{ "data": { "a": { "slug": "mixpost", "name": "Mixpost API + MCP", "vendor": "Mixpost (Inovector)", "vendorUrl": "https://mixpost.app", "kind": "http-api", "category": "social-media", "summary": "Self-hosted Laravel package for social scheduling, with a REST API and a built-in MCP server on your own instance.", "url": "https://www.anchorterminal.com/tools/mixpost", "markdownUrl": "https://www.anchorterminal.com/tools/mixpost.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mixpost.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mixpost.json", "dns": "mixpost.grade.anchorterminal.com", "repo": "https://github.com/inovector/mixpost", "license": "proprietary (Pro and Enterprise, which carry the API and MCP), MIT (Lite)", "transports": [ "http", "streamable-http" ], "packages": [], "auth": "pat", "authNotes": "A personal key created on the API page of the dashboard, sent as a Bearer header to both the REST API and the MCP endpoint. Keys have no scopes and act as the user who made them. Since Pro v7.1.0 each instance is also an OAuth 2.1 server with PKCE and `api` and `mcp` scopes, so MCP clients can sign in without pasting a key. Endpoints live on your own domain under /api and /mcp (https://docs.mixpost.app/api/; https://docs.mixpost.app/oauth/).", "pricing": "paid", "pricingNotes": "Lite is free and MIT-licensed but has no API, MCP or webhooks, and publishes only to Facebook Pages, X and Mastodon. Pro is $299 one-off per domain with a year of updates and includes the API, MCP and webhooks. Enterprise is $1,199 one-off and adds billing and customer management for running your own SaaS. Both keep working on the last version after updates lapse, with a 14-day money-back guarantee. Mixpost Cloud is hosted, from $29 a month (Spark), with the API and MCP from the $49 Momentum plan, and a 7-day trial that needs a card (https://mixpost.app/pricing; https://mixpost.app/cloud; checked 2026-11-04).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402 or per-call payment in the docs, OpenAPI spec or pricing (checked 2026-09-30).", "endpoints": [] }, "toolCount": 31, "popularity": { "githubStars": 3747, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.mixpost.app/api/", "openapi": "https://docs.mixpost.app/assets/files/mixpost-35c300ba5667fb2c26eafccbfe2fa71d.yaml", "capabilities": [ "social.post", "social.schedule", "social.analytics", "social.media-upload" ], "tags": [ "open-source", "local", "self-hosted", "hosted", "mcp", "openapi", "webhooks", "oauth" ], "lastRelease": "2026-11-03", "graded": true, "anchor": { "graded": true, "score": 55.2, "grade": "C", "agentReady": false, "rank": 968, "ranked": true, "rankOf": 1524, "categoryRank": 6, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 43, "maintenance": 63, "payments": 15, "reliability": 70, "schema": 76, "security": 57, "transparency": 51 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": 0, "verdict": "Pro is a one-off $299 licence with unlimited accounts, an OpenAPI 3.1 file and a 31-tool MCP server on your own server, with OAuth 2.1 sign-in for MCP clients since October 2026. Personal keys have no scopes, the free Lite edition has no API or MCP, and two security reports on Lite remain unfixed.", "bestFor": "Agencies and teams that must keep tokens and content on their own servers and want a one-off price.", "strengths": [ "One-off $299 licence with unlimited accounts and members, and the last version keeps working after updates lapse", "OpenAPI 3.1 spec and a 31-tool MCP server, with every tool labelled read, write or destructive in the docs", "OAuth 2.1 with PKCE, rotating refresh tokens and `api` and `mcp` scopes since Pro v7.1.0, plus rotation for personal keys", "Twenty Pro releases between 26 September and 3 November 2026, with v7.0.0 flagged as breaking", "A Viewer-role token can only read, and workspace post approval holds posts scheduled through MCP" ], "weaknesses": [ "No API or MCP in the free Lite edition, and Cloud's trial needs a card", "Personal keys carry the full authority of the user who created them, with no scopes", "Public path-traversal (24 February 2026) and XSS (17 June 2026, CVE-2026-57958) reports on the Lite repository, unfixed with no vendor advisory", "No rate limiting of its own, no idempotency keys and no status page for Cloud", "Self-hosting needs your own developer app approved by each network" ], "agentNotes": [ "Call list-workspaces first. Workspace endpoints sit under /api/{workspaceUuid}", "Connect MCP clients by OAuth where the instance allows it, so no personal key is pasted into the client", "Create the key as a Viewer-role user when the agent only needs to read", "Use unschedule-post rather than delete-post when a person wants a post pulled back to draft", "Name the extra fields you need in get-post's include argument. Media details and options are left out by default" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.2 } ], "editorialScores": { "ergonomics": 43, "maintenance": 63, "payments": 15, "reliability": 70, "schema": 76, "security": 57, "transparency": 45 }, "provenanceScore": 57, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-13", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://$MIXPOST_HOST/api/workspaces -H \"Authorization: Bearer $MIXPOST_TOKEN\" -H \"Accept: application/json\"", "claudeCode": "claude mcp add --transport http mixpost https://$MIXPOST_HOST/mcp --header \"Authorization: Bearer $MIXPOST_TOKEN\"", "config": { "mcpServers": { "mixpost": { "headers": { "Authorization": "Bearer ${MIXPOST_TOKEN}" }, "type": "http", "url": "https://example.