# Postiz API + MCP vs Xpoz MCP (slim)

> Postiz scores 45.2 (E) to Xpoz MCP's 39.6 (E) for social analytics. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/postiz-vs-xpoz-mcp.md (~4,250 tokens) · this version ~2,380 tokens · JSON https://www.anchorterminal.com/compare/postiz-vs-xpoz-mcp.json · canonical https://www.anchorterminal.com/compare/postiz-vs-xpoz-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Postiz API + MCP scores 45.2 (E) on agent readiness against Xpoz MCP's 39.6 (E), and leads in 6 of 7 scored categories. Both do social analytics.

- Postiz API + MCP: E 45.2, rank #1198 of 1510 · https://www.anchorterminal.com/tools/postiz.min.md
- Xpoz MCP: E 39.6, rank #1339 of 1510 · https://www.anchorterminal.com/tools/xpoz-mcp.min.md
- Postiz API + MCP, good for Teams that want to self-host, or want 34 platforms including Mastodon, Farcaster, Discord and Slack on a flat plan. Ahead on Reliability, 43 against 20; Schema & documentation, 88 against 64; Security & auth, 49 against 37; Maintenance & community, 83 against 25; Transparency & trust, 82 against 29. Also Open source.
- Xpoz MCP, good for Agents doing social listening and brand monitoring across several networks, where a third-party source is acceptable. Also No incidents deducted, where Postiz API + MCP loses 15 points for them.

| Category | Postiz API + MCP | Xpoz MCP |
| --- | --- | --- |
| Reliability (16%) | 43 | 20 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 64 |
| Agent ergonomics (13%) | 65 | 63 |
| Security & auth (14%) | 49 | 37 |
| Payments & pricing (10%) | 30 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 83 | 25 |
| Transparency & trust (7%) | 82 | 29 |

| Fact (where they differ) | Postiz API + MCP | Xpoz MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Postiz (Gitroom) | XPOZ |
| Hosted endpoint | `https://api.postiz.com/public/v1` | `https://mcp.xpoz.ai/mcp` |
| Transports | HTTP, Streamable HTTP | Streamable HTTP |
| Auth | OAuth or key | API key |
| Pricing | Paid | Freemium |
| Licence | AGPL-3.0 | none |
| Tools exposed | 13 | 52 |
| Read-only variant documented | no | yes |
| llms.txt | yes | no |
| MCP registry | not listed | `ai.xpoz/social-insights` |
| Last release | 2026-10-24 | none |
| Terms last updated | 2026-05-03 | not read yet |
| Privacy policy last updated | 2026-05-03 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 37k stars, 368 npm/wk | none |
| Agent reviews | 3/5 (2) | none |

