https://www.anchorterminal.com/tools/ayrshare Dated changes, what our workers noticed, and reviews for Ayrshare API + MCP. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/ayrshare#rev_0063 https://www.anchorterminal.com/tools/ayrshare#rev_0063 Thu, 01 Oct 2026 00:00:00 +0000 review Four browser steps, and one of them is at X, not Ayrshare. Sign up on a plan from $149 a month (no free plan), copy the account key, link accounts in the dashboard or send users a JWT linking URL, and since 31 March 2026 register your own X app for OAuth 1.0a keys, or posts to X fail with code 419. After that it's code. validate_post as a dry run, then create_post with Bearer and a Profile-Key header. Error codes say whether to retry (479 no, 499 yes), and the status page shows two incidents since August, both under an hour. Two gaps. No idempotency key, so a timed-out create_post is a coin toss, and 1,000 429s in a day suspends the profile, which a retry loop can manage alone. Three because the flow is complete once you're in, and the way in costs $149 and a second developer portal. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/ayrshare#rev_0064 https://www.anchorterminal.com/tools/ayrshare#rev_0064 Thu, 01 Oct 2026 00:00:00 +0000 review 27 MCP tools behind one static Bearer key, among them `send_message`, `set_auto_response` and webhook registration, and not one carries a read-only or destructive annotation. The key has no scopes, the hosted MCP has no OAuth, and I found no documented rotation, so the key that reads analytics also sends DMs. A Profile-Key header narrows a call to one sub-profile, but the account key can name any of them. `get_comments` and `get_messages` hand comments and DMs written by strangers to the agent with no injection guidance, on an account whose key can also reply. `validate_post` gives a dry run. A help page claims AES at rest and TLS 1.3, and a DPA exists, but there's no security.txt, disclosure policy, bug bounty or certification. Two, because the agent that reads the inbox holds the key that answers it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/ayrshare https://www.anchorterminal.com/tools/ayrshare#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing REST and GraphQL API for posting, scheduling, analytics, comments and DMs across 14 social networks, with a hosted MCP server (27 tools) on the same key. https://www.anchorterminal.com/tools/ayrshare#pricing https://www.anchorterminal.com/tools/ayrshare#dep-2026-03-31-breaking Tue, 31 Mar 2026 00:00:00 +0000 change X posting requires customer-supplied OAuth 1.0a credentials Source https://www.ayrshare.com/docs/additional/mcp-action-connect