Atlas / MCP servers / chemany / Toutiao

ToutiaoCAUTION

mcp/chemany/toutiao
Verdict
CAUTION
Grade
C
Trust score
76 /100
Exposed tools
16 11r · 4w · 1d
Transport
sse · streamable-http
License
—
Stars
69
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

一个功能完整的今日头条内容管理MCP服务器,支持自动登录、内容发布、数据分析等功能。完全兼容小红书自动发布工具的数据格式,支持一键多平台发布。

✨ 主要特性

  • 🔐 用户认证管理 - 自动登录、Cookie持久化、登录状态检查
  • 📝 内容发布功能 - 图文文章发布、微头条发布、图片上传与压缩
  • 📊 数据分析统计 - 阅读量统计、粉丝增长分析、内容表现评估
  • 🗂️ 内容管理 - 获取文章列表、编辑删除内容、状态管理
  • 📈 报告生成 - 自动生成日报、周报、月报
  • 🌐 多平台兼容 - 完全兼容小红书自动发布工具,支持一键发布多个平台
  • ⚡ 现代化架构 - 基于FastMCP框架,支持HTTP Streamable模式

🔗 多平台兼容特性

与小红书自动发布工具完全兼容

本项目完全兼容您现有的小红书自动发布工具数据格式,可以实现:

  1. 相同的数据源 - 支持相同的飞书多维表格格式
  2. 相同的字段名 - 兼容"小红书标题"、"仿写小红书文案"、"配图"字段
  3. 相同的图片处理 - 支持图片URL下载和本地存储
  4. 一键多平台发布 - 可以同时发布到小红书和今日头条

支持的兼容接口

  • publish_xiaohongshu_data - 批量发布小红书格式数据到今日头条
  • publish_single_xiaohongshu_record - 发布单条小红书记录到今日头条
  • process_feishu_records - 处理飞书多维表格记录(兼容小红书工具格式)
  • convert_xiaohongshu_format - 预览小红书格式转换为今日头条格式

📦 安装指南

环境要求

  • Python 3.8+
  • Chrome 浏览器(用于Selenium自动登录)
  • Windows/macOS/Linux

安装步骤

  1. 克隆项目
git clone 
cd toutiao_mcp_server
  1. 安装依赖
pip install -r requirements.txt
  1. 安装Chrome WebDriver
# WebDriver会通过webdriver-manager自动下载
# 确保系统已安装Chrome浏览器
  1. 配置设置(可选)
# 复制配置示例文件
cp config.example.py config_local.py
# 根据需要修改配置

🚀 快速开始

1. 启动服务器

# 使用默认端口8003启动
python start_server.py

# 或指定端口和日志级别
python start_server.py --port 8080 --log-level DEBUG

2. 多平台发布示例

使用集成示例文件(推荐):

# 运行多平台发布示例
python integration_example.py

这个示例文件完全兼容您现有的小红书工具,支持:

  • 从相同的飞书多维表格获取数据
  • 同时发布到小红书和今日头条
  • 支持批量发布和单个发布
  • 提供详细的发布结果统计

或通过MCP工具调用:

import asyncio
import httpx

async def multi_platform_publish():
# 飞书数据格式(与小红书工具完全一致)
records = [
{
"title": "科技前沿:AI发展趋势",
"content": "人工智能正在改变我们的生活...",
"image_url": "https://example.com/image.jpg"
}
]

# 发布到今日头条
async with httpx.AsyncClient() as client:
response = await client.post(
"http://localhost:8003/publish_xiaohongshu_data",
j
Read from source at commit 56e77d4f0866OBSERVED · 2026-10-08
Advertisement
02

Exposed tools (16)

11 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
check_login_statusread
convert_xiaohongshu_formatread
delete_articledestructive
generate_reportread
get_account_overviewread
get_article_listread
get_article_statsread
get_content_performanceread
get_trending_analysisread
login_with_credentialsread
logoutread
process_feishu_recordsread
publish_articlewrite
publish_micro_postwrite
publish_single_xiaohongshu_recordwrite
publish_xiaohongshu_datawrite
03

Trust audit

CAUTIONgrade C · trust 76/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (9)

MEDIUMInventory / provenance · inv.binary · CWE-1104
toutiao_mcp_server/__pycache__/__init__.cpython-312.pyc
__init__.cpython-312.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
toutiao_mcp_server/__pycache__/__init__.cpython-313.pyc
__init__.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
toutiao_mcp_server/__pycache__/analytics.cpython-313.pyc
analytics.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
toutiao_mcp_server/__pycache__/auth.cpython-312.pyc
auth.cpython-312.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
toutiao_mcp_server/__pycache__/auth.cpython-313.pyc
auth.cpython-313.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
delete_article
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
sse,streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
fastmcp, selenium, requests, beautifulsoup4, Pillow, python-dateutil, pydantic, webdriver-manager
Why it matters. 8 requirement(s) not pinned with ==
Fix. pin exact versions

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-08 · audit v0.4.1 · source sha 56e77d4f0866full audit observations/trust-audit/mcp-server/chemany__toutiao.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-0856e77d4f0866CAUTIONC76first audit
05

Questions

What tools does Toutiao expose?

16 in total: 11 read-only, 4 that write, and 1 that can delete or overwrite (delete_article). Every one is listed on this page with its risk.

Is Toutiao safe to connect to an agent?

With care. The audit graded it C (76/100) and found 9 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Toutiao need?

No credential environment variables were found in its source, so it appears to need none.

How does Toutiao run?

It speaks sse and streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (56e77d4f0866), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement