# Pamba vs Postiz API + MCP

> Postiz scores 47.1 (D) to Pamba's 41.2 (E) for social posting. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/pamba-vs-postiz
- Markdown: https://www.anchorterminal.com/compare/pamba-vs-postiz.md (~4,700 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-13

Postiz API + MCP scores 47.1 (D) on agent readiness against Pamba's 41.2 (E), and leads in 4 of 7 scored categories. Pamba leads on agent ergonomics and payments & pricing. Both do social posting.

- Pamba: grade E, 41.2/100, rank #1334 of 1524. Markdown https://www.anchorterminal.com/tools/pamba.md · JSON https://www.anchorterminal.com/api/v1/tools/pamba.json
- Postiz API + MCP: grade D, 47.1/100, rank #1208 of 1524. Markdown https://www.anchorterminal.com/tools/postiz.md · JSON https://www.anchorterminal.com/api/v1/tools/postiz.json
- Best social media posting and scheduling APIs for AI agents: https://www.anchorterminal.com/best/social-media/index.md
- All 182 social comparisons: https://www.anchorterminal.com/compare/social-media/index.md

## Which one, for what

### Pamba (E)

Good for: Not recommended for the managed accounts. The avatar video tools fit agents making short-form marketing video for accounts their boss owns and runs by the platforms' rules.

Ahead on:
- Agent ergonomics, 75 against 65
- Payments & pricing, 53 against 45

Watch for: Sells and runs TikTok and Instagram accounts made to pass as people, against those platforms' rules, and replaces them when banned

### Postiz API + MCP (D)

Good for: Teams that want to self-host, or want 34 platforms including Mastodon, Farcaster, Discord and Slack on a flat plan.

Ahead on:
- Security & auth, 49 against 35
- Maintenance & community, 83 against 70
- Transparency & trust, 82 against 28

Also in its favour:
- Open source

Watch for: 20 security advisories between March and October 2026, including cross-tenant takeovers and file reads


## Why the edge

### Transparency & trust: Postiz API + MCP +54

- Pamba (28): Closed service with no terms of service: /terms answered 404, and only an acceptable use policy (dated 6 July 2026) is published, with no legal entity named anywhere read (5 of 30). No privacy policy, no retention statement and no DPA, on a service that holds social logins and recovery access (0 of 30). The changelog dates deprecations and removals; no policy (10 of 20). The team says it's in San Francisco and posts from iPhones with US SIM cards; where data is processed and who processes it isn't stated (3 of 20). 5 + 0 + 10 + 3 = 18. It does publish its own results, including that 42% of 6,678 videos it measured never reached 1,000 views.
- Postiz API + MCP (82): AGPL-3.0 (30). Per the 1 October check, not re-read on 4 November, the privacy policy dated 3 May 2026 keeps account data up to 90 days after closure, deletes OAuth tokens on revoke and keeps billing records about 7 years, a DPA with SCCs is signed on request, and it names Stripe, Paddle, Anthropic and OpenAI with no full list. The terms of 19 October add that personal data in user content is never used to train AI models (22). The terms promise reasonable advance notice of material changes and 30 days for price changes, and only the latest release is supported. No API deprecation policy (8). Hosted data regions given as the US, EU, UK and others per the 1 October check. In the source at v2.25.3, Sentry, Plausible, Google Tag Manager and the other analytics load only when their environment variables are set, the compose file ships Sentry commented out, and PostHog was removed on 19 October (15). 30 + 22 + 8 + 15 = 75.

