Metricool API + MCP vs Xpoz MCP

Metricool API + MCP 61

Closed service with published terms from METRICOOL SOFTWARE, SL of Madrid, part of the team.blue group (15). Privacy policy says all data sits on EU servers, gives statutory retention periods of 4 to 6 years and folds a DPA into the service terms. A signed DPA is available on request from legal@metricool.com, with deletion or return of data when the contract ends. Processors are named only by category (22). No deprecation policy or dated notices found (0). Data location stated, subprocessors not named (10).

Xpoz MCP 29

Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.

Metricool API + MCP 39

The help centre's MCP basics page lists six hosted tools, four that read (metrics, analytics, best time, scheduled posts) and two that write (create and update a scheduled post). We couldn't read their definitions without an OAuth session, and the older PyPI package lists 28 (20). Analytics take date ranges. We didn't verify pagination or field selection (8). Two documented error cases, no codes an agent can act on (5). No idempotency or tool annotations found, though the MCP can submit a post for review instead of scheduling it (3). No SDKs, and three values per REST call (3).

Xpoz MCP 63

52 tools totalling about 238 KB (5). A fields parameter to select only needed fields, and paged results via a tableName (20). No documented errors (3 of 20). All annotated, 49 read-only (20). SDKs and a CLI (15). 5 + 20 + 3 + 20 + 15 = 63.

Metricool API + MCP 6

No dated API or MCP change found. The PyPI server mcp-metricool is still at 1.1.9 from 7 October 2025 (0). No releases or dated changelog entries in the last 90 days (0). No public API changelog. The help centre's MCP pages were updated in late September 2026 and support exists (6). No official SDKs or registry entry (0). The GitHub repo the help centre names isn't public. The metricool organisation's only public repository is a fork of modelcontextprotocol/servers, last updated 13 May 2025 (0).

Xpoz MCP 25

Registry entry last updated 14 July 2026 and repository commit on 9 September; the live server reports 3.0.0 (10). No dated releases in 90 days (0). Issues not read (0). Official registry entry ai.xpoz/social-insights (15). Docker packaging only (0). 10 + 0 + 0 + 15 + 0 = 25. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Metricool API + MCP 35

A status page at status.metricool.com, per the 30 September check (20). Its robots.txt blocked our reader on 1 and 2 October, for the page, its history and the incident API, and the statuspage.io mirror too, so we have no readable history. That's our limit, not proof of a clean record. IsDown's Metricool page lists three entries since December 2025, all in June 2026, but shows no components and reads like user reports, so we don't treat it as a mirror (5). No rate limits published. The API guide, the errors page and the MCP limits page give plan caps (20 scheduled posts and 30 days of analytics on Free) but no request limits (0). No 429 or retry guidance found (0). No SLA found (0). The API and MCP aren't labelled beta (10).

Xpoz MCP 20

No status page found (0). No history (5). Credit allowances, no rate limits found (5 of 15). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.

Metricool API + MCP 48

REST takes one account token in the X-Mc-Auth header, not the query string, plus userId and blogId. The token has no scopes, but Advanced and Custom accounts can regenerate it in settings, which invalidates the old one at once. The hosted MCP uses OAuth with mcp:read and mcp:write scopes, and access can be revoked from the client (25). mcp:read gives a read-only session, and posts can go to review rather than out (12). Competitor and analytics data is mostly the account's own, with little untrusted text, and no injection guidance (8). No audit log found (0). The privacy policy names a DPO. No security.txt, disclosure route or certification found (3).

Xpoz MCP 37

One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.

Metricool API + MCP 56

OpenAPI 3.0 at app.metricool.com/api/swagger.json covering 553 paths, per the 30 September check. On 1 and 2 October app.metricool.com answered our reader's robots.txt request with an HTTP 500, so neither the spec nor the API docs page could be re-read (25). llms.txt on the help centre, re-read on 2 October (10). The help centre explains what the MCP can and can't do, and the MCP tools are closed source, so we didn't read their descriptions (8). Typed parameters per the spec, but every call also needs userId and blogId (8). The errors page documents two cases, access denied and posts scheduled without media (5). No API or MCP changelog. The only changelog in the help centre's llms.txt is for the Looker Studio connector (0).

Xpoz MCP 64

52 tools read from tools/list with JSON Schema inputs and 42 enums (25). No llms.txt read (0). Server instructions explain paging and field selection (16 of 20). Typed inputs with enums (15). Examples on the home page (5 of 15). Registry 1.4.1 from July, server 3.0.0; no changelog (3 of 15). 25 + 0 + 16 + 15 + 5 + 3 = 64.