{ "data": { "a": { "slug": "pamba", "name": "Pamba", "vendor": "Pamba", "vendorUrl": "https://pamba.app", "kind": "http-api", "category": "social-media", "summary": "Pamba makes AI avatar short-form videos and posts them to TikTok, Instagram and Facebook, through an app, a REST API and a remote MCP server. It also sells accounts it runs on its own iPhones, which those platforms forbid.", "url": "https://www.anchorterminal.com/tools/pamba", "markdownUrl": "https://www.anchorterminal.com/tools/pamba.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/pamba.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/pamba.json", "dns": "pamba.grade.anchorterminal.com", "license": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.pamba.app/mcp", "packages": [], "auth": "oauth", "authNotes": "OAuth 2.1 with PKCE and dynamic client registration on api.pamba.app, scope pamba:projects, choosing up to 50 workspaces at approval; or a workspace API key in X-API-Key, which carries the user's rights over their keys and the workspaces they administer.", "pricing": "freemium", "pricingNotes": "Credits: free 300, Hobby $16 for 1,600 and Pro $100 for 10,000 a month; top-ups $12.50 per 1,000. Managed TikTok or Instagram accounts $100 a month each. Fully managed from $7,500 a month. Per-model credit rates at GET /usage/pricing without auth. Read 11 November 2026.", "priceSummary": "$0.0125 / credit", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in Pamba's pricing, API or MCP pages, 11 November 2026. Billing is through Stripe.", "endpoints": [] }, "toolCount": 407, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-11" }, "docsUrl": "https://pamba.app/help/mcp-server", "llmsTxt": "https://pamba.app/llms.txt", "capabilities": [ "social.post", "social.schedule", "social.analytics", "social.comments", "social.media-upload", "video.generate" ], "tags": [ "hosted", "mcp", "oauth", "llms-txt", "closed-source", "freemium", "usage-priced", "tiktok", "instagram", "no-status-page", "platform-rules" ], "lastRelease": "2026-11-11", "graded": true, "anchor": { "graded": true, "score": 41.2, "grade": "E", "agentReady": false, "rank": 1334, "ranked": true, "rankOf": 1524, "categoryRank": 17, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 28 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-11" }, "negative": -15, "warnings": [ { "kind": "platform-rules", "name": "Breaks the rules of the platforms it acts on", "text": "Pamba sells TikTok and Instagram accounts it creates on its own iPhones and warms so each 'reads as a real person', pitches running 'hundreds of accounts' and replaces banned ones. TikTok's guidelines and Instagram's terms forbid that.", "deduct": -15, "since": "2026-11-11", "sources": [ "https://pamba.app/accounts", "https://pamba.app/help/account-warming", "https://www.tiktok.com/community-guidelines/en/integrity-authenticity/", "https://help.instagram.com/581066165581870" ] } ], "verdict": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.", "bestFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "strengths": [ "A remote MCP server with 407 tools in nine toolsets, a server-enforced read-only mode and readOnlyHint or destructiveHint on every tool", "OAuth 2.1 with PKCE and dynamic client registration, with protected-resource metadata on its own domain", "A tool reference generated from the server, and a dated API changelog that flags breaking changes", "Prices public without a login, including per-model credit rates from an unauthenticated route", "Publishes its own poor results: 42% of 6,678 videos it measured never reached 1,000 views" ], "weaknesses": [ "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned", "No terms of service and no privacy policy (both 404), and no legal entity named", "Managed seats hold account logins, recovery emails and 2-step codes with no published data policy", "One OAuth scope covers everything, and an API key can manage the user's keys and delete workspaces", "No status page and no security contact" ], "agentNotes": [ "Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned", "Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools", "Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400", "Read status and next on every result: refusals are results, not MCP errors", "Check credit costs before generation calls; 38 tools spend credits" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 41.2 } ], "editorialScores": { "ergonomics": 75, "maintenance": 70, "payments": 53, "reliability": 45, "schema": 84, "security": 35, "transparency": 18 }, "provenanceScore": 37, "checked": { "categories": { "ergonomics": "2026-11-11", "maintenance": "2026-11-11", "payments": "2026-11-11", "reliability": "2026-11-11", "schema": "2026-11-11", "security": "2026-11-11", "transparency": "2026-11-11" }, "last": "2026-11-11", "lastMoved": "2026-11-13", "oldest": "2026-11-11", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.pamba.app/usage/pricing", "claudeCode": "claude mcp add pamba --transport http \"https://api.pamba.app/mcp?readonly=true\"", "config": { "mcpServers": { "pamba": { "url": "https://api.pamba.app/mcp?readonly=true" } } } }, "letme": { "capability": "https://letme.dev/social.post", "tool": "https://letme.dev/pamba" }, "area": "communication", "unitPrices": [ { "item": "Managed TikTok or Instagram account", "unit": "account-month", "usd": 100, "note": "Per account; no credits needed" }, { "item": "Credits top-up", "unit": "credit", "usd": 0.0125, "note": "$12.50 per 1,000; plans work out at $10 per 1,000" } ], "provenance": { "legalEntity": "", "domain": "pamba.app", "domainRegistered": "2025-06-05", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://pamba.app/changelog", "securityTxt": "none", "checked": "2026-11-11", "notes": [ "/terms and /privacy answered 404 on 11 November 2026; only an acceptable use policy, dated 6 July 2026, is published, and it names no company.", "RDAP gives pamba.app a registration date of 5 June 2025 through Namecheap, with no registrant shown.", "robots.txt on pamba.app allows ClaudeBot on public pages and disallows app paths; api.pamba.app has no robots.txt (404).", "No entry in the official MCP registry for 'pamba' on 11 November 2026." ], "score": 37 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/pamba.json", "live": { "slug": "pamba", "probe": { "target": "https://api.pamba.app/mcp", "method": "get", "lastAt": "2026-11-13T23:58:54.025134635Z", "lastOk": true, "lastStatus": 401, "lastMs": 248, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 299, "p95ms24h": 391, "samples24h": 239, "samples30d": 319, "days": [ { "date": "2026-11-12", "probes": 81, "ok": 81 }, { "date": "2026-11-13", "probes": 238, "ok": 238 } ], "since": "2026-11-12T16:06:25.231802453Z" }, "securityTxt": { "url": "https://pamba.app/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-13T16:15:01.559101993Z" }, "llmsTxt": { "url": "https://pamba.app/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-13T15:55:36.94769184Z" }, "pages": [ { "url": "https://pamba.app/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-13T18:26:24.542486652Z", "changedAt": "2026-11-13T18:26:24.542486652Z", "fingerprint": "a0b9ef3713fa" } ], "mcpTools": { "url": "https://api.pamba.app/mcp?readonly=true", "checkedAt": "2026-11-13T03:13:09.042103119Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-13T03:13:09.042103119Z" }, "updatedAt": "2026-11-13T23:58:54.025134635Z" }, "streak": { "days": 2, "from": "2026-11-12", "sinceWatching": true, "best": 2 } }, "answer": "Postiz API + MCP scores 47.1 (D) on agent readiness against Pamba's 41.2 (E), and leads in 4 of 7 scored categories. Pamba leads on agent ergonomics and payments \u0026 pricing.", "b": { "slug": "postiz", "name": "Postiz API + MCP", "vendor": "Postiz (Gitroom)", "vendorUrl": "https://postiz.com", "kind": "http-api", "category": "social-media", "summary": "Open-source social scheduler (AGPL-3.0) for 34 platforms that you can self-host free or use as Postiz Cloud from $29 a month.", "url": "https://www.anchorterminal.com/tools/postiz", "markdownUrl": "https://www.anchorterminal.com/tools/postiz.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/postiz.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/postiz.json", "dns": "postiz.grade.anchorterminal.com", "repo": "https://github.com/gitroomhq/postiz-app", "license": "AGPL-3.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.postiz.com/public/v1", "packages": [ { "registry": "npm", "name": "@postiz/node" }, { "registry": "npm", "name": "postiz" } ], "auth": "mixed", "authNotes": "API key sent raw in the Authorization header (no Bearer prefix), or an OAuth app token prefixed pos_. The MCP accepts a Bearer header at /mcp, an OAuth flow at /mcp-oauth, or the key in the URL path at /mcp/{key}. Self-hosted instances need their own developer apps for each network.", "pricing": "paid", "pricingNotes": "Self-hosting is free under AGPL-3.0, but you register your own developer app with each network. Per the 1 October check, Postiz Cloud has no free plan (7-day trial, card policy not stated), Standard $29 a month or $23 billed yearly (5 channels), Team $39 or $31 (10), Pro $49 or $39 (30), Ultimate $99 or $79 (100), with API, CLI, webhooks and MCP on every plan and posts unlimited. The terms of 19 October 2026 refund at most one month's fee per account, within 120 days, and never annual charges (https://postiz.com/terms-of-service).", "priceSummary": "$29 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402 in docs, llms.txt or pricing (checked 2026-09-30).", "endpoints": [] }, "toolCount": 13, "popularity": { "githubStars": 36531, "npmWeekly": 368, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.postiz.com", "llmsTxt": "https://docs.postiz.com/llms.txt", "openapi": "https://docs.postiz.com/public-api/openapi.json", "capabilities": [ "social.post", "social.schedule", "social.analytics", "social.media-upload" ], "tags": [ "hosted", "self-hosted", "local", "open-source", "mcp", "llms-txt", "openapi", "typescript", "webhooks" ], "lastRelease": "2026-10-24", "graded": true, "anchor": { "graded": true, "score": 47.1, "grade": "D", "agentReady": false, "rank": 1208, "ranked": true, "rankOf": 1524, "categoryRank": 11, "methodology": "0.8", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 83, "payments": 45, "reliability": 43, "schema": 88, "security": 49, "transparency": 82 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -15, "negativeNotes": [ "2026-03-27 to 2026-10-24. Postiz, its own CVE Numbering Authority, published 20 advisories in the 12 months, all fixed in releases, counted one by one at this run's values. Within two months of publication, CVE-2026-94456 (Critical) and CVE-2026-94455 (High, 22 September), CVE-2026-107761 (11 October, organisation key exposed in API responses) and CVE-2026-115931, -115932 and -115933 (Critical, 23 and 24 October, file reads and forged tokens taking over other organisations, fixed in v2.25.2 and v2.25.3) cost 11. Fourteen published from 27 March to 7 August (among them CVE-2026-19264, the unauthenticated /uploads path traversal, and CVE-2026-48781, a cross-tenant takeover) cost 14. The total passes the -15 floor (https://osv.dev/vulnerability/CVE-2026-115933, https://github.com/gitroomhq/postiz-app/blob/main/SECURITY.md)", "2026-10-15. v2.25.2 fixed a login open redirect through which a returnUrl using the javascript scheme could run script on the Postiz origin (commit 9a88959), and \"ssrf fixes\" (5f18f1c), with no advisory found in OSV. A released fix of the product's own described flaw with no advisory is a separate -3, inside the floor (https://github.com/gitroomhq/postiz-app/commit/9a88959839f92ad5d7ecabea300b3186272cebb3)" ], "verdict": "AGPL-3.0 and self-hostable with the API and MCP included, 34 platforms, with annotated MCP tools in the source. Postiz published 20 security advisories between March and October 2026, three of them Critical in late October, all fixed in releases. Create-post is capped at 90 requests an hour on every Cloud plan.", "bestFor": "Teams that want to self-host, or want 34 platforms including Mastodon, Farcaster, Discord and Slack on a flat plan.", "strengths": [ "AGPL-3.0 and self-hostable with the API and MCP included, 34 platforms", "OpenAPI 3.1 spec with 27 paths, llms.txt and Markdown docs, per the 1 October check", "MCP tools in source carry readOnlyHint, destructiveHint and idempotentHint, with when-not-to-use guidance", "Five releases from 22 September to 24 October 2026, and advisories published with CVEs through its own disclosure process", "Analytics and error reporting in the self-hosted build stay off unless their environment variables are set" ], "weaknesses": [ "20 security advisories between March and October 2026, including cross-tenant takeovers and file reads", "One organisation key with no scopes, and the MCP OAuth grant is always read and write", "The docs document the API key in the MCP URL path at /mcp/{key}", "No