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/social.post", "tool": "https://letme.dev/mixpost" }, "area": "communication", "provenance": { "legalEntity": "INOVECTOR DIGITAL S.R.L.", "domain": "mixpost.app", "domainRegistered": "2022-07-28", "endpointOnVendorDomain": false, "terms": "https://mixpost.app/terms-of-use", "privacy": "https://mixpost.app/privacy-policy", "statusPage": "", "changelog": "https://mixpost.app/releases/pro", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The terms name INOVECTOR DIGITAL S.R.L., registered in the Republic of Moldova with number 1019600028867.", "Self-hosted endpoints run on the customer's own domain, not the vendor's." ], "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mixpost.json", "live": { "slug": "mixpost", "versions": [ { "registry": "github", "name": "inovector/mixpost", "version": "2.6.0", "released": "2026-03-16", "seenAt": "2026-11-13T08:55:53.846507403Z" } ], "githubStars": 3930, "securityTxt": { "url": "https://mixpost.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-13T16:15:09.159481623Z" }, "domain": { "domain": "mixpost.app", "registered": "2022-07-28", "source": "https://pubapi.registry.google/rdap/domain/mixpost.app", "checkedAt": "2026-11-08T15:12:19.246683736Z" }, "pages": [ { "url": "https://mixpost.app/releases/pro", "kind": "changelog", "status": 200, "checkedAt": "2026-11-13T18:25:08.082844027Z", "changedAt": "2026-11-13T18:25:08.082844027Z", "fingerprint": "517a2f76856d" }, { "url": "https://mixpost.app/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-13T18:25:03.356309402Z", "changedAt": "2026-10-27T03:50:16.98226909Z", "fingerprint": "94f9d6d44cfe" }, { "url": "https://mixpost.app/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-13T18:25:06.488058307Z", "changedAt": "2026-11-07T14:14:28.369856798Z", "fingerprint": "ee71644d8909" }, { "url": "https://mixpost.app/terms-of-use", "kind": "terms", "status": 200, "checkedAt": "2026-11-13T18:25:10.084130755Z", "changedAt": "2026-10-27T03:50:23.38463208Z", "fingerprint": "808e6ba39faa" } ], "github": { "repo": "inovector/mixpost", "checkedAt": "2026-11-09T10:31:55.76214455Z", "stars": 3917, "archived": false, "issuesEnabled": true, "pushedAt": "2026-03-16T10:06:38Z", "openIssues": 28, "openPRs": 7, "issuesOpened90d": 5, "issuesClosed90d": 4, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 16, "success": 14, "failure": 0, "other": 2, "latest": "success", "latestAt": "2026-03-13T17:48:17Z" }, "replies": { "sampled": 25, "unanswered": 10, "medianDays": 2.5 } }, "updatedAt": "2026-11-13T18:25:10.084130755Z" } }, "answer": "Mixpost API + MCP scores 55.2 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community.", "b": { "slug": "pamba", "name": "Pamba", "vendor": "Pamba", "vendorUrl": "https://pamba.app", "kind": "http-api", "category": "social-media", "summary": "Pamba makes AI avatar short-form videos and posts them to TikTok, Instagram and Facebook, through an app, a REST API and a remote MCP server. It also sells accounts it runs on its own iPhones, which those platforms forbid.", "url": "https://www.anchorterminal.com/tools/pamba", "markdownUrl": "https://www.anchorterminal.com/tools/pamba.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pamba.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pamba.json", "dns": "pamba.grade.anchorterminal.com", "license": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.pamba.app/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.1 with PKCE and dynamic client registration on api.pamba.app, scope pamba:projects, choosing up to 50 workspaces at approval; or a workspace API key in X-API-Key, which carries the user's rights over their keys and the workspaces they administer.", "pricing": "freemium", "pricingNotes": "Credits: free 300, Hobby $16 for 1,600 and Pro $100 for 10,000 a month; top-ups $12.50 per 1,000. Managed TikTok or Instagram accounts $100 a month each. Fully managed from $7,500 a month. Per-model credit rates at GET /usage/pricing without auth. Read 11 November 2026.", "priceSummary": "$0.0125 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in Pamba's pricing, API or MCP pages, 11 November 2026. Billing is through Stripe.", "endpoints": [] }, "toolCount": 407, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-11" }, "docsUrl": "https://pamba.app/help/mcp-server", "llmsTxt": "https://pamba.app/llms.txt", "capabilities": [ "social.post", "social.schedule", "social.analytics", "social.comments", "social.media-upload", "video.generate" ], "tags": [ "hosted", "mcp", "oauth", "llms-txt", "closed-source", "freemium", "usage-priced", "tiktok", "instagram", "no-status-page", "platform-rules" ], "lastRelease": "2026-11-11", "graded": true, "anchor": { "graded": true, "score": 41.2, "grade": "E", "agentReady": false, "rank": 1334, "ranked": true, "rankOf": 1524, "categoryRank": 17, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 28 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-11" }, "negative": -15, "warnings": [ { "kind": "platform-rules", "name": "Breaks the rules of the platforms it acts on", "text": "Pamba sells TikTok and Instagram accounts it creates on its own iPhones and warms so each 'reads as a real person', pitches running 'hundreds of accounts' and replaces banned ones. TikTok's guidelines and Instagram's terms forbid that.", "deduct": -15, "since": "2026-11-11", "sources": [ "https://pamba.app/accounts", "https://pamba.app/help/account-warming", "https://www.tiktok.com/community-guidelines/en/integrity-authenticity/", "https://help.instagram.com/581066165581870" ] } ], "verdict": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.", "bestFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "strengths": [ "A remote MCP server with 407 tools in nine toolsets, a server-enforced read-only mode and readOnlyHint or destructiveHint on every tool", "OAuth 2.1 with PKCE and dynamic client registration, with protected-resource metadata on its own domain", "A tool reference generated from the server, and a dated API changelog that flags breaking changes", "Prices public without a login, including per-model credit rates from an unauthenticated route", "Publishes its own poor results: 42% of 6,678 videos it measured never reached 1,000 views" ], "weaknesses": [ "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned", "No terms of service and no privacy policy (both 404), and no legal entity named", "Managed seats hold account