Is Postfast Mcp safe to install?

SaferSkills independently audited Postfast Mcp (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md6.7 KB · Markdown

PostFast MCP Server

MCP server for the PostFast API — schedule and manage social media posts via AI tools like Claude, Cursor, VS Code, and more.

Hosted connector (no install)

Prefer not to run anything locally? Connect to the hosted endpoint and authenticate with OAuth — no npx, no API key to manage:

https://mcp.postfa.st/mcp

Add it as a remote/streamable-HTTP MCP server in any client that supports OAuth (e.g. ChatGPT, Claude). You'll be prompted to sign in to PostFast and authorize access on first use.

Want to run the server yourself instead? Use the npx + API-key setup in Quick Start below.

Quick Start

1. Get your API key

2. Install

Choose your preferred method:

#### Claude Desktop (recommended)

Download the extension from the Claude Desktop extension directory or install manually:

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "postfast": {
      "command": "npx",
      "args": ["-y", "postfast-mcp"],
      "env": {
        "POSTFAST_API_KEY": "your-api-key-here"
      }
    }
  }
}

Restart Claude Desktop.

#### Claude Code

Via plugin (pending marketplace approval):

/plugin install postfast@claude-plugins-official

After installing, set your API key — pick one of these:

# Option A: Add to your shell profile (~/.zshrc or ~/.bashrc)
export POSTFAST_API_KEY="your-api-key-here"

# Option B: Add to ~/.claude/settings.local.json
# { "env": { "POSTFAST_API_KEY": "your-api-key-here" } }

Then restart Claude Code.

Via manual config:

Add to your project's .mcp.json or ~/.claude/.mcp.json (global):

{
  "mcpServers": {
    "postfast": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "postfast-mcp"],
      "env": {
        "POSTFAST_API_KEY": "your-api-key-here"
      }
    }
  }
}

#### Cursor / VS Code / Windsurf / Other MCP clients

Add to your MCP config (.mcp.json, mcp.json, or the tool's settings UI):

{
  "mcpServers": {
    "postfast": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "postfast-mcp"],
      "env": {
        "POSTFAST_API_KEY": "your-api-key-here"
      }
    }
  }
}

3. Use it

Ask your AI assistant things like:

"List my connected social accounts"
"Schedule a post to Instagram for tomorrow at 9am"
"Show me all scheduled posts for this week"
"Upload this image and create a LinkedIn post with it"
"Create a Facebook reel with this video"
"Show me analytics for my Instagram posts this month"

Available Tools

Tool	Description
`list_accounts`	List connected social media accounts (each with `connectionStatus` — `CONNECTED`/`DISABLED` — and `disabledReason`)
`list_posts`	List posts with filters (specific IDs, platform, status, date range)
`create_posts`	Create and schedule posts (batch, up to 15)
`delete_post`	Delete a post by ID
`upload_media`	Upload a local file and get a media key (handles the full flow)
`get_upload_urls`	Get signed URLs to upload media files
`list_pinterest_boards`	Get Pinterest boards for an account
`list_youtube_playlists`	Get YouTube playlists for an account
`list_gbp_locations`	Get Google Business Profile locations for an account
`search_places`	Find a place to tag posts (the `id` works for both `facebookPlaceId` and `instagramLocationId`)
`generate_connect_link`	Generate a link for clients to connect accounts
`get_post_analytics`	Fetch published posts with performance metrics — Instagram, Facebook, TikTok, Threads, YouTube, LinkedIn (company pages), Pinterest (Business accounts)
`get_follower_history`	Daily follower-count history for an account (current count + `delta` over a date range) — Facebook Pages, Instagram, YouTube, Pinterest, Threads, Bluesky, Telegram, LinkedIn (company pages)

Supported Platforms

Facebook, Instagram, X (Twitter), TikTok, LinkedIn, YouTube, BlueSky, Threads, Pinterest, Telegram, Google Business Profile

Platform-Specific Controls

When creating posts, you can pass platform-specific settings via the controls parameter:

Platform	Controls
X (Twitter)	`xRetweetUrl`
Instagram	`instagramPublishType` (TIMELINE/STORY/REEL), `instagramPostToGrid`, `instagramCollaborators`, `instagramLocationId`/`instagramLocationName` (geotag from `search_places`)
Facebook	`facebookContentType` (POST/REEL/STORY), `facebookAllowComments`, `facebookPrivacy`, `facebookReelsCollaborators`, `facebookTargetCountries` (ISO alpha-2, max 25), `facebookPlaceId`/`facebookPlaceName` (geotag from `search_places`)
TikTok	`tiktokPrivacy` (PUBLIC/MUTUAL_FRIENDS/FOLLOWER_OF_CREATOR/ONLY_ME), `tiktokIsDraft`, `tiktokAllowComments`, `tiktokAllowDuet`, `tiktokAllowStitch`, `tiktokBrandOrganic`, `tiktokBrandContent`, `tiktokAutoAddMusic`, `tiktokIsAigc`
YouTube	`youtubeTitle`, `youtubePrivacy` (PUBLIC/PRIVATE/UNLISTED), `youtubeTags`, `youtubeCategoryId`, `youtubeIsShort`, `youtubeMadeForKids`, `youtubePlaylistId`, `youtubeThumbnailKey`
Pinterest	`pinterestBoardId` (required), `pinterestLink`
LinkedIn	`linkedinAttachmentKey`, `linkedinAttachmentTitle`
Google Business Profile	`gbpLocationId` (required), `gbpTopicType` (STANDARD/EVENT/OFFER), `gbpCallToActionType`, `gbpCallToActionUrl`, `gbpEventTitle`, `gbpEventStartDate`, `gbpEventEndDate`, `gbpOfferCouponCode`, `gbpOfferRedeemUrl`, `gbpOfferTerms`

Media Upload

The upload_media tool handles the full flow in a single call:

Detects content type from file extension
Gets a signed upload URL from PostFast
Uploads the file
Returns a key and type ready to use in create_posts

Supported formats: JPEG, PNG, GIF, WebP, MP4, WebM, MOV

You can also use get_upload_urls directly if you need more control over the upload process.

Environment Variables

Variable	Required	Description
`POSTFAST_API_KEY`	Yes	Your workspace API key
`POSTFAST_API_URL`	No	API base URL (default: `https://api.postfa.st`)

Testing

Verify everything works with the MCP Inspector:

POSTFAST_API_KEY=your-key npx @modelcontextprotocol/inspector npx postfast-mcp

API Docs

Full REST API documentation: postfa.st/docs

Development

npm install
npm run build
node dist/index.js

Badges

License

MIT

Postfast Mcp— plugin

Is Postfast Mcp safe to install?

PostFast MCP Server

Hosted connector (no install)

Quick Start

1. Get your API key

2. Install

3. Use it

Available Tools

Supported Platforms

Platform-Specific Controls

Media Upload

Environment Variables

Testing

API Docs

Development

Badges

License

Audit the pieces. Scan the whole. Decide.