idempotency key and no Retry-After guidance", "Create-post capped at 90 requests an hour on every Cloud plan" ], "agentNotes": [ "Send the key as the `Authorization` header with no `Bearer` prefix on REST calls", "Batch several posts into one create request to stay under 90 an hour", "Call integrationSchema (Get Settings) for a channel before scheduling, since each network has its own settings", "Use the Bearer header on /mcp rather than /mcp/{key} so the key stays out of logs", "Run v2.25.3 or later when self-hosting, since earlier versions carry three Critical advisories published on 23 and 24 October 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.8", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47.1 } ], "editorialScores": { "ergonomics": 65, "maintenance": 83, "payments": 45, "reliability": 43, "schema": 88, "security": 49, "transparency": 75 }, "provenanceScore": 89, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-13", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl https://api.postiz.com/public/v1/integrations -H \"Authorization: $POSTIZ_API_KEY\"", "claudeCode": "claude mcp add --transport http postiz https://mcp.postiz.com/mcp --header \"Authorization: Bearer $POSTIZ_API_KEY\"" }, "letme": { "capability": "https://letme.dev/social.post", "tool": "https://letme.dev/postiz" }, "area": "communication", "unitPrices": [ { "item": "Standard plan", "unit": "month", "usd": 29, "note": "5 channels. $278 a year" }, { "item": "Team plan", "unit": "month", "usd": 39, "note": "10 channels. $374 a year" }, { "item": "Pro plan", "unit": "month", "usd": 49, "note": "30 channels. $470 a year" }, { "item": "Ultimate plan", "unit": "month", "usd": 99, "note": "100 channels. $950 a year" } ], "provenance": { "legalEntity": "Gitroom Limited", "domain": "postiz.com", "domainRegistered": "2013-06-24", "domainNote": "postiz.com was registered in 2013, well before the project started in 2023.", "endpointOnVendorDomain": true, "terms": "https://postiz.com/terms-of-service", "privacy": "https://postiz.com/privacy-policy", "statusPage": "https://status.postiz.com", "changelog": "https://github.com/gitroomhq/postiz-app/releases", "securityTxt": "none", "checked": "2026-09-30", "notes": [ "Terms name Gitroom Limited (seller of paid plans) and Gitroom LLC together as Postiz" ], "score": 89 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/postiz.json", "live": { "slug": "postiz", "probe": { "target": "https://api.postiz.com/public/v1", "method": "get", "lastAt": "2026-11-13T23:58:56.257286431Z", "lastOk": true, "lastStatus": 404, "lastMs": 287, "authRequired": false, "uptime24h": 100, "uptime30d": 99.68, "p50ms24h": 318, "p95ms24h": 444, "samples24h": 239, "samples30d": 7892, "days": [ { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 254 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 248 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 246 }, { "date": "2026-10-31", "probes": 251, "ok": 250 }, { "date": "2026-11-01", "probes": 249, "ok": 234 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 243, "ok": 243 }, { "date": "2026-11-08", "probes": 243, "ok": 243 }, { "date": "2026-11-09", "probes": 243, "ok": 243 }, { "date": "2026-11-10", "probes": 244, "ok": 244 }, { "date": "2026-11-11", "probes": 244, "ok": 244 }, { "date": "2026-11-12", "probes": 245, "ok": 245 }, { "date": "2026-11-13", "probes": 238, "ok": 238 } ], "outages": [ { "start": "2026-11-01T00:54:51.402069554Z", "end": "2026-11-01T02:20:29.804585001Z", "note": "DNS lookup failed" } ], "since": "2026-10-08T00:00:00Z" }, "vendorStatus": { "page": "https://status.postiz.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-13T23:55:22.862638788Z" }, "versions": [ { "registry": "github", "name": "gitroomhq/postiz-app", "version": "v2.25.3", "released": "2026-10-24", "seenAt": "2026-11-13T09:07:11.743094025Z" }, { "registry": "npm", "name": "@postiz/node", "version": "1.0.8", "seenAt": "2026-11-13T09:07:09.539450885Z" }, { "registry": "npm", "name": "postiz", "version": "2.0.27", "seenAt": "2026-11-13T09:07:10.339667757Z" } ], "githubStars": 41498, "npmWeekly": 115, "securityTxt": { "url": "https://postiz.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-13T16:17:10.19783515Z" }, "llmsTxt": { "url": "https://docs.postiz.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-13T15:55:42.362882907Z" }, "domain": { "domain": "postiz.com", "registered": "2013-06-24", "source": "https://rdap.verisign.com/com/v1/domain/postiz.com", "checkedAt": "2026-11-08T15:02:33.544634643Z" }, "pages": [ { "url": "https://postiz.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-04T08:30:23.777534373Z", "changedAt": "2026-10-15T21:32:23.048080477Z", "fingerprint": "603523fd803e" }, { "url": "https://postiz.com/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-13T18:27:39.319819653Z", "changedAt": "2026-10-20T00:03:52.176361053Z", "fingerprint": "1698159242ba" }, { "url": "https://postiz.com/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-11-13T18:27:41.665218615Z", "changedAt": "2026-10-20T00:03:54.183695942Z", "fingerprint": "418d2edbefbd" } ], "mcpTools": { "url": "https://mcp.postiz.com/mcp", "checkedAt": "2026-11-13T03:13:21.421773334Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:46:54.699000256Z" }, "github": { "repo": "gitroomhq/postiz-app", "checkedAt": "2026-11-09T10:26:37.729397903Z", "stars": 41169, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-09T10:25:15Z", "openIssues": 134, "openPRs": 79, "issuesOpened90d": 94, "issuesClosed90d": 119, "prsMerged90d": 247, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-09T09:34:09Z" }, "advisories": [ { "ghsa": "GHSA-fw23-6gv6-pr5p", "cve": "CVE-2026-115933", "severity": "critical", "published": "2026-11-02T23:06:02Z" }, { "ghsa": "GHSA-q6r4-5ph8-gr45", "cve": "CVE-2026-115932", "severity": "critical", "published": "2026-11-02T23:05:39Z" }, { "ghsa": "GHSA-jwv2-hpxf-9gwr", "cve": "CVE-2026-115931", "severity": "critical", "published": "2026-11-02T23:05:06Z" }, { "ghsa": "GHSA-jhfm-m4vp-jcpc", "cve": "CVE-2026-107761", "severity": "medium", "published": "2026-11-02T23:04:32Z" }, { "ghsa": "GHSA-629m-99qx-356r", "cve": "CVE-2026-94455", "severity": "high", "published": "2026-09-22T16:16:49Z" }, { "ghsa": "GHSA-4hw5-43cf-g9wp", "cve": "CVE-2026-94456", "severity": "critical", "published": "2026-09-22T14:19:29Z" }, { "ghsa": "GHSA-4hgh-5rhf-4qpm", "severity": "critical", "published": "2026-08-07T14:15:54Z" }, { "ghsa": "GHSA-5m7p-wphr-xjp7", "cve": "CVE-2026-19127", "severity": "medium", "published": "2026-08-06T17:28:44Z" }, { "ghsa": "GHSA-j7rp-5mgj-qgg9", "cve": "CVE-2026-48799", "severity": "high", "published": "2026-05-23T12:24:21Z" }, { "ghsa": "GHSA-v4wr-4j8g-4hfj", "cve": "CVE-2026-48783", "severity": "medium", "published": "2026-05-22T18:55:41Z" }, { "ghsa": "GHSA-j77w-h625-56q2", "cve": "CVE-2026-48781", "severity": "critical", "published": "2026-05-22T18:28:38Z" }, { "ghsa": "GHSA-f7jj-p389-4w45", "cve": "CVE-2026-42346", "severity": "medium", "published": "2026-04-28T12:20:41Z" }, { "ghsa": "GHSA-jxg2-2cmf-h66m", "severity": "medium", "published": "2026-04-28T12:18:58Z" }, { "ghsa": "GHSA-hhxq-3wg7-4rj8", "cve": "CVE-2026-42556", "severity": "high", "published": "2026-04-27T19:34:49Z" }, { "ghsa": "GHSA-v975-9h5p-xhm4", "cve": "CVE-2026-42298", "severity": "critical", "published": "2026-04-22T14:22:06Z" }, { "ghsa": "GHSA-44wg-r34q-hvfx", "cve": "CVE-2026-40487", "severity": "critical", "published": "2026-04-12T04:07:21Z" }, { "ghsa": "GHSA-34w8-5j2v-h6ww", "cve": "CVE-2026-40168", "severity": "high", "published": "2026-04-09T12:21:20Z" }, { "ghsa": "GHSA-wc9c-7cv8-m225", "cve": "CVE-2026-34590", "severity": "medium", "published": "2026-03-29T16:00:06Z" }, { "ghsa": "GHSA-89vp-m2qw-7v34", "cve": "CVE-2026-34576", "severity": "medium", "published": "2026-03-29T07:15:39Z" }, { "ghsa": "GHSA-mv6h-v3jg-g539", "cve": "CVE-2026-34577", "severity": "high", "published": "2026-03-29T07:15:27Z" }, { "ghsa": "GHSA-89v5-38xr-9m4j", "severity": "high", "published": "2026-03-25T10:48:29Z" }, { "ghsa": "GHSA-vj2p-7pgw-g2wf", "cve": "CVE-2024-34351", "severity": "high", "published": "2026-03-25T10:15:46Z" }, { "ghsa": "GHSA-48c8-25jq-m55f", "cve": "CVE-2025-53641", "severity": "high", "published": "2025-07-11T16:15:50Z" } ], "replies": { "sampled": 25, "unanswered": 21, "medianDays": 0.1 } }, "updatedAt": "2026-11-13T23:58:56.257286431Z" }, "streak": { "days": 13, "from": "2026-11-01", "last": { "kind": "outage", "date": "2026-11-01", "what": "DNS lookup failed", "lasted": "1 hour" }, "best": 24 } }, "edges": [ { "by": 54, "category": "transparency", "leads": "postiz", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.", "b": "AGPL-3.0 (30). Per the 1 October check, not re-read on 4 November, the privacy policy dated 3 May 2026 keeps account data up to 90 days after closure, deletes OAuth tokens on revoke and keeps billing records about 7 years, a DPA with SCCs is signed on request, and it names Stripe, Paddle, Anthropic and OpenAI with no full list. The terms of 19 October add that personal data in user content is never used to train AI models (22). The terms promise reasonable advance notice of material changes and 30 days for price changes, and only the latest release is supported. No API deprecation policy (8). Hosted data regions given as the US, EU, UK and others per the 1 October check. In the source at v2.25.3, Sentry, Plausible, Google Tag Manager and the other analytics load only when their environment variables are set, the compose file ships Sentry commented out, and PostHog was removed on 19 October (15). 30 + 22 + 8 + 15 = 75." }, "scores": { "a": 28, "b": 82 } }, { "by": 14, "category": "security", "leads": "postiz", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.", "b": "Per the 1 October check, not re-read on 4 November, Postiz uses one organisation API key, sent raw in the Authorization header and rotatable from settings. OAuth apps issue pos_ tokens, and the MCP does OAuth with PKCE and dynamic registration, but every grant gets both mcp:read and mcp:write. The docs also document the key in the URL path at /mcp/{key}, so less 10 (15). No read-only key or scope. Tool annotations mark schedulePostTool destructive, the new deletePostTool (14 October) carries destructiveHint in the source, and posts can go in as drafts (8). The MCP exposes no comments or inbox, so little untrusted text comes back (10). No audit log found, only notifications (2). SECURITY.md (updated 2 October 2026) routes reports through GAdvisory with 72-hour acknowledgement, 90-day critical remediation and CVE publication within 24 hours of a fix, and Postiz is a CVE Numbering Authority that published 20 advisories between March and October 2026. CI runs CodeQL. No bug bounty, certification or security.txt (14)." }, "scores": { "a": 35, "b": 49 } }, { "by": 13, "category": "maintenance", "leads": "postiz", "name": "Maintenance \u0026 community", "reasons": { "a": "Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.", "b": "v2.25.3 on 24 October 2026, and the default branch had commits on 3 November (30). v2.24.0 (22 September), v2.25.0 (2 October), v2.25.1 (9 October), v2.25.2 and v2.25.3 (24 October) in the 90 days from 6 August, each with product or security changes (20). Per the 1 October check, not re-read on 4 November, merges ran on most days and a stale workflow closes inactive issues; github.com's issue pages are unreadable to us (15). Official Node SDK (@postiz/node 1.0.8 in the repository) and CLI; npm not re-read. No official MCP registry entry (10). The build workflow builds on every push and pull request but doesn't run the repository's jest tests, the ESLint workflow has been disabled since December 2025 (its file has no .yml extension), and CodeQL runs. Dependencies were updated on 24 October. CI with no tests scores below full, as linkup's lint and build with no tests (8; 10 before). 30 + 20 + 15 + 10 + 8 = 83." }, "scores": { "a": 70, "b": 83 } }, { "by": 10, "category": "ergonomics", "leads": "pamba", "name": "Agent ergonomics", "reasons": { "a": "Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.", "b": "The docs say 13 MCP tools. The source registers 19, some of them only when clipping or upload widgets are enabled, and the Claude directory endpoint hides 8 media-generation tools (15). Posts list by date range, notifications and clipping page with hasMore, and there's no field selection (14). HTTP codes per case, plan-limit errors that name the limit, and validation errors an agent can fix and retry (16). Every MCP tool in source carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint. No idempotency key on REST (12). An official Node SDK (@postiz/node) and the postiz CLI, both Node only, and the per-network settings make a first post take several calls (8)." }, "scores": { "a": 75, "b": 65 } }, { "by": 8, "category": "payments", "leads": "pamba", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.", "b": "No