socialync-mcpSAFE
Hosted MCP server: let Claude, ChatGPT, Gemini and any AI agent draft, schedule and publish to TikTok, Instagram, YouTube and 5 more, and read your analytics. Free plan included.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Official documentation, registry manifest, and Cursor plugin for the Socialync hosted MCP server. Socialync is a cross-posting and scheduling tool for creators: upload once, publish to TikTok, Instagram, YouTube, Facebook, X, LinkedIn, Threads, and Bluesky.
This MCP server lets Claude, ChatGPT, Cursor, Google Antigravity, Gemini CLI, OpenAI Codex, Grok Bot, and any MCP-compatible AI agent draft, schedule, and publish social media posts through your own OAuth-authorized Socialync account, with human-in-the-loop approval built into the workflow. It also reads back your analytics (views, likes, comments, shares, saves, followers, and your best and worst posts), so an agent can plan next week's content from what actually performed.
Every platform integration runs on the official platform API. No browser automation, no scraping, no unofficial endpoints. Your agent cannot get your account restricted on our behalf.
Duplicate protection means a retry can never publish twice, and failed posts are retried automatically. Both matter when an agent is doing the posting.
Note: Socialync's server is hosted (remote) and closed source. This repository contains the documentation, the MCP Registry manifest, and the Cursor plugin files only. There is nothing to install or run from here.
Endpoint
https://mcp.socialync.io/mcp
Transport: Streamable HTTP. Discovery document (tools, platforms, auth, limits, as JSON): https://mcp.socialync.io/.well-known/mcp
MCP and API access are on the free plan. $0, no credit card, 5 posts a month on 7 platforms (X is on paid plans). Your agent can connect and publish without anyone reaching for a card. Paid plans start at $20/month for unlimited posts and 5 connected accounts (Starter $20, Creator $30 for 10 accounts, Agency $99 for 100, extra accounts from $2 a month). Plans and pricing.
Limits worth knowing: 1 API key per brand, and 10 AI-created posts per day
46bc2e3f6a46OBSERVED · 2026-10-11Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (6)
streamable-http
OAuth callbacks known to work end to end (any https redirect URI plus http://localhost and http://127.0.0.1 on any port is accepted):
- http://127.0.0.1/callback
Clients that cannot open a browser can use a per-brand API key from https://www.socialync.io/api-keys as `Authorization: Bearer <key>` instead. That is a fallback, not the normal path.
**B) Bearer API key.** For clients that cannot complete a browser OAuth flow (Grok Bot, headless agents, hand-edited config files). Generate a key at https://www.socialync.io/api-keys and send `Author
Gates applied: no_behavioural_pass.
46bc2e3f6a46full audit observations/trust-audit/mcp-server/jackvitick__socialync-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 46bc2e3f6a46 | SAFE | B | 89 | first audit |
Questions
What is the socialync-mcp MCP server?
Hosted MCP server: let Claude, ChatGPT, Gemini and any AI agent draft, schedule and publish to TikTok, Instagram, YouTube and 5 more, and read your analytics. Free plan included.
Is socialync-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does socialync-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does socialync-mcp run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (46bc2e3f6a46), read on 2026-10-11. The repository is watched and re-audited when it changes.