logins, recovery emails and 2-step codes with no published data policy", "One OAuth scope covers everything, and an API key can manage the user's keys and delete workspaces", "No status page and no security contact" ], "agentNotes": [ "Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned", "Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools", "Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400", "Read status and next on every result: refusals are results, not MCP errors", "Check credit costs before generation calls; 38 tools spend credits" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.2 } ], "editorialScores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 18 }, "provenanceScore": 37, "checked": { "categories": { "ergonomics": "2026-11-11", "maintenance": "2026-11-11", "payments": "2026-11-11", "reliability": "2026-11-11", "schema": "2026-11-11", "security": "2026-11-11", "transparency": "2026-11-11" }, "last": "2026-11-11", "lastMoved": "2026-11-13", "oldest": "2026-11-11", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.pamba.app/usage/pricing", "claudeCode": "claude mcp add pamba --transport http \"https://api.pamba.app/mcp?readonly=true\"", "config": { "mcpServers": { "pamba": { "url": "https://api.pamba.app/mcp?readonly=true" } } } }, "letme": { "capability": "https://letme.dev/social.post", "tool": "https://letme.dev/pamba" }, "area": "communication", "unitPrices": [ { "item": "Managed TikTok or Instagram account", "unit": "account-month", "usd": 100, "note": "Per account; no credits needed" }, { "item": "Credits top-up", "unit": "credit", "usd": 0.0125, "note": "$12.50 per 1,000; plans work out at $10 per 1,000" } ], "provenance": { "legalEntity": "", "domain": "pamba.app", "domainRegistered": "2025-06-05", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://pamba.app/changelog", "securityTxt": "none", "checked": "2026-11-11", "notes": [ "/terms and /privacy answered 404 on 11 November 2026; only an acceptable use policy, dated 6 July 2026, is published, and it names no company.", "RDAP gives pamba.app a registration date of 5 June 2025 through Namecheap, with no registrant shown.", "robots.txt on pamba.app allows ClaudeBot on public pages and disallows app paths; api.pamba.app has no robots.txt (404).", "No entry in the official MCP registry for 'pamba' on 11 November 2026." ], "score": 37 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pamba.json", "live": { "slug": "pamba", "probe": { "target": "https://api.pamba.app/mcp", "method": "get", "lastAt": "2026-11-13T23:58:54.025134635Z", "lastOk": true, "lastStatus": 401, "lastMs": 248, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 299, "p95ms24h": 391, "samples24h": 239, "samples30d": 319, "days": [ { "date": "2026-11-12", "probes": 81, "ok": 81 }, { "date": "2026-11-13", "probes": 238, "ok": 238 } ], "since": "2026-11-12T16:06:25.231802453Z" }, "securityTxt": { "url": "https://pamba.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-13T16:15:01.559101993Z" }, "llmsTxt": { "url": "https://pamba.app/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-13T15:55:36.94769184Z" }, "pages": [ { "url": "https://pamba.app/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-13T18:26:24.542486652Z", "changedAt": "2026-11-13T18:26:24.542486652Z", "fingerprint": "a0b9ef3713fa" } ], "mcpTools": { "url": "https://api.pamba.app/mcp?readonly=true", "checkedAt": "2026-11-13T03:13:09.042103119Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-13T03:13:09.042103119Z" }, "updatedAt": "2026-11-13T23:58:54.025134635Z" }, "streak": { "days": 2, "from": "2026-11-12", "sinceWatching": true, "best": 2 } }, "edges": [ { "by": 38, "category": "payments", "leads": "pamba", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402 (0). Pro is $299 once and Enterprise $1,199 once, and Cloud's Momentum plan with the API and MCP is $49 a month, all public, with no per-call price (10). Lite is free but has no API or MCP, Pro has a 14-day money-back guarantee, and Cloud's 7-day trial needs a card (0). A person has to buy a licence or sign up for Cloud in a browser (0). 0 + 10 + 0 + 0 = 10. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 10 is 15.", "b": "No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53." }, "scores": { "a": 15, "b": 53 } }, { "by": 32, "category": "ergonomics", "leads": "pamba", "name": "Agent ergonomics", "reasons": { "a": "31 MCP tools since v7.3.0 added list-mentions on 30 October 2026, with no toolsets (5). A workspace role decides which tools a token may use, but the docs say a Viewer calling a members-only tool gets an error, not a shorter tool list, so nothing comes back (5 of 25). Some list endpoints paginate and some don't, per the API docs (12). Laravel-style JSON errors with field messages and 422 for validation, and MCP inputs with unknown option keys rejected with an error naming the accepted keys (15). No idempotency keys, and the read, write and destructive labels live in the docs rather than as MCP annotations. unschedule-post and restore-post give safe ways back (6). No official SDKs, only an n8n community node (5). 5 + 12 + 15 + 6 + 5 = 43.", "b": "Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75." }, "scores": { "a": 43, "b": 75 } }, { "by": 25, "category": "reliability", "leads": "mixpost", "name": "Reliability", "reasons": { "a": "Scored on the checklist for software you run yourself, since Pro installs into your own Laravel app and its uptime is whatever your server gives it. Mixpost Cloud has no public status page we could find. Installs from Inovector's Composer repository with PHP 8.2 or later stated, per the 1 October check (20). Lite runs a public test workflow on PHP 8.2 and 8.3, and Pro's CI isn't public; kept at the earlier partial value (10). The Lite repository's issues were read on 1 October (27 open, no maintainer replies visible) and couldn't be re-read on 4 November, and Pro's tracker is private (10). Release notes per version, with v7.0.0 flagged as breaking and no breaking change found in the 7.1 to 7.3 notes (15). Past 1.0, at Pro v7.3.1 (15). 