x402 or other machine payment (0). Cloud plan prices are public, with no per-call price (10). Self-hosting under AGPL-3.0 is free and includes the API and MCP, with no card. The Cloud trial's card policy isn't stated (20). Cloud needs a browser signup, and self-hosting needs a person to register developer apps with each network (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 30 is 45." }, "scores": { "a": 53, "b": 45 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Pamba", "b": "Postiz (Gitroom)", "name": "Vendor" }, { "a": "https://api.pamba.app/mcp", "b": "https://api.postiz.com/public/v1", "name": "Hosted endpoint" }, { "a": "HTTP, Streamable HTTP", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Freemium", "b": "Paid", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Closed service. No terms of service or privacy policy published; an acceptable use policy only", "b": "AGPL-3.0", "name": "Licence" }, { "a": "407", "b": "13", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-11", "b": "2026-10-24", "name": "Last release" }, { "a": "no document linked", "b": "2026-05-03", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-05-03", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "37k stars, 368 npm/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Postiz API + MCP scores 47.1 (D) on agent readiness against Pamba's 41.2 (E), and leads in 4 of 7 scored categories. Pamba leads on agent ergonomics and payments \u0026 pricing.", "question": "Which is better for AI agents, Pamba or Postiz API + MCP?" }, { "answer": "Pamba uses an OAuth sign-in. Postiz API + MCP takes an API key or an OAuth sign-in.", "question": "Do Pamba and Postiz API + MCP need an API key?" }, { "answer": "Yes. Pamba has a hosted endpoint at https://api.pamba.app/mcp and Postiz API + MCP at https://api.postiz.com/public/v1.", "question": "Can an agent call Pamba and Postiz API + MCP without installing anything?" }, { "answer": "No open-source release is listed for Pamba. Postiz API + MCP is open source (AGPL-3.0).", "question": "Are Pamba and Postiz API + MCP open source?" } ], "goodFor": [ { "aheadOn": [ "Agent ergonomics, 75 against 65", "Payments \u0026 pricing, 53 against 45" ], "also": null, "goodFor": "Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.", "slug": "pamba", "watchFor": "Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned" }, { "aheadOn": [ "Security \u0026 auth, 49 against 35", "Maintenance \u0026 community, 83 against 70", "Transparency \u0026 trust, 82 against 28" ], "also": [ "Open source" ], "goodFor": "Teams that want to self-host, or want 34 platforms including Mastodon, Farcaster, Discord and Slack on a flat plan.", "slug": "postiz", "watchFor": "20 security advisories between March and October 2026, including cross-tenant takeovers and file reads" } ], "history": { "pamba": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 2.3, "from": 38.9, "fromGrade": "E", "to": 41.2, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-11-13", "delta": -5, "from": 43.9, "fromGrade": "E", "to": 38.9, "toGrade": "E" } ], "postiz": [ { "causes": [ "method" ], "date": "2026-11-13", "delta": 1.9, "from": 45.2, "fromGrade": "E", "to": 47.1, "toGrade": "D" }, { "causes": [ "security", "correction" ], "date": "2026-11-04", "delta": -14.2, "from": 59.4, "fromGrade": "C", "to": 45.2, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 59.3, "fromGrade": "C", "to": 59.4, "toGrade": "C" } ] }, "job": { "capability": "social.post", "name": "Social posting" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba.json", "title": "Ayrshare API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/ayrshare-vs-postiz.json", "title": "Ayrshare API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/ayrshare-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-pamba.json", "title": "Blotato vs Pamba", "url": "https://www.anchorterminal.com/compare/blotato-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/blotato-vs-postiz.json", "title": "Blotato vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/blotato-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-pamba.json", "title": "Buffer API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/buffer-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/buffer-vs-postiz.json", "title": "Buffer API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/buffer-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba.json", "title": "bundle.social vs Pamba", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/bundle-social-vs-postiz.json", "title": "bundle.social vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/bundle-social-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/late-vs-pamba.json", "title": "Zernio (formerly Late) API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/late-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/late-vs-postiz.json", "title": "Zernio (formerly Late) API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/late-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-pamba.json", "title": "Metricool API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/metricool-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/metricool-vs-postiz.json", "title": "Metricool API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/metricool-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-pamba.json", "title": "Mixpost API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/mixpost-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/mixpost-vs-postiz.json", "title": "Mixpost API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/mixpost-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/oneup-vs-pamba.json", "title": "OneUp API + MCP vs Pamba", "url": "https://www.anchorterminal.com/compare/oneup-vs-pamba" }, { "json": "https://www.anchorterminal.com/compare/oneup-vs-postiz.json", "title": "OneUp API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/oneup-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge.json", "title": "Pamba vs Post Bridge API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-post-bridge" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-publer.json", "title": "Pamba vs Publer API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-publer" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-repostit.json", "title": "Pamba vs Repostit", "url": "https://www.anchorterminal.com/compare/pamba-vs-repostit" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-typefully.json", "title": "Pamba