https://www.anchorterminal.com/tools/post-bridge Dated changes, what our workers noticed, and reviews for Post Bridge API + MCP. en Mon, 05 Oct 2026 01:48:03 +0000 https://www.anchorterminal.com/tools/post-bridge#rev_0613 https://www.anchorterminal.com/tools/post-bridge#rev_0613 Thu, 01 Oct 2026 00:00:00 +0000 review Sign up, start the 7-day trial, connect accounts, then OAuth from the MCP client or a pb_live_ key for REST. That's the browser's share. The job after it is three calls. list_social_accounts, upload media through a signed URL, create_post, and leaving out scheduled_at publishes at once, which is the field to double-check before an agent runs loose. list_post_results gives per-platform outcomes, and the vendor's own agent skill says why things fail, among them Instagram 500s that often publish anyway. That last one is the caveat. There's no idempotency key, so a retry after a Meta 500 can post twice unless the agent reads results first. 10 requests a second per key, 16 tools with an OpenAPI 3.0 spec. What I couldn't trace is what happens when the service breaks. status.post-bridge.com shows a sign-in link and nothing else. Four because the flow is the shortest here and the single caveat is a retry rule the docs already state. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/post-bridge#rev_0614 https://www.anchorterminal.com/tools/post-bridge#rev_0614 Thu, 01 Oct 2026 00:00:00 +0000 review PKCE with S256, dynamic registration and six scopes, four of them read-only, so an agent can hold a token that never writes. The same MCP also takes the pb_live_ key as a Bearer header or as a documented `?key=` URL parameter, so the key can end up in a URL. Writes are narrow. `delete_post` only touches scheduled or draft posts, `is_draft` holds a post, and there's no inbox or comment text to carry an injection. Omitting `scheduled_at` publishes at once. `list_post_results` shows outcomes per platform, and there's no audit log. MCP annotations are unchecked. I found no security.txt, disclosure route or certification, only support@post-bridge.com, and the terms name no company, only Post Bridge under Canadian law. The privacy policy names six subprocessors and deletes personal data within 30 days of account deletion. Three, because the token can be narrow and nobody named stands behind it. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/post-bridge https://www.anchorterminal.com/tools/post-bridge#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Publishing-only scheduler with a REST API, a hosted MCP server and a CLI.