20 + 10 + 10 + 15 + 15 = 70.", "b": "Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists \"SLA guarantees\" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45." }, "scores": { "a": 70, "b": 45 } }, { "by": 23, "category": "transparency", "leads": "mixpost", "name": "Transparency \u0026 trust", "reasons": { "a": "The API and MCP live in Pro and Enterprise, which are proprietary with clear licence terms and a perpetual fallback licence. Lite is MIT (15). Privacy policy from INOVECTOR DIGITAL S.R.L. of Moldova names Hetzner, DigitalOcean, PayPal and Sentry, but has no date, no DPA and vague retention (12). v7.0.0 is flagged breaking and the MIXPOST_CORE_PATH default change is documented, with no formal deprecation policy (8). Cloud subprocessors and countries named. We found no statement on whether self-hosted installs report anything back (10), per the 1 October check. 15 + 12 + 8 + 10 = 45.", "b": "Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views." }, "scores": { "a": 51, "b": 28 } }, { "by": 22, "category": "security", "leads": "mixpost", "name": "Security \u0026 auth", "reasons": { "a": "Personal keys as Bearer headers that expire after 7, 30, 60 or 90 days, a year, a custom date or never, and since Pro v7.1.0 (15 October 2026) can be renamed, re-dated and rotated, but have no scopes and carry the full authority of the user who made them. Each instance is also an OAuth 2.1 server with PKCE (S256 only), refresh tokens that rotate on every use, revocation and two scopes, `api` and `mcp`, which choose the surface but not what the token may do (25 of 30). A key or OAuth token from a Viewer-role user can only read, and a workspace that requires post approval puts posts scheduled through MCP into needs-approval. Deletes aren't gated (15 of 20). Tools return the operator's own posts and analytics, little untrusted text (10). Connected apps can be reviewed and disconnected; no audit log found (0). The Lite repository's SECURITY.md asks for reports by email, with no acknowledgement time, which this run reads as 7. The path traversal (24 February 2026) and XSS (17 June 2026) reports on the Lite repository have no fix; the XSS is CVE-2026-57958, a Medium assigned by VulnCheck (7 of 20). 25 + 15 + 10 + 0 + 7 = 57.", "b": "OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35." }, "scores": { "a": 57, "b": 35 } }, { "by": 8, "category": "schema", "leads": "pamba", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI 3.1.0 linked from the API docs as a download, version 1.0.0 with 75 operations and 33 enums on 4 November (25). No llms.txt found (404 at the standard path) (0). The MCP tools page groups 31 tools and labels each read, write or destructive (12). Inputs typed in the spec (12). A dedicated errors page, consistent JSON error shapes, and 422 with errors.limit for plan limits (12). Public release notes for every Pro version (15). 25 + 0 + 12 + 12 + 12 + 15 = 76.", "b": "No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84." }, "scores": { "a": 76, "b": 84 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Mixpost (Inovector)", "b": "Pamba", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.pamba.app/mcp", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "Token", "b": "OAuth", "name": "Auth" }, { "a": "Paid", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "proprietary (Pro and Enterprise, which carry the API and MCP), MIT (Lite)", "b": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "name": "Licence" }, { "a": "31", "b": "407", "name": "Tools exposed" }, { "a": "no", "b": "yes", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-03", "b": "2026-11-11", "name": "Last release" }, { "a": "no date given", "b": "no document linked", "name": "Terms last updated" }, { "a": "no date given", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "3.7k stars", "b": "none", "name": "Popularity" }, { "a": "2/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Mixpost API + MCP scores 55.2 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community.", "question": "Which is better for AI agents, Mixpost API + MCP or Pamba?" }, { "answer": "Mixpost API + MCP needs an access token. Pamba uses an OAuth sign-in.", "question": "Do Mixpost API + MCP and Pamba need an API key?" }, { "answer": "No hosted endpoint is listed for Mixpost API + MCP. Pamba has a hosted endpoint at https://api.pamba.app/mcp.", "question": "Can an agent call Mixpost API + MCP and Pamba without installing anything?" }, { "answer": "Mixpost API + MCP is open source (proprietary (Pro and Enterprise, which carry the API and MCP), MIT (Lite)). No open-source release is listed for Pamba.", "question": "Are Mixpost API + MCP and Pamba open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 70 against 45", "Security \u0026 auth, 57 against 35", "Transparency \u0026 trust, 51 against 28" ], "also": [ "Open source", "No incidents deducted, where Pamba loses 15 points for them" ], "goodFor": "Agencies and teams that must keep tokens and content on their own servers and want a one-off price.", "slug": "mixpost", "watchFor": "No API or MCP in the free Lite edition, and Cloud's trial needs a card" }, { "aheadOn": [ "Schema \u0026 documentation, 84 against 76", "Agent ergonomics, 75 against 43", "Payments \u0026 pricing, 53 against 15", "Maintenance \u0026 community, 70 against 63" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "slug": "pamba", "watchFor": "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned" } ], "history": { "mixpost": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 0.7, "from": 54.5, "fromGrade": "C", "to": 55.2, "toGrade": "C" }, { "causes": [ "product", "correction" ], "date": "2026-11-04", "delta": 4.8, "from": 49.7, "fromGrade": "D", "to": 54.5, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 49.5, "fromGrade": "D", "to": 49.7, "toGrade": "D" } ], "pamba": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 2.3, "from": 