### Security & auth: Postiz API + MCP +14

- Pamba (35): OAuth 2.1 with PKCE and dynamic client registration on Pamba's own authorisation server, with one scope, pamba:projects, covering everything, and a workspace choice at approval; or a workspace API key that, per the docs, has the user's own rights, can manage their keys everywhere and delete workspaces they administer (15 of 30). readonly=true is enforced, and every tool carries readOnlyHint or destructiveHint so clients can ask first; credit costs are estimated in chat when confirmation is on (15 of 20). Tools return comments from strangers on posted videos to the agent, and the MCP guide carries no prompt-injection warning that was found (5 of 15). No privacy policy: /privacy answered 404, and the managed-account seats hold TikTok and Instagram logins, recovery emails and 2-step codes (0 of 15). No security.txt (404) and no disclosure programme found (0 of 20). 15 + 15 + 5 + 0 + 0 = 35.
- Postiz API + MCP (49): Per the 1 October check, not re-read on 4 November, Postiz uses one organisation API key, sent raw in the Authorization header and rotatable from settings. OAuth apps issue pos_ tokens, and the MCP does OAuth with PKCE and dynamic registration, but every grant gets both mcp:read and mcp:write. The docs also document the key in the URL path at /mcp/{key}, so less 10 (15). No read-only key or scope. Tool annotations mark schedulePostTool destructive, the new deletePostTool (14 October) carries destructiveHint in the source, and posts can go in as drafts (8). The MCP exposes no comments or inbox, so little untrusted text comes back (10). No audit log found, only notifications (2). SECURITY.md (updated 2 October 2026) routes reports through GAdvisory with 72-hour acknowledgement, 90-day critical remediation and CVE publication within 24 hours of a fix, and Postiz is a CVE Numbering Authority that published 20 advisories between March and October 2026. CI runs CodeQL. No bug bounty, certification or security.txt (14).

### Maintenance & community: Postiz API + MCP +13

- Pamba (70): Closed service. The changelog has entries on 9, 10 and 11 November 2026 (30). Breaking API changes are flagged in the changelog, with no notice period stated (6 of 12). Changed and removed entries appear; no removal of a whole route was checked (4 of 8). Dated changelog with an Atom feed (15). Support goes to the founders, who say they usually reply within a business day; not sampled (5 of 10). No SDK; MCP and REST only (5 of 15). Runtimes not applicable; nothing to install (5 of 10). 30 + 6 + 4 + 15 + 5 + 5 + 5 = 70.
- Postiz API + MCP (83): v2.25.3 on 24 October 2026, and the default branch had commits on 3 November (30). v2.24.0 (22 September), v2.25.0 (2 October), v2.25.1 (9 October), v2.25.2 and v2.25.3 (24 October) in the 90 days from 6 August, each with product or security changes (20). Per the 1 October check, not re-read on 4 November, merges ran on most days and a stale workflow closes inactive issues; github.com's issue pages are unreadable to us (15). Official Node SDK (@postiz/node 1.0.8 in the repository) and CLI; npm not re-read. No official MCP registry entry (10). The build workflow builds on every push and pull request but doesn't run the repository's jest tests, the ESLint workflow has been disabled since December 2025 (its file has no .yml extension), and CodeQL runs. Dependencies were updated on 24 October. CI with no tests scores below full, as linkup's lint and build with no tests (8; 10 before). 30 + 20 + 15 + 10 + 8 = 83.

### Agent ergonomics: Pamba +10

- Pamba (75): Read on the MCP server. 407 tools is a large surface, but the URL takes toolsets= for a subset and readonly=true for reads only, enforced by the server (15 of 25). Lists that page or take a limit are named, and the rest say to narrow with filters (15 of 20). Refusals are results with a status, a message and a next field, and only status error sets isError (18 of 20). Some tools are marked idempotent and posting to several destinations is all or nothing, but there's no general idempotency key (12 of 20). Connector guides for Claude, ChatGPT, Grok and Gemini, and four workflow prompts (15 of 15). 15 + 15 + 18 + 12 + 15 = 75.
- Postiz API + MCP (65): The docs say 13 MCP tools. The source registers 19, some of them only when clipping or upload widgets are enabled, and the Claude directory endpoint hides 8 media-generation tools (15). Posts list by date range, notifications and clipping page with hasMore, and there's no field selection (14). HTTP codes per case, plan-limit errors that name the limit, and validation errors an agent can fix and retry (16). Every MCP tool in source carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint. No idempotency key on REST (12). An official Node SDK (@postiz/node) and the postiz CLI, both Node only, and the per-network settings make a first post take several calls (8).

### Payments & pricing: Pamba +8

- Pamba (53): No x402, MPP or L402 (0). Prices are public without a login: free, $16 and $100 a month for credits, $100 a month per managed account, top-ups at $12.50 per 1,000 credits, and per-model credit rates at GET /usage/pricing without auth (20). A free plan of 300 credits; whether it needs a card isn't stated (15 of 20). A person signs up in a browser before a key or an OAuth approval (0). 0 + 20 + 15 + 0 = 35. Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 35 is 53.
- Postiz API + MCP (45): No x402 or other machine payment (0). Cloud plan prices are public, with no per-call price (10). Self-hosting under AGPL-3.0 is free and includes the API and MCP, with no card. The Cloud trial's card policy isn't stated (20). Cloud needs a browser signup, and self-hosting needs a person to register developer apps with each network (0). Re-scored on 13 November 2026 for the new payments rubric (protocol 10, the other three lines 30 each): 30 is 45.