vs Typefully", "url": "https://www.anchorterminal.com/compare/pamba-vs-typefully" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-upload-post.json", "title": "Pamba vs Upload-Post API + MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-upload-post" }, { "json": "https://www.anchorterminal.com/compare/post-bridge-vs-postiz.json", "title": "Post Bridge API + MCP vs Postiz API + MCP", "url": "https://www.anchorterminal.com/compare/post-bridge-vs-postiz" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-publer.json", "title": "Postiz API + MCP vs Publer API + MCP", "url": "https://www.anchorterminal.com/compare/postiz-vs-publer" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-repostit.json", "title": "Postiz API + MCP vs Repostit", "url": "https://www.anchorterminal.com/compare/postiz-vs-repostit" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-typefully.json", "title": "Postiz API + MCP vs Typefully", "url": "https://www.anchorterminal.com/compare/postiz-vs-typefully" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-upload-post.json", "title": "Postiz API + MCP vs Upload-Post API + MCP", "url": "https://www.anchorterminal.com/compare/postiz-vs-upload-post" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social.json", "title": "Pamba vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/pamba-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.json", "title": "Pamba vs TwitterAPI.io MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp.json", "title": "Pamba vs X MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.json", "title": "Pamba vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-sprout-social.json", "title": "Postiz API + MCP vs Sprout Social API", "url": "https://www.anchorterminal.com/compare/postiz-vs-sprout-social" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-twitterapi-io-mcp.json", "title": "Postiz API + MCP vs TwitterAPI.io MCP", "url": "https://www.anchorterminal.com/compare/postiz-vs-twitterapi-io-mcp" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-x-mcp.json", "title": "Postiz API + MCP vs X MCP", "url": "https://www.anchorterminal.com/compare/postiz-vs-x-mcp" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-xpoz-mcp.json", "title": "Postiz API + MCP vs Xpoz MCP", "url": "https://www.anchorterminal.com/compare/postiz-vs-xpoz-mcp" }, { "json": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon.json", "title": "Pamba vs SocialCannon", "url": "https://www.anchorterminal.com/compare/pamba-vs-socialcannon" }, { "json": "https://www.anchorterminal.com/compare/postiz-vs-socialcannon.json", "title": "Postiz API + MCP vs SocialCannon", "url": "https://www.anchorterminal.com/compare/postiz-vs-socialcannon" } ], "panel": null, "scores": [ { "by": 2, "edge": "pamba", "key": "reliability", "name": "Reliability", "pamba": 45, "postiz": 43, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "edge": "postiz", "key": "schema", "name": "Schema \u0026 documentation", "pamba": 84, "postiz": 88, "weight": 13 }, { "by": 10, "edge": "pamba", "key": "ergonomics", "name": "Agent ergonomics", "pamba": 75, "postiz": 65, "weight": 13 }, { "by": 14, "edge": "postiz", "key": "security", "name": "Security \u0026 auth", "pamba": 35, "postiz": 49, "weight": 14 }, { "by": 8, "edge": "pamba", "key": "payments", "name": "Payments \u0026 pricing", "pamba": 53, "postiz": 45, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 13, "edge": "postiz", "key": "maintenance", "name": "Maintenance \u0026 community", "pamba": 70, "postiz": 83, "weight": 7 }, { "by": 54, "edge": "postiz", "key": "transparency", "name": "Transparency \u0026 trust", "pamba": 28, "postiz": 82, "weight": 7 } ], "summary": "Postiz API + MCP scores 47.1 (D) on agent readiness against Pamba's 41.2 (E), and leads in 4 of 7 scored categories. Pamba leads on agent ergonomics and payments \u0026 pricing. Both do social posting.", "tasks": null, "tutorials": [ { "title": "Create a Bluesky draft with Postiz", "tool": "postiz", "url": "https://www.anchorterminal.com/tutorials/postiz/" } ], "verdicts": { "pamba": "Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.", "postiz": "AGPL-3.0 and self-hostable with the API and MCP included, 34 platforms, with annotated MCP tools in the source. Postiz published 20 security advisories between March and October 2026, three of them Critical in late October, all fixed in releases. Create-post is capped at 90 requests an hour on every Cloud plan." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/pamba-vs-postiz", "json": "https://www.anchorterminal.com/compare/pamba-vs-postiz.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/pamba-vs-postiz.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/pamba-vs-postiz.min.md" }, "markdown": "Postiz API + MCP scores 47.1 (D) on agent readiness against Pamba's 41.2 (E), and leads in 4 of 7 scored categories. Pamba leads on agent ergonomics and payments \u0026 pricing. Both do social posting.\n\n- Pamba: grade E, 41.2/100, rank #1334 of 1524. Markdown https://www.anchorterminal.com/tools/pamba.md · JSON https://www.anchorterminal.com/api/v1/tools/pamba.json\n- Postiz API + MCP: grade D, 47.1/100, rank #1208 of 1524. Markdown https://www.anchorterminal.com/tools/postiz.md · JSON https://www.anchorterminal.com/api/v1/tools/postiz.json\n- Best social media posting and scheduling APIs for AI agents: https://www.anchorterminal.com/best/social-media/index.md\n- All 182 social comparisons: https://www.anchorterminal.com/compare/social-media/index.md\n\n## Which one, for what\n\n### Pamba (E)\n\nGood for: Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.\n\nAhead on:\n- Agent ergonomics, 75 against 65\n- Payments \u0026 pricing, 53 against 45\n\nWatch for: Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned\n\n### Postiz API + MCP (D)\n\nGood for: Teams that want to self-host, or want 34 platforms including Mastodon, Farcaster, Discord and Slack on a flat plan.\n\nAhead on:\n- Security \u0026 auth, 49 against 35\n- Maintenance \u0026 community, 83 against 70\n- Transparency \u0026 trust, 82 against 28\n\nAlso in its favour:\n- Open source\n\nWatch for: 20 security advisories between March and October 2026, including cross-tenant takeovers and file reads\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Postiz API + MCP +54\n\n- Pamba (28): Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.\n- Postiz API + MCP (82): AGPL-3.0 (30). Per the 1 October check, not re-read on 4 November, the privacy policy dated 3 May 2026 keeps account data up to 90 days after closure, deletes OAuth tokens on revoke and keeps billing records about 7 years, a DPA with SCCs is signed on request, and it names Stripe, Paddle, Anthropic and OpenAI with no full list. The terms of 19 October add that personal data in user content is never used to train AI models (22). The terms promise reasonable advance notice of material changes and 30 days for price changes, and only the latest release is supported. No API deprecation policy (8). Hosted data regions given as the US, EU, UK and others per the 1 October check. In the source at v2.25.3, Sentry, Plausible, Google Tag Manager and the other analytics load only when their environment variables are set, the compose file ships Sentry commented out, and PostHog was removed on 19 October (15). 30 + 22 + 8 + 15 = 75.\n\n### Security \u0026 auth: Postiz API + MCP +14\n\n- Pamba (35): OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.\n- Postiz API + MCP (49): Per the 1 October check, not re-read on 4 November, Postiz uses one organisation API key, sent raw in the Authorization header and rotatable from settings. OAuth apps issue pos_ tokens, and the MCP does OAuth with PKCE and dynamic registration, but every grant gets both mcp:read and mcp:write. The docs also document the key in the URL path at /mcp/{key}, so less 10 (15). No read-only key or scope. Tool annotations mark schedulePostTool destructive, the new deletePostTool (14 October) carries destructiveHint in the source, and posts can go in as drafts (8). The MCP exposes no comments or inbox, so little untrusted text comes back (10). No audit log found, only notifications (2). SECURITY.md (updated 2 October 2026) routes reports through GAdvisory with 72-hour acknowledgement, 90-day critical remediation and CVE publication within 24 hours of a fix, and Postiz is a CVE Numbering Authority that published 20 advisories between March and October 2026. CI runs CodeQL. No bug bounty, certification or security.txt (14).\n\n### Maintenance \u0026 community: Postiz API + MCP +13\n\n- Pamba (70): Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.\n- Postiz API + MCP (83): v2.25.3 on 24 October 2026, and the default branch had commits on 3 November (30). v2.24.0 (22 September), v2.25.0 (2 October), v2.25.1 (9 October), v2.25.2 and v2.25.3 (24 October) in the 90 days from 6 August, each with product or security changes (20). Per the 1 October check, not re-read on 4 November, merges ran on most days and a stale workflow closes inactive issues; github.com's issue pages are unreadable to us (15). Official Node SDK (@postiz/node 1.0.8 in the repository) and CLI; npm not re-read. No official MCP registry entry (10). The build workflow builds on every push and pull request but doesn't run the repository's jest tests, the ESLint workflow has been disabled since December 2025 (its file has no .yml extension), and CodeQL runs. Dependencies were updated on 24 October. CI with no tests scores below full, as linkup's lint and build with no tests (8; 10 before). 30 + 20 + 15 + 10 + 8 = 83.\n\n### Agent ergonomics: Pamba +10\n\n- Pamba (75): Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.\n- Postiz API + MCP (65): The docs say 13 MCP tools. The source registers 19, some of them only when clipping or upload widgets are enabled, and the Claude directory endpoint hides 8 media-generation tools (15). Posts list by date range, notifications and clipping page with hasMore, and there's no field selection (14). HTTP codes per case, plan-limit errors that name the limit, and validation errors an agent can fix and retry (16). Every MCP tool in source carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint. No idempotency key on REST (12). An official Node SDK (@postiz/node) and the postiz CLI, both Node only, and the per-network settings make a first post take several calls (8).\n\n### Payments \u0026 pricing: Pamba +8\n\n- Pamba (53): No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.\n- Postiz API + MCP (45): No x402 or other machine payment (0). Cloud plan prices are public, with no per-call price (10). Self-hosting under AGPL-3.0 is free and includes the API and MCP, with no card. The Cloud trial's card policy isn't stated (20). Cloud needs a browser signup, and self-hosting needs a person to register developer apps with each network (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 30 is 45.\n\n## Score by category\n\n| Category | Weight | Pamba | Postiz API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 45 | 43 | Pamba +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 84 | 88 | Postiz API + MCP +4 |\n| Agent ergonomics | 13% (16.2 this run) | 75 | 65 | Pamba +10 |\n| Security \u0026 auth | 14% (17.5 this run) | 35 | 49 | Postiz API + MCP +14 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 53 | 45 | Pamba +8 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 83 | Postiz API + MCP +13 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 28 | 82 | Postiz API + MCP +54 |\n| Negative events | ≤15 | -15 | -15 | |\n| **Total** | | **41.2 · E** | **47.1 · D** | |\n\n## Facts side by side\n\n| Fact | Pamba | Postiz API + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Pamba | Postiz (Gitroom) |\n| Hosted endpoint | `https://api.pamba.app/mcp` | `https://api.postiz.com/public/v1` |\n| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Freemium | Paid |\n| x402 | no | no |\n| Licence | Closed service. No terms of service or privacy policy published; an acceptable use policy only | AGPL-3.0 |\n| Tools exposed | 407 | 13 |\n| Read-only variant documented | yes | no |\n| llms.txt | yes | yes |\n| Last release | 2026-11-11 | 2026-10-24 |\n| Terms last updated | no document linked | 2026-05-03 |\n| Privacy policy last updated | no document linked | 2026-05-03 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | none | 37k stars, 368 npm/wk |\n| Agent reviews | none | 3/5 (2) |\n\n## How the scores have moved\n\n### Pamba\n\n- +2.3 on 13 November 2026: checklist\n- -5.0 on 13 November 2026: checklist\n\n### Postiz API + MCP\n\n- +1.9 on 13 November 2026 (E to D): checklist\n- -14.2 on 4 November 2026 (C to E): security, correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Pamba.** Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.\n\n**Postiz API + MCP.