled_post (destructive), generate_posts (write), schedule_post (write), create_connect_link (write) and 7 more
Install
Pinned to version 0.3.5. Values in angle brackets are yours to fill in.
claude mcp add --transport http postwire https://postwire.io/api/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__postwire__list_platforms",
"mcp__postwire__my_account",
"mcp__postwire__list_scheduled_posts",
"mcp__postwire__get_post_status",
"mcp__postwire__list_brands",
"mcp__postwire__get_uploaded_file",
"mcp__postwire__get_upgrade_link",
"mcp__postwire__get_x_credits",
"mcp__postwire__get_post_performance"
],
"ask": [
"mcp__postwire__generate_posts",
"mcp__postwire__schedule_post",
"mcp__postwire__create_connect_link",
"mcp__postwire__plan_week",
"mcp__postwire__bulk_schedule",
"mcp__postwire__create_recurring_post",
"mcp__postwire__create_brand",
"mcp__postwire__create_upload_link",
"mcp__postwire__make_video_from_text",
"mcp__postwire__replicate_top_post"
],
"deny": [
"mcp__postwire__post_to_social",
"mcp__postwire__cancel_scheduled_post"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as postwire. Review it before you use it.
Capability tags behind 15 rules
- mcp__postwire__list_platforms private-data, untrusted-input
- mcp__postwire__my_account untrusted-input
- mcp__postwire__generate_posts outbound
- mcp__postwire__post_to_social untrusted-input, outbound
- mcp__postwire__schedule_post untrusted-input, outbound
- mcp__postwire__list_scheduled_posts untrusted-input
- mcp__postwire__get_post_status untrusted-input
- mcp__postwire__plan_week untrusted-input
- mcp__postwire__bulk_schedule untrusted-input
- mcp__postwire__create_recurring_post untrusted-input, outbound
- mcp__postwire__list_brands untrusted-input
- mcp__postwire__get_uploaded_file private-data, untrusted-input
- mcp__postwire__get_upgrade_link untrusted-input
- mcp__postwire__get_post_performance untrusted-input
- mcp__postwire__replicate_top_post outbound
