Postiz API + MCP vs Repostit

Postiz API + MCP 88

OpenAPI 3.1.0 at docs.postiz.com/public-api/openapi.json with 27 paths, and zod input schemas on every MCP tool in source (25). llms.txt and Markdown versions of the docs pages (10). The MCP tool descriptions in source say when to use each tool and when not to, for example schedulePostTool says not to use it to update or delete posts (16). Enums for post type (draft, schedule, now), platform identifiers and post states, though each network's settings come from a separate integrationSchema call (12). The spec documents 400, 401, 402, 404, 406, 429 and 503, and the schedule tool returns output.errors naming what to fix (12). Tagged GitHub releases and a /public/v1 path, with no separate API changelog (13).

Repostit 27

MCP reading, since the connector is the only surface an outside agent reaches; no public REST API, developer page, OpenAPI file, SDK or package was found in the help centre, /whats-new/, the sitemap, llms.txt, GitHub, npm or the MCP registry. No tool names or input schemas are published anywhere, and no session was opened to read them (0 of 25). llms.txt exists, but it is a Rank Math index of site URLs that includes theme placeholder entries, and help articles are HTML only (5 of 10). The Claude connector page says what each step is for and when not to use it, list accounts before choosing a destination, a Brief saves a draft and neither publishes nor schedules, publishing applies to every destination in a Brief, Queued is not delivery, future-content workflows publish once active while existing-content ones import for review (8 of 20). Inputs are described in prose only, formats per destination, JPEG, PNG or WebP up to 20 MB, carousel caps of 4, 10 and 20 by network, media at a downloadable HTTPS URL and a timezone with every scheduled time (4 of 15). Plain-language example requests and per-network failure reasons written for people; no example tool call, response or error shape (5 of 15). The endpoint path carries v1.1 and the registry holds 2026.10.17 and 2026.10.23; /whats-new/ is undated and no changelog was found (5 of 15). 0+5+8+4+5+5 = 27.

Postiz API + MCP 82

AGPL-3.0 (30). The privacy policy dated 3 May 2026 keeps account data up to 90 days after closure, deletes OAuth tokens on revoke and keeps billing records about 7 years. A DPA with SCCs is signed on request and AI providers are told not to train on inputs. It names Stripe, Paddle, Anthropic and OpenAI and no full list (22). The terms promise reasonable notice of material changes and 30 days for price rises, and only the latest release is supported. No API deprecation policy (8). Hosted data regions given as the US, EU, UK and others. Self-hosted Sentry reporting runs only when a DSN is set, and the compose file ships it commented out (15).

Repostit 29

Closed service. The terms of service (effective 7 March 2025, no revision since) name Repostit LLC of Newark, Delaware, with Delaware law and arbitration, take a non-exclusive licence to content only to run the service and say fees are non-refundable; every footer says Repostit, Inc., and the terms do not mention the connector (12 of 30). The privacy policy (29 July 2026) keeps data until the account is deleted or as needed, with no periods, deletes Pinterest credentials on disconnect but says nothing of other networks' tokens, names no DPA, and does not mention the connector or its 90-day offline access; the account deletion article gives no timeline and leaves network-side access to the user (10 of 30). No deprecation policy or dated notices; the terms promise notice of significant changes and the ChatGPT page names a pending version 1.1 without a date (3 of 20). Subprocessors are 'hosting providers, analytics services', unnamed, with transfers outside the user's country and no locations; the Tawk.to chat on the contact page and the Google Cloud Run host of the connector are not named in the policy (2 of 20). 12+10+3+2 = 27.

Postiz API + MCP 65

The docs say 13 MCP tools. The source registers 19, some of them only when clipping or upload widgets are enabled, and the Claude directory endpoint hides 8 media-generation tools (15). Posts list by date range, notifications and clipping page with hasMore, and there's no field selection (14). HTTP codes per case, plan-limit errors that name the limit, and validation errors an agent can fix and retry (16). Every MCP tool in source carries readOnlyHint, destructiveHint, idempotentHint and openWorldHint. No idempotency key on REST (12). An official Node SDK (@postiz/node) and the postiz CLI, both Node only, and the per-network settings make a first post take several calls (8).

Repostit 25

MCP reading. The tool count is not published. The connector pages describe seven actions (list accounts, create, schedule and publish a Brief, check delivery, create a workflow, send a connection link), which suggests a small set, but the definitions were not read, so a middle reading rather than full marks (10 of 25). No pagination, filtering or output-size controls are documented (0 of 20). Delivery checks report a result per destination with public links when the network gives one, and the help centre lists failure reasons per network, but no error codes or connector error messages are documented (5 of 20). No idempotency key and no readOnlyHint or destructiveHint seen; Briefs start as drafts, queued Briefs are locked against a second send, Manual workflows hold posts for approval and the guidance says to check before retrying (6 of 20). Requests are made in plain language with few stated requirements (an HTTPS media URL, a timezone); no SDK in any language (4 of 15). 10+0+5+6+4 = 25.