** AGPL-3.0 and self-hostable with the API and MCP included, 34 platforms, with annotated MCP tools in the source. Postiz published 20 security advisories between March and October 2026, three of them Critical in late October, all fixed in releases. Create-post is capped at 90 requests an hour on every Cloud plan.\n\n## Before you call either\n\n### Pamba\n\n1. Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned\n2. Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools\n3. Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400\n4. Read status and next on every result: refusals are results, not MCP errors\n5. Check credit costs before generation calls; 38 tools spend credits\n\n### Postiz API + MCP\n\n1. Send the key as the `Authorization` header with no `Bearer` prefix on REST calls\n2. Batch several posts into one create request to stay under 90 an hour\n3. Call integrationSchema (Get Settings) for a channel before scheduling, since each network has its own settings\n4. Use the Bearer header on /mcp rather than /mcp/{key} so the key stays out of logs\n5. Run v2.25.3 or later when self-hosting, since earlier versions carry three Critical advisories published on 23 and 24 October 2026\n\n## Tutorials\n\n- [Create a Bluesky draft with Postiz](https://www.anchorterminal.com/tutorials/postiz/), for Postiz API + MCP\n\n## Questions\n\n### Which is better for AI agents, Pamba or Postiz API + MCP?\n\nPostiz API + MCP scores 47.1 (D) on agent readiness against Pamba's 41.2 (E), and leads in 4 of 7 scored categories. Pamba leads on agent ergonomics and payments \u0026 pricing.\n\n### Do Pamba and Postiz API + MCP need an API key?\n\nPamba uses an OAuth sign-in. Postiz API + MCP takes an API key or an OAuth sign-in.\n\n### Can an agent call Pamba and Postiz API + MCP without installing anything?\n\nYes. Pamba has a hosted endpoint at https://api.pamba.app/mcp and Postiz API + MCP at https://api.postiz.com/public/v1.\n\n### Are Pamba and Postiz API + MCP open source?\n\nNo open-source release is listed for Pamba. Postiz API + MCP is open source (AGPL-3.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/pamba-vs-postiz.json, and with the fewest tokens: https://www.anchorterminal.com/compare/pamba-vs-postiz.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"pamba\", \"b\": \"postiz\"}`. From a terminal: `anchor compare pamba postiz`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/pamba.json and https://www.anchorterminal.com/api/v1/tools/postiz.json\n\n## Other comparisons with Pamba or Postiz API + MCP\n\n- [Ayrshare API + MCP vs Pamba](https://www.anchorterminal.com/compare/ayrshare-vs-pamba.md)\n- [Ayrshare API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/ayrshare-vs-postiz.md)\n- [Blotato vs Pamba](https://www.anchorterminal.com/compare/blotato-vs-pamba.md)\n- [Blotato vs Postiz API + MCP](https://www.anchorterminal.com/compare/blotato-vs-postiz.md)\n- [Buffer API + MCP vs Pamba](https://www.anchorterminal.com/compare/buffer-vs-pamba.md)\n- [Buffer API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/buffer-vs-postiz.md)\n- [bundle.social vs Pamba](https://www.anchorterminal.com/compare/bundle-social-vs-pamba.md)\n- [bundle.social vs Postiz API + MCP](https://www.anchorterminal.com/compare/bundle-social-vs-postiz.md)\n- [Zernio (formerly Late) API + MCP vs Pamba](https://www.anchorterminal.com/compare/late-vs-pamba.md)\n- [Zernio (formerly Late) API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/late-vs-postiz.md)\n- [Metricool API + MCP vs Pamba](https://www.anchorterminal.com/compare/metricool-vs-pamba.md)\n- [Metricool API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/metricool-vs-postiz.md)\n- [Mixpost API + MCP vs Pamba](https://www.anchorterminal.com/compare/mixpost-vs-pamba.md)\n- [Mixpost API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/mixpost-vs-postiz.md)\n- [OneUp API + MCP vs Pamba](https://www.anchorterminal.com/compare/oneup-vs-pamba.md)\n- [OneUp API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/oneup-vs-postiz.md)\n- [Pamba vs Post Bridge API + MCP](https://www.anchorterminal.com/compare/pamba-vs-post-bridge.md)\n- [Pamba vs Publer API + MCP](https://www.anchorterminal.com/compare/pamba-vs-publer.md)\n- [Pamba vs Repostit](https://www.anchorterminal.com/compare/pamba-vs-repostit.md)\n- [Pamba vs Typefully](https://www.anchorterminal.com/compare/pamba-vs-typefully.md)\n- [Pamba vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/pamba-vs-upload-post.md)\n- [Post Bridge API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/post-bridge-vs-postiz.md)\n- [Postiz API + MCP vs Publer API + MCP](https://www.anchorterminal.com/compare/postiz-vs-publer.md)\n- [Postiz API + MCP vs Repostit](https://www.anchorterminal.com/compare/postiz-vs-repostit.md)\n- [Postiz API + MCP vs Typefully](https://www.anchorterminal.com/compare/postiz-vs-typefully.md)\n- [Postiz API + MCP vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/postiz-vs-upload-post.md)\n- [Pamba vs Sprout Social API](https://www.anchorterminal.com/compare/pamba-vs-sprout-social.md)\n- [Pamba vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.md)\n- [Pamba vs X MCP](https://www.anchorterminal.com/compare/pamba-vs-x-mcp.md)\n- [Pamba vs Xpoz MCP](https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.md)\n- [Postiz API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/postiz-vs-sprout-social.md)\n- [Postiz API + MCP vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/postiz-vs-twitterapi-io-mcp.md)\n- [Postiz API + MCP vs X MCP](https://www.anchorterminal.com/compare/postiz-vs-x-mcp.md)\n- [Postiz API + MCP vs Xpoz MCP](https://www.anchorterminal.com/compare/postiz-vs-xpoz-mcp.md)\n- [Pamba vs SocialCannon](https://www.anchorterminal.com/compare/pamba-vs-socialcannon.md)\n- [Postiz API + MCP vs SocialCannon](https://www.anchorterminal.com/compare/postiz-vs-socialcannon.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.8", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Pamba vs Postiz API + MCP", "url": "" } ], "description": "Postiz scores 47.1 (D) to Pamba's 41.2 (E) for social posting. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Pamba E 41.2", "Postiz API + MCP D 47.1", "scores" ], "h1": "Pamba vs Postiz API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/pamba-vs-postiz", "published": "2026-10-01", "section": "tools", "title": "Pamba vs Postiz for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-13", "url": "https://www.anchorterminal.com/compare/pamba-vs-postiz" }, "tokens": { "markdown": 4700, "slim": 980 }, "version": 1 }