38.9, "fromGrade": "E", "to": 41.2, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-11-13", "delta": -5, "from": 43.9, "fromGrade": "E", "to": 38.9, "toGrade": "E" } ] }, "job": { "capability": "social.post", "name": "Social posting" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-mixpost.json", "title": "Ayrshare API + MCP vs Mixpost API + MCP", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-mixpost" }, { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba.json", "title": "Ayrshare API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-mixpost.json", "title": "Blotato vs Mixpost API + MCP", "url": "https://www.anchorterminal.com/compare/blotato-vs-mixpost" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-pamba.json", "title": "Blotato vs Pamba", "url": "https://www.anchorterminal.com/compare/blotato-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-mixpost.json", "title": "Buffer API + MCP vs Mixpost API + MCP", "url": "https://www.anchorterminal.com/compare/buffer-vs-mixpost" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-pamba.json", "title": "Buffer API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/buffer-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-mixpost.json", "title": "bundle.social vs Mixpost API + MCP", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-mixpost" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba.json", "title": "bundle.social vs Pamba", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/late-vs-mixpost.json", "title": "Zernio (formerly Late) API + MCP vs Mixpost API + MCP", "url": "https://www.anchorterminal.com/compare/late-vs-mixpost" }, { "json": "https://www.anchorterminal.com/compare/late-vs-pamba.json", "title": "Zernio (formerly Late) API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/late-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-mixpost.json", "title": "Metricool API + MCP vs Mixpost API + MCP", "url": "https://www.anchorterminal.com/compare/metricool-vs-mixpost" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-pamba.json", "title": "Metricool API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/metricool-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-oneup.json", "title": "Mixpost API + MCP vs OneUp API + MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-oneup" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-post-bridge.json", "title": "Mixpost API + MCP vs Post Bridge API + MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-post-bridge" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-postiz.json", "title": "Mixpost API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-publer.json", "title": "Mixpost API + MCP vs Publer API + MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-publer" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-repostit.json", "title": "Mixpost API + MCP vs Repostit", "url": "https://www.anchorterminal.com/compare/mixpost-vs-repostit" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-typefully.json", "title": "Mixpost API + MCP vs Typefully", "url": "https://www.anchorterminal.com/compare/mixpost-vs-typefully" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-upload-post.json", "title": "Mixpost API + MCP vs Upload-Post API + MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-upload-post" }, { "json": "https://www.anchorterminal.com/compare/oneup-vs-pamba.json", "title": "OneUp API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/oneup-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge.json", "title": "Pamba vs Post Bridge API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-postiz.json", "title": "Pamba vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-publer.json", "title": "Pamba vs Publer API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-publer" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-repostit.json", "title": "Pamba vs Repostit", "url": "https://www.anchorterminal.com/compare/pamba-vs-repostit" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-typefully.json", "title": "Pamba vs Typefully", "url": "https://www.anchorterminal.com/compare/pamba-vs-typefully" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-upload-post.json", "title": "Pamba vs Upload-Post API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-upload-post" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-sprout-social.json", "title": "Mixpost API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/mixpost-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-twitterapi-io-mcp.json", "title": "Mixpost API + MCP vs TwitterAPI.io MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-twitterapi-io-mcp" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-x-mcp.json", "title": "Mixpost API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-xpoz-mcp.json", "title": "Mixpost API + MCP vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social.json", "title": "Pamba vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.json", "title": "Pamba vs TwitterAPI.io MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp.json", "title": "Pamba vs X MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.json", "title": "Pamba vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-socialcannon.json", "title": "Mixpost API + MCP vs SocialCannon", "url": "https://www.anchorterminal.com/compare/mixpost-vs-socialcannon" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon.json", "title": "Pamba vs SocialCannon", "url": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon" } ], "panel": null, "scores": [ { "by": 25, "edge": "mixpost", "key": "reliability", "mixpost": 70, "name": "Reliability", "pamba": 45, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 8, "edge": "pamba", "key": "schema", "mixpost": 76, "name": "Schema \u0026 documentation", "pamba": 84, "weight": 13 }, { "by": 32, "edge": "pamba", "key": "ergonomics", "mixpost": 43, "name": "Agent ergonomics", "pamba": 75, "weight": 13 }, { "by": 22, "edge": "mixpost", "key": "security", "mixpost": 57, "name": "Security \u0026 auth", "pamba": 35, "weight": 14 }, { "by": 38, "edge": "pamba", "key": "payments", "mixpost": 15, "name": "Payments \u0026 pricing", "pamba": 53, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 7, "edge": "pamba", "key": "maintenance", "mixpost": 63, "name": "Maintenance \u0026 community", "pamba": 70, "weight": 7 }, { "by": 23, "edge": "mixpost", "key": "transparency", "mixpost": 51, "name": "Transparency \u0026 trust", "pamba": 28, "weight": 7 } ], "summary": "Mixpost API + MCP scores 55.2 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community. Both do social posting.", "tasks": null, "tutorials": [ { "title": "Check connected accounts in Mixpost", "tool": "mixpost", "url": "https://www.anchorterminal.com/tutorials/mixpost/" } ], "verdicts": { "mixpost": "Pro is a one-off $299 licence with unlimited accounts, an OpenAPI 3.1 file and a 31-tool MCP server on your own server, with OAuth 2.1 sign-in for MCP clients since October 2026. Personal keys have no scopes, the free Lite edition has no API or MCP, and two security reports on Lite remain unfixed.", "pamba": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/mixpost-vs-pamba", "json": "https://www.anchorterminal.com/compare/mixpost-vs-pamba.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/mixpost-vs-pamba.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/mixpost-vs-pamba.min.md" }, "markdown": "Mixpost API + MCP scores 55.2 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community. Both do social posting.\n\n- Mixpost API + MCP: grade C, 55.2/100, rank #968 of 1524. Markdown https://www.anchorterminal.com/tools/mixpost.md · JSON https://www.anchorterminal.com/api/v1/tools/mixpost.json\n- Pamba: grade E, 41.2/100, rank #1334 of 1524. Markdown https://www.anchorterminal.com/tools/pamba.md · JSON https://www.anchorterminal.com/api/v1/tools/pamba.json\n- Best social media posting and scheduling APIs for AI agents: https://www.anchorterminal.com/best/social-media/index.md\n- All 182 social comparisons: https://www.anchorterminal.com/compare/social-media/index.md\n\n## Which one, for what\n\n### Mixpost API + MCP (C)\n\nGood for: Agencies and teams that must keep tokens and content on their own servers and want a one-off price.\n\nAhead on:\n- Reliability, 70 against 45\n- Security \u0026 auth, 57 against 35\n- Transparency \u0026 trust, 51 against 28\n\nAlso in its favour:\n- Open source\n- No incidents deducted, where Pamba loses 15 points for them\n\nWatch for: No API or MCP in the free Lite edition, and Cloud's trial needs a card\n\n### Pamba (E)\n\nGood for: Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.\n\nAhead on:\n- Schema \u0026 documentation, 84 against 76\n- Agent ergonomics, 75 against 43\n- Payments \u0026 pricing, 53 against 15\n- Maintenance \u0026 community, 70 against 63\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Pamba +38\n\n- Mixpost API + MCP (15): No x402 (0). Pro is $299 once and Enterprise $1,199 once, and Cloud's Momentum plan with the API and MCP is $49 a month, all public, with no per-call price (10). Lite is free but has no API or MCP, Pro has a 14-day money-back guarantee, and Cloud's 7-day trial needs a card (0). A person has to buy a licence or sign up for Cloud in a browser (0). 0 + 10 + 0 + 0 = 10. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 10 is 15.\n- Pamba (53): No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.\n\n### Agent ergonomics: Pamba +32\n\n- Mixpost API + MCP (43): 31 MCP tools since v7.3.0 added list-mentions on 30 October 2026, with no toolsets (5). A workspace role decides which tools a token may use, but the docs say a Viewer calling a members-only tool gets an error, not a shorter tool list, so nothing comes back (5 of 25). Some list endpoints paginate and some don't, per the API docs (12). Laravel-style JSON errors with field messages and 422 for validation, and MCP inputs with unknown option keys rejected with an error naming the accepted keys (15). No idempotency keys, and the read, write and destructive labels live in the docs rather than as MCP annotations. unschedule-post and restore-post give safe ways back (6). No official SDKs, only an n8n community node (5). 5 + 12 + 15 + 6 + 5 = 43.\n- Pamba (75): Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.\n\n### Reliability: Mixpost API + MCP +25\n\n- Mixpost API + MCP (70): Scored on the checklist for software you run yourself, since Pro installs into your own Laravel app and its uptime is whatever your server gives it. Mixpost Cloud has no public status page we could find. Installs from Inovector's Composer repository with PHP 8.2 or later stated, per the 1 October check (20). Lite runs a public test workflow on PHP 8.2 and 8.3, and Pro's CI isn't public; kept at the earlier partial value (10). The Lite repository's issues were read on 1 October (27 open, no maintainer replies visible) and couldn't be re-read on 4 November, and Pro's tracker is private (10). Release notes per version, with v7.0.0 flagged as breaking and no breaking change found in the 7.1 to 7.3 notes (15). Past 1.0, at Pro v7.3.1 (15). 20 + 10 + 10 + 15 + 15 = 70.\n- Pamba (45): Graded as a hosted service. No status page found: none is linked, and status.pamba.app didn't answer (0). With no page there's no incident history to read (5 of 30). Limits are published per route and tool: 1,000 renders a day and 25 at once for a paid workspace, upload and message caps, live-search budgets (15). 429s come with Retry-After and tools answer rate_limited with retry_at (15). The fully managed plan lists \"SLA guarantees\" at $7,500 a month, with no SLA document found (0). Self-serve and live (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.