Mixpost API + MCP vs Xpoz MCP

Mixpost API + MCP 70

Scored on the checklist for software you run yourself, since Pro installs into your own Laravel app and its uptime is whatever your server gives it. Mixpost Cloud has no public status page we could find. Installs from Inovector's Composer repository with PHP 8.2 or later stated, per the 1 October check (20). Lite runs a public test workflow on PHP 8.2 and 8.3, and Pro's CI isn't public; kept at the earlier partial value (10). The Lite repository's issues were read on 1 October (27 open, no maintainer replies visible) and couldn't be re-read on 4 November, and Pro's tracker is private (10). Release notes per version, with v7.0.0 flagged as breaking and no breaking change found in the 7.1 to 7.3 notes (15). Past 1.0, at Pro v7.3.1 (15). 20 + 10 + 10 + 15 + 15 = 70.

Xpoz MCP 20

No status page found (0). No history (5). Credit allowances, no rate limits found (5 of 15). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.

Mixpost API + MCP 63

Pro v7.3.1 on 3 November 2026 (30). Twenty Pro releases from v7.0.0 on 26 September to v7.3.1 on 3 November, more than three in the last 90 days (20). The public Lite tracker showed no maintainer replies on recent issues on 1 October and couldn't be re-read; Pro support is private (8). No official SDKs or registry entry (0). Lite has CI but last released 2.6.0 on 13 March 2026, and its last commit is 16 March 2026 (5). 30 + 20 + 8 + 0 + 5 = 63.

Xpoz MCP 25

Registry entry last updated 14 July 2026 and repository commit on 9 September; the live server reports 3.0.0 (10). No dated releases in 90 days (0). Issues not read (0). Official registry entry ai.xpoz/social-insights (15). Docker packaging only (0). 10 + 0 + 0 + 15 + 0 = 25. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.

Mixpost API + MCP 51

The API and MCP live in Pro and Enterprise, which are proprietary with clear licence terms and a perpetual fallback licence. Lite is MIT (15). Privacy policy from INOVECTOR DIGITAL S.R.L. of Moldova names Hetzner, DigitalOcean, PayPal and Sentry, but has no date, no DPA and vague retention (12). v7.0.0 is flagged breaking and the MIXPOST_CORE_PATH default change is documented, with no formal deprecation policy (8). Cloud subprocessors and countries named. We found no statement on whether self-hosted installs report anything back (10), per the 1 October check. 15 + 12 + 8 + 10 = 45.

Xpoz MCP 29

Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.

Mixpost API + MCP 43

31 MCP tools since v7.3.0 added list-mentions on 30 October 2026, with no toolsets (5). A workspace role decides which tools a token may use, but the docs say a Viewer calling a members-only tool gets an error, not a shorter tool list, so nothing comes back (5 of 25). Some list endpoints paginate and some don't, per the API docs (12). Laravel-style JSON errors with field messages and 422 for validation, and MCP inputs with unknown option keys rejected with an error naming the accepted keys (15). No idempotency keys, and the read, write and destructive labels live in the docs rather than as MCP annotations. unschedule-post and restore-post give safe ways back (6). No official SDKs, only an n8n community node (5). 5 + 12 + 15 + 6 + 5 = 43.

Xpoz MCP 63

52 tools totalling about 238 KB (5). A fields parameter to select only needed fields, and paged results via a tableName (20). No documented errors (3 of 20). All annotated, 49 read-only (20). SDKs and a CLI (15). 5 + 20 + 3 + 20 + 15 = 63.

Mixpost API + MCP 57

Personal keys as Bearer headers that expire after 7, 30, 60 or 90 days, a year, a custom date or never, and since Pro v7.1.0 (15 October 2026) can be renamed, re-dated and rotated, but have no scopes and carry the full authority of the user who made them. Each instance is also an OAuth 2.1 server with PKCE (S256 only), refresh tokens that rotate on every use, revocation and two scopes, api and mcp, which choose the surface but not what the token may do (25 of 30). A key or OAuth token from a Viewer-role user can only read, and a workspace that requires post approval puts posts scheduled through MCP into needs-approval. Deletes aren't gated (15 of 20). Tools return the operator's own posts and analytics, little untrusted text (10). Connected apps can be reviewed and disconnected; no audit log found (0). The Lite repository's SECURITY.md asks for reports by email, with no acknowledgement time, which this run reads as 7. The path traversal (24 February 2026) and XSS (17 June 2026) reports on the Lite repository have no fix; the XSS is CVE-2026-57958, a Medium assigned by VulnCheck (7 of 20). 25 + 15 + 10 + 0 + 7 = 57.

Xpoz MCP 37

One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.

Mixpost API + MCP 10

No x402 (0). Pro is $299 once and Enterprise $1,199 once, and Cloud's Momentum plan with the API and MCP is $49 a month, all public, with no per-call price (10). Lite is free but has no API or MCP, Pro has a 14-day money-back guarantee, and Cloud's 7-day trial needs a card (0). A person has to buy a licence or sign up for Cloud in a browser (0). 0 + 10 + 0 + 0 = 10.

Xpoz MCP 30

No machine payment protocol (0). Plan prices public (10). Free 500 credits (20). A person signs in for a key (0). 0 + 10 + 20 + 0 = 30.