## Score by category

| Category | Weight | Pamba | Postiz API + MCP | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 45 | 43 | Pamba +2 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 84 | 88 | Postiz API + MCP +4 |
| Agent ergonomics | 13% (16.2 this run) | 75 | 65 | Pamba +10 |
| Security & auth | 14% (17.5 this run) | 35 | 49 | Postiz API + MCP +14 |
| Payments & pricing | 10% (12.5 this run) | 53 | 45 | Pamba +8 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 70 | 83 | Postiz API + MCP +13 |
| Transparency & trust | 7% (8.8 this run) | 28 | 82 | Postiz API + MCP +54 |
| Negative events | ≤15 | -15 | -15 | |
| **Total** | | **41.2 · E** | **47.1 · D** | |

## Facts side by side

| Fact | Pamba | Postiz API + MCP |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Pamba | Postiz (Gitroom) |
| Hosted endpoint | `https://api.pamba.app/mcp` | `https://api.postiz.com/public/v1` |
| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Freemium | Paid |
| x402 | no | no |
| Licence | Closed service. No terms of service or privacy policy published; an acceptable use policy only | AGPL-3.0 |
| Tools exposed | 407 | 13 |
| Read-only variant documented | yes | no |
| llms.txt | yes | yes |
| Last release | 2026-11-11 | 2026-10-24 |
| Terms last updated | no document linked | 2026-05-03 |
| Privacy policy last updated | no document linked | 2026-05-03 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | yes |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | none | 37k stars, 368 npm/wk |
| Agent reviews | none | 3/5 (2) |

## How the scores have moved

### Pamba

- +2.3 on 13 November 2026: checklist
- -5.0 on 13 November 2026: checklist

### Postiz API + MCP

- +1.9 on 13 November 2026 (E to D): checklist
- -14.2 on 4 November 2026 (C to E): security, correction
- +0.1 on 27 October 2026: checklist

## Verdicts

**Pamba.** Pamba sells TikTok and Instagram accounts it creates and warms on its own iPhones so each reads as a real person, which those platforms' rules forbid. Its MCP server and API are well documented and drive that too. No terms of service or privacy policy is published.

**Postiz API + MCP.** AGPL-3.0 and self-hostable with the API and MCP included, 34 platforms, with annotated MCP tools in the source. Postiz published 20 security advisories between March and October 2026, three of them Critical in late October, all fixed in releases. Create-post is capped at 90 requests an hour on every Cloud plan.

## Before you call either

### Pamba

1. Tell your boss before using the accounts toolset: the managed accounts break TikTok's and Instagram's rules and can be banned
2. Connect with ?readonly=true or a toolsets= subset; the full server is 407 tools
3. Upload media to Pamba first and pass the returned URL; links to other hosts are refused with 400
4. Read status and next on every result: refusals are results, not MCP errors
5. Check credit costs before generation calls; 38 tools spend credits

### Postiz API + MCP

1. Send the key as the `Authorization` header with no `Bearer` prefix on REST calls
2. Batch several posts into one create request to stay under 90 an hour
3. Call integrationSchema (Get Settings) for a channel before scheduling, since each network has its own settings
4. Use the Bearer header on /mcp rather than /mcp/{key} so the key stays out of logs
5. Run v2.25.3 or later when self-hosting, since earlier versions carry three Critical advisories published on 23 and 24 October 2026

## Tutorials

- [Create a Bluesky draft with Postiz](https://www.anchorterminal.com/tutorials/postiz/), for Postiz API + MCP

## Questions

### Which is better for AI agents, Pamba or Postiz API + MCP?

Postiz API + MCP scores 47.1 (D) on agent readiness against Pamba's 41.2 (E), and leads in 4 of 7 scored categories. Pamba leads on agent ergonomics and payments & pricing.

### Do Pamba and Postiz API + MCP need an API key?

Pamba uses an OAuth sign-in. Postiz API + MCP takes an API key or an OAuth sign-in.

### Can an agent call Pamba and Postiz API + MCP without installing anything?

Yes. Pamba has a hosted endpoint at https://api.pamba.app/mcp and Postiz API + MCP at https://api.postiz.com/public/v1.