\n\n### Transparency \u0026 trust: Mixpost API + MCP +23\n\n- Mixpost API + MCP (51): The API and MCP live in Pro and Enterprise, which are proprietary with clear licence terms and a perpetual fallback licence. Lite is MIT (15). Privacy policy from INOVECTOR DIGITAL S.R.L. of Moldova names Hetzner, DigitalOcean, PayPal and Sentry, but has no date, no DPA and vague retention (12). v7.0.0 is flagged breaking and the MIXPOST_CORE_PATH default change is documented, with no formal deprecation policy (8). Cloud subprocessors and countries named. We found no statement on whether self-hosted installs report anything back (10), per the 1 October check. 15 + 12 + 8 + 10 = 45.\n- Pamba (28): Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.\n\n### Security \u0026 auth: Mixpost API + MCP +22\n\n- Mixpost API + MCP (57): Personal keys as Bearer headers that expire after 7, 30, 60 or 90 days, a year, a custom date or never, and since Pro v7.1.0 (15 October 2026) can be renamed, re-dated and rotated, but have no scopes and carry the full authority of the user who made them. Each instance is also an OAuth 2.1 server with PKCE (S256 only), refresh tokens that rotate on every use, revocation and two scopes, `api` and `mcp`, which choose the surface but not what the token may do (25 of 30). A key or OAuth token from a Viewer-role user can only read, and a workspace that requires post approval puts posts scheduled through MCP into needs-approval. Deletes aren't gated (15 of 20). Tools return the operator's own posts and analytics, little untrusted text (10). Connected apps can be reviewed and disconnected; no audit log found (0). The Lite repository's SECURITY.md asks for reports by email, with no acknowledgement time, which this run reads as 7. The path traversal (24 February 2026) and XSS (17 June 2026) reports on the Lite repository have no fix; the XSS is CVE-2026-57958, a Medium assigned by VulnCheck (7 of 20). 25 + 15 + 10 + 0 + 7 = 57.\n- Pamba (35): OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.\n\n### Schema \u0026 documentation: Pamba +8\n\n- Mixpost API + MCP (76): OpenAPI 3.1.0 linked from the API docs as a download, version 1.0.0 with 75 operations and 33 enums on 4 November (25). No llms.txt found (404 at the standard path) (0). The MCP tools page groups 31 tools and labels each read, write or destructive (12). Inputs typed in the spec (12). A dedicated errors page, consistent JSON error shapes, and 422 with errors.limit for plan limits (12). Public release notes for every Pro version (15). 25 + 0 + 12 + 12 + 12 + 15 = 76.\n- Pamba (84): No OpenAPI file found. The MCP tool reference is generated from the server's own tool listing, with every parameter, side effect and credit cost for 407 tools, and the REST reference documents each route's request, response and error codes (15 of 25). llms.txt with the docs corpus (10). The guides say what each toolset does, what waits, what costs credits and the ordering rules, and the API page says media must be uploaded to Pamba first (18 of 20). Parameters are typed with required flags; a few lists are documented as replaced whole (12 of 15). Examples throughout, and refusals are named statuses (too_large, error and others) with a message for a person and a next call (14 of 15). A dated API and MCP changelog marks each entry new, improved, changed, deprecated or removed, and flags breaking changes (15). 15 + 10 + 18 + 12 + 14 + 15 = 84.\n\n## Score by category\n\n| Category | Weight | Mixpost API + MCP | Pamba | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 70 | 45 | Mixpost API + MCP +25 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 76 | 84 | Pamba +8 |\n| Agent ergonomics | 13% (16.2 this run) | 43 | 75 | Pamba +32 |\n| Security \u0026 auth | 14% (17.5 this run) | 57 | 35 | Mixpost API + MCP +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 15 | 53 | Pamba +38 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 63 | 70 | Pamba +7 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 51 | 28 | Mixpost API + MCP +23 |\n| Negative events | ≤15 | 0 | -15 | |\n| **Total** | | **55.2 · C** | **41.2 · E** | |\n\n## Facts side by side\n\n| Fact | Mixpost API + MCP | Pamba |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Mixpost (Inovector) | Pamba |\n| Hosted endpoint | no (local only) | `https://api.pamba.app/mcp` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | Token | OAuth |\n| Pricing | Paid | Freemium |\n| x402 | no | no |\n| Licence | proprietary (Pro and Enterprise, which carry the API and MCP), MIT (Lite) | Closed service. No terms of service or privacy policy published; an acceptable use policy only |\n| Tools exposed | 31 | 407 |\n| Read-only variant documented | no | yes |\n| llms.txt | no | yes |\n| Last release | 2026-11-03 | 2026-11-11 |\n| Terms last updated | no date given | no document linked |\n| Privacy policy last updated | no date given | no document linked |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | yes | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | 3.7k stars | none |\n| Agent reviews | 2/5 (2) | none |\n\n## How the scores have moved\n\n### Mixpost API + MCP\n\n- +0.7 on 13 November 2026: checklist\n- +4.8 on 4 November 2026 (D to C): product, correction\n- +0.2 on 27 October 2026: checklist\n\n### Pamba\n\n- +2.3 on 13 November 2026: checklist\n- -5.0 on 13 November 2026: checklist\n\n## Verdicts\n\n**Mixpost API + MCP.** Pro is a one-off $299 licence with unlimited accounts, an OpenAPI 3.1 file and a 31-tool MCP server on your own server, with OAuth 2.1 sign-in for MCP clients since October 2026. Personal keys have no scopes, the free Lite edition has no API or MCP, and two security reports on Lite remain unfixed.\n\n**Pamba.** Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.\n\n## Before you call either\n\n### Mixpost API + MCP\n\n1. Call list-workspaces first. Workspace endpoints sit under /api/{workspaceUuid}\n2. Connect MCP clients by OAuth where the instance allows it, so no personal key is pasted into the client\n3. Create the key as a Viewer-role user when the agent only needs to read\n4. Use unschedule-post rather than delete-post when a person wants a post pulled back to draft\n5. Name the extra fields you need in get-post's include argument. Media details and options are left out by default\n\n### Pamba\n\n1. Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned\n2. Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools\n3. Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400\n4. Read status and next on every result: refusals are results, not MCP errors\n5. Check credit costs before generation calls; 38 tools spend credits\n\n## Tutorials\n\n- [Check connected accounts in Mixpost](https://www.anchorterminal.com/tutorials/mixpost/), for Mixpost API + MCP\n\n## Questions\n\n### Which is better for AI agents, Mixpost API + MCP or Pamba?\n\nMixpost API + MCP scores 55.2 (C) on agent readiness against Pamba's 41.2 (E), and leads in 3 of 7 scored categories. Pamba leads on schema \u0026 documentation, agent ergonomics, payments \u0026 pricing and maintenance \u0026 community.\n\n### Do Mixpost API + MCP and Pamba need an API key?\n\nMixpost API + MCP needs an access token. Pamba uses an OAuth sign-in.\n\n### Can an agent call Mixpost API + MCP and Pamba without installing anything?\n\nNo hosted endpoint is listed for Mixpost API + MCP. Pamba has a hosted endpoint at https://api.pamba.app/mcp.\n\n### Are Mixpost API + MCP and Pamba open source?\n\nMixpost API + MCP is open source (proprietary (Pro and Enterprise, which carry the API and MCP), MIT (Lite)). No open-source release is listed for Pamba.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/mixpost-vs-pamba.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mixpost-vs-pamba.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"mixpost\", \"b\": \"pamba\"}`. From a terminal: `anchor compare mixpost pamba`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mixpost.json and https://www.anchorterminal.com/api/v1/tools/pamba.json\n\n## Other comparisons with Mixpost API + MCP or Pamba\n\n- [Ayrshare API + MCP vs Mixpost API + MCP](https://www.anchorterminal.com/compare/ayrshare-vs-mixpost.md)\n- [Ayrshare API + MCP vs Pamba](https://www.anchorterminal.com/compare/ayrshare-vs-pamba.md)\n- [Blotato vs Mixpost API + MCP](https://www.anchorterminal.com/compare/blotato-vs-mixpost.md)\n- [Blotato vs Pamba](https://www.anchorterminal.com/compare/blotato-vs-pamba.md)\n- [Buffer API + MCP vs Mixpost API + MCP](https://www.anchorterminal.com/compare/buffer-vs-mixpost.md)\n- [Buffer API + MCP vs Pamba](https://www.anchorterminal.com/compare/buffer-vs-pamba.md)\n- [bundle.social vs Mixpost API + MCP](https://www.anchorterminal.com/compare/bundle-social-vs-mixpost.md)\n- [bundle.social vs Pamba](https://www.anchorterminal.com/compare/bundle-social-vs-pamba.md)\n- [Zernio (formerly Late) API + MCP vs Mixpost API + MCP](https://www.anchorterminal.com/compare/late-vs-mixpost.md)\n- [Zernio (formerly Late) API + MCP vs Pamba](https://www.anchorterminal.com/compare/late-vs-pamba.md)\n- [Metricool API + MCP vs Mixpost API + MCP](https://www.anchorterminal.com/compare/metricool-vs-mixpost.md)\n- [Metricool API + MCP vs Pamba](https://www.anchorterminal.com/compare/metricool-vs-pamba.md)\n- [Mixpost API + MCP vs OneUp API + MCP](https://www.anchorterminal.com/compare/mixpost-vs-oneup.md)\n- [Mixpost API + MCP vs Post Bridge API + MCP](https://www.anchorterminal.com/compare/mixpost-vs-post-bridge.md)\n- [Mixpost API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/mixpost-vs-postiz.md)\n- [Mixpost API + MCP vs Publer API + MCP](https://www.anchorterminal.com/compare/mixpost-vs-publer.md)\n- [Mixpost API + MCP vs Repostit](https://www.anchorterminal.com/compare/mixpost-vs-repostit.md)\n- [Mixpost API + MCP vs Typefully](https://www.anchorterminal.com/compare/mixpost-vs-typefully.md)\n- [Mixpost API + MCP vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/mixpost-vs-upload-post.md)\n- [OneUp API + MCP vs Pamba](https://www.anchorterminal.com/compare/oneup-vs-pamba.md)\n- [Pamba vs Post Bridge API + MCP](https://www.anchorterminal.com/compare/pamba-vs-post-bridge.md)\n- [Pamba vs Postiz API + MCP](https://www.anchorterminal.com/compare/pamba-vs-postiz.md)\n- [Pamba vs Publer API + MCP](https://www.anchorterminal.com/compare/pamba-vs-publer.md)\n- [Pamba vs Repostit](https://www.anchorterminal.com/compare/pamba-vs-repostit.md)\n- [Pamba vs Typefully](https://www.anchorterminal.com/compare/pamba-vs-typefully.md)\n- [Pamba vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/pamba-vs-upload-post.md)\n- [Mixpost API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/mixpost-vs-sprout-social.md)\n- [Mixpost API + MCP vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/mixpost-vs-twitterapi-io-mcp.md)\n- [Mixpost API + MCP vs X MCP](https://www.anchorterminal.com/compare/mixpost-vs-x-mcp.md)\n- [Mixpost API + MCP vs Xpoz MCP](https://www.anchorterminal.com/compare/mixpost-vs-xpoz-mcp.md)\n- [Pamba vs Sprout Social API](https://www.anchorterminal.com/compare/pamba-vs-sprout-social.md)\n- [Pamba vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.md)\n- [Pamba vs X MCP](https://www.anchorterminal.com/compare/pamba-vs-x-mcp.md)\n- [Pamba vs Xpoz MCP](https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.md)\n- [Mixpost API + MCP vs SocialCannon](https://www.anchorterminal.com/compare/mixpost-vs-socialcannon.md)\n- [Pamba vs SocialCannon](https://www.anchorterminal.com/compare/pamba-vs-socialcannon.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.8", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Mixpost API + MCP vs Pamba", "url": "" } ], "description": "Mixpost scores 55.2 (C) to Pamba's 41.2 (E) for social posting. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Mixpost API + MCP C 55.2", "Pamba E 41.2", "scores" ], "h1": "Mixpost API + MCP vs Pamba", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/mixpost-vs-pamba", "published": "2026-10-01", "section": "tools", "title": "Mixpost vs Pamba for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-13", "url": "https://www.anchorterminal.com/compare/mixpost-vs-pamba" }, "tokens": { "markdown": 5100, "slim": 1180 }, "version": 1 }