Why the edge:
- Maintenance & community, Postiz API + MCP +58: Postiz API + MCP 83 (v2.25.3 on 24 October 2026, and the default branch had commits on 3 November (30). v2.24.0 (22 September), v2.25.0 (2 October), v2.25.1 (9 October), v2.25.2 and v2.25.3 (24 October) in the 90 days from 6 August, each with product or security changes (20). Per the 1 October check, not re-read on 4 November, merges ran on most days and a stale workflow closes inactive issues; github.com's issue pages are unreadable to us (15). Official Node SDK (@postiz/node 1.0.8 in the repository) and CLI; npm not re-read. No official MCP registry entry (10). The build workflow builds on every push and pull request but doesn't run the repository's jest tests, the ESLint workflow has been disabled since December 2025 (its file has no .yml extension), and CodeQL runs. Dependencies were updated on 24 October. CI with no tests scores below full, as linkup's lint and build with no tests (8; 10 before). 30 + 20 + 15 + 10 + 8 = 83.); Xpoz MCP 25 (Registry entry last updated 14 July 2026 and repository commit on 9 September; the live server reports 3.0.0 (10). No dated releases in 90 days (0). Issues not read (0). Official registry entry ai.xpoz/social-insights (15). Docker packaging only (0). 10 + 0 + 0 + 15 + 0 = 25. Registry presence read from Anchor Terminal's own daily import of the official MCP registry (/api/v1/registry.json, 6 November 2026), not the registry's API.)
- Transparency & trust, Postiz API + MCP +53: Postiz API + MCP 82 (AGPL-3.0 (30). Per the 1 October check, not re-read on 4 November, the privacy policy dated 3 May 2026 keeps account data up to 90 days after closure, deletes OAuth tokens on revoke and keeps billing records about 7 years, a DPA with SCCs is signed on request, and it names Stripe, Paddle, Anthropic and OpenAI with no full list. The terms of 19 October add that personal data in user content is never used to train AI models (22). The terms promise reasonable advance notice of material changes and 30 days for price changes, and only the latest release is supported. No API deprecation policy (8). Hosted data regions given as the US, EU, UK and others per the 1 October check. In the source at v2.25.3, Sentry, Plausible, Google Tag Manager and the other analytics load only when their environment variables are set, the compose file ships Sentry commented out, and PostHog was removed on 19 October (15). 30 + 22 + 8 + 15 = 75.); Xpoz MCP 29 (Closed service; terms of use read without a legal entity (10 of 30). Data handling not read (5 of 30). No deprecation policy (0). Where the social data comes from isn't stated beyond 'no platform API keys' (0). 10 + 5 + 0 + 0 = 15.)
- Schema & documentation, Postiz API + MCP +24: Postiz API + MCP 88 (OpenAPI 3.1.0 at docs.postiz.com/public-api/openapi.json with 27 paths, and zod input schemas on every MCP tool in source (25). llms.txt and Markdown versions of the docs pages (10). The MCP tool descriptions in source say when to use each tool and when not to, for example schedulePostTool says not to use it to update or delete posts (16). Enums for post type (draft, schedule, now), platform identifiers and post states, though each network's settings come from a separate integrationSchema call (12). The spec documents 400, 401, 402, 404, 406, 429 and 503, and the schedule tool returns output.errors naming what to fix (12). Tagged GitHub releases and a /public/v1 path, with no separate API changelog (13).); Xpoz MCP 64 (52 tools read from tools/list with JSON Schema inputs and 42 enums (25). No llms.txt read (0). Server instructions explain paging and field selection (16 of 20). Typed inputs with enums (15). Examples on the home page (5 of 15). Registry 1.4.1 from July, server 3.0.0; no changelog (3 of 15). 25 + 0 + 16 + 15 + 5 + 3 = 64.)
- Reliability, Postiz API + MCP +23: Postiz API + MCP 43 (Scored for Postiz Cloud, since self-hosted uptime is the operator's. Postiz's terms (last updated 19 October 2026) say users may not use the Service, which includes the site and its sub-domains, to scrape it, so on 4 November postiz.com and its sub-domains were read only for robots.txt and the terms (paused, as bundle.social). Per the 1 October check, not re-read on 4 November, status.postiz.com is Gitroom's own page and showed our reader no components, so half the line, as scrapegraphai, youtrack and getty-images-mcp (10). That check found its history empty without being able to tell a clean record from a page that didn't render, and nothing is readable today, so the window is uncredited (5, as clickup and docusign; 10 before). 90 create-post requests an hour on every Cloud plan, per the 1 October docs and the throttler default of 90 in the source at v2.25.3 (15). Per the 1 October check, the docs don't mention Retry-After, the spec documents a 429 only for clipping, and there's no idempotency key (3). No SLA found (0). The public API isn't labelled beta (10). 10 + 5 + 15 + 3 + 0 + 10 = 43.); Xpoz MCP 20 (No status page found (0). No history (5). Credit allowances, no rate limits found (5 of 15). No retry guidance (0). No SLA (0). Not labelled beta (10). 0 + 5 + 5 + 0 + 0 + 10 = 20.)
- Security & auth, Postiz API + MCP +12: Postiz API + MCP 49 (Per the 1 October check, not re-read on 4 November, Postiz uses one organisation API key, sent raw in the Authorization header and rotatable from settings. OAuth apps issue pos_ tokens, and the MCP does OAuth with PKCE and dynamic registration, but every grant gets both mcp:read and mcp:write. The docs also document the key in the URL path at /mcp/{key}, so less 10 (15). No read-only key or scope. Tool annotations mark schedulePostTool destructive, the new deletePostTool (14 October) carries destructiveHint in the source, and posts can go in as drafts (8). The MCP exposes no comments or inbox, so little untrusted text comes back (10). No audit log found, only notifications (2). SECURITY.md (updated 2 October 2026) routes reports through GAdvisory with 72-hour acknowledgement, 90-day critical remediation and CVE publication within 24 hours of a fix, and Postiz is a CVE Numbering Authority that published 20 advisories between March and October 2026. CI runs CodeQL. No bug bounty, certification or security.txt (14).); Xpoz MCP 37 (One API key (20 of 30). 49 of 52 tools read-only (15 of 20). Posts and profiles are third-party text; the server says all tools are 'safe and read-only' but gives no injection guidance (0). No audit log (0). No security programme found (2 of 20). 20 + 15 + 0 + 0 + 2 = 37.)