Postiz API + MCP 85

v2.24.0 on 22 September 2026, and the default branch had commits on 1 October (30). v2.22.1, v2.23.0 and v2.24.0 since July, and 502 commits since 3 July from three main maintainers (20). 121 merges on 18 days since 1 September, and 1,191 pull requests opened to date. robots.txt blocked our reader from the issue tracker, and a stale workflow closes inactive issues (15). Official Node SDK and CLI. No official MCP registry entry (10). Build, CodeQL and Dependabot on GitHub (10).

Repostit 56

Closed service. The latest registry version is 2026.10.23, published 23 October 2026, and the connector article was updated 22 October 2026 (30). Dated changes in the last 90 days are the two registry versions of 17 and 23 October 2026; /whats-new/ is undated and the ChatGPT app's 1.1.0 (per the 3 November listing check) carries no date, so fewer than three dated releases (10 of 20). Support is email and weekday chat, 9am to 5pm Eastern, with replies within 24 hours; no public changelog with dates, forum or issue tracker (6 of 15). In the official MCP registry as io.github.hax98/repostit, a GitHub-verified namespace of a personal account; the entry links Repostit's own pages and its address matches the vendor's connector page, but no first-hand page ties the account to the company, so partial credit (10 of 15). No packages, public code or CI to judge (0 of 10). 30+10+6+10+0 = 56.

Postiz API + MCP 53

Scored for Postiz Cloud, since self-hosted uptime is the operator's. status.postiz.com is Gitroom's own page and read All Systems Operational, but showed our reader no components (15). Its history page loaded with no incidents listed, and robots.txt blocked the incident API, so we can't tell a clean record from a page our reader didn't render. Partial credit (10). 90 create-post requests an hour on every Cloud plan, matching the throttler default in source (15). The docs don't mention Retry-After, the spec documents a 429 only for clipping, and there's no idempotency key (3). No SLA found (0). The public API isn't labelled beta (10).

Repostit 26

Hosted reading, for the connector and the service behind it. No status page was found. None is linked from the help centre, the contact page, the footer or the troubleshooting articles, and https://repostit.io/status/ did not load through our reader, which also fails on the home page (0). No readable incident history, so the floor (5). Repostit publishes posting quotas rather than request limits, 10 posts on the trial, 10 video posts a month on Basic, existing-content workflows up to 5 posts a day, plus per-network rules and 20 MB images through the connector; no request rate for the connector, and the terms only bar automated access faster than a human (6 of 15). No 429 or overload handling is documented. The Claude connector page says Queued means accepted, not delivered, and to check the existing result before retrying to avoid duplicate posts, and Brief locks queued posts against a second send; no idempotency key and no page says failed posts are retried (5 of 15). No SLA; the terms (7 March 2025) let Repostit modify or discontinue the service at any time and say nothing on uptime (0). The connector carries no beta label and its registry entry is active (10). 0+5+6+5+0+10 = 26.

Postiz API + MCP 49

One organisation API key, sent raw in the Authorization header and rotatable from settings. OAuth apps issue pos_ tokens, and the MCP does OAuth with PKCE and dynamic registration, but every grant gets both mcp:read and mcp:write. The docs also document the key in the URL path at /mcp/{key}, so less 10 (15). No read-only key or scope. Tool annotations mark schedulePostTool destructive, and posts can go in as drafts (8). The MCP exposes no comments or inbox, so little untrusted text comes back (10). No audit log found, only notifications (2). SECURITY.md routes reports through GAdvisory with 72-hour acknowledgement and 90-day remediation targets, CVE-2026-94455 and CVE-2026-94456 were fixed on 22 September 2026, and CI runs CodeQL. No bug bounty, certification or security.txt (14).

Repostit 44

OAuth with dynamic client registration and no client secret, per Repostit's Claude connector page, with offline access that renews for up to 90 days from the first authorisation; social-network sign-ins stay in Repostit and provider tokens are not passed to the assistant. PKCE S256 is stated only in third-party metadata. No scopes are named; the page lists the permissions shown at sign-in (read accounts, create workflows and Briefs, schedule or publish, read delivery status). Revocation is by disconnecting in the client or asking support (18 of 30). A Brief is saved as a draft, Manual workflows wait for approval, and the help article says the assistant shows each step for confirmation before publishing (on ChatGPT 'may ask', depending on the client); no read-only mode, and an activated future-content workflow publishes on its own (8 of 20). Tools return the user's own accounts, Briefs and delivery results and read no comments or messages (10). Assistant-created posts appear under Post with a Comments & Activity log of each step, and Post History shows each network's response; no per-call log for the connector (8 of 15). security.txt did not load through our reader, and no disclosure policy, bug bounty or certification appears on any page read (0 of 20). 18+8+10+8+0 = 44.