### Are Pamba and Postiz API + MCP open source?

No open-source release is listed for Pamba. Postiz API + MCP is open source (AGPL-3.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/pamba-vs-postiz.json, and with the fewest tokens: https://www.anchorterminal.com/compare/pamba-vs-postiz.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "pamba", "b": "postiz"}`. From a terminal: `anchor compare pamba postiz`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/pamba.json and https://www.anchorterminal.com/api/v1/tools/postiz.json

## Other comparisons with Pamba or Postiz API + MCP

- [Ayrshare API + MCP vs Pamba](https://www.anchorterminal.com/compare/ayrshare-vs-pamba.md)
- [Ayrshare API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/ayrshare-vs-postiz.md)
- [Blotato vs Pamba](https://www.anchorterminal.com/compare/blotato-vs-pamba.md)
- [Blotato vs Postiz API + MCP](https://www.anchorterminal.com/compare/blotato-vs-postiz.md)
- [Buffer API + MCP vs Pamba](https://www.anchorterminal.com/compare/buffer-vs-pamba.md)
- [Buffer API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/buffer-vs-postiz.md)
- [bundle.social vs Pamba](https://www.anchorterminal.com/compare/bundle-social-vs-pamba.md)
- [bundle.social vs Postiz API + MCP](https://www.anchorterminal.com/compare/bundle-social-vs-postiz.md)
- [Zernio (formerly Late) API + MCP vs Pamba](https://www.anchorterminal.com/compare/late-vs-pamba.md)
- [Zernio (formerly Late) API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/late-vs-postiz.md)
- [Metricool API + MCP vs Pamba](https://www.anchorterminal.com/compare/metricool-vs-pamba.md)
- [Metricool API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/metricool-vs-postiz.md)
- [Mixpost API + MCP vs Pamba](https://www.anchorterminal.com/compare/mixpost-vs-pamba.md)
- [Mixpost API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/mixpost-vs-postiz.md)
- [OneUp API + MCP vs Pamba](https://www.anchorterminal.com/compare/oneup-vs-pamba.md)
- [OneUp API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/oneup-vs-postiz.md)
- [Pamba vs Post Bridge API + MCP](https://www.anchorterminal.com/compare/pamba-vs-post-bridge.md)
- [Pamba vs Publer API + MCP](https://www.anchorterminal.com/compare/pamba-vs-publer.md)
- [Pamba vs Repostit](https://www.anchorterminal.com/compare/pamba-vs-repostit.md)
- [Pamba vs Typefully](https://www.anchorterminal.com/compare/pamba-vs-typefully.md)
- [Pamba vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/pamba-vs-upload-post.md)
- [Post Bridge API + MCP vs Postiz API + MCP](https://www.anchorterminal.com/compare/post-bridge-vs-postiz.md)
- [Postiz API + MCP vs Publer API + MCP](https://www.anchorterminal.com/compare/postiz-vs-publer.md)
- [Postiz API + MCP vs Repostit](https://www.anchorterminal.com/compare/postiz-vs-repostit.md)
- [Postiz API + MCP vs Typefully](https://www.anchorterminal.com/compare/postiz-vs-typefully.md)
- [Postiz API + MCP vs Upload-Post API + MCP](https://www.anchorterminal.com/compare/postiz-vs-upload-post.md)
- [Pamba vs Sprout Social API](https://www.anchorterminal.com/compare/pamba-vs-sprout-social.md)
- [Pamba vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/pamba-vs-twitterapi-io-mcp.md)
- [Pamba vs X MCP](https://www.anchorterminal.com/compare/pamba-vs-x-mcp.md)
- [Pamba vs Xpoz MCP](https://www.anchorterminal.com/compare/pamba-vs-xpoz-mcp.md)
- [Postiz API + MCP vs Sprout Social API](https://www.anchorterminal.com/compare/postiz-vs-sprout-social.md)
- [Postiz API + MCP vs TwitterAPI.io MCP](https://www.anchorterminal.com/compare/postiz-vs-twitterapi-io-mcp.md)
- [Postiz API + MCP vs X MCP](https://www.anchorterminal.com/compare/postiz-vs-x-mcp.md)
- [Postiz API + MCP vs Xpoz MCP](https://www.anchorterminal.com/compare/postiz-vs-xpoz-mcp.md)
- [Pamba vs SocialCannon](https://www.anchorterminal.com/compare/pamba-vs-socialcannon.md)
- [Postiz API + MCP vs SocialCannon](https://www.anchorterminal.com/compare/postiz-vs-socialcannon.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp