Atlas / MCP servers / tayler-id / Social Media

Social MediaBLOCK

Name: Social Media
Author: tayler-id

mcp/tayler-id/social-media-1

MCP server by tayler-id · Audited 2026-10-10

⚑ Report / re-scan Source ↗

A Model Context Protocol (MCP) server that connects to multiple social media platforms

Verdict

BLOCK

Grade

Trust score

58 /100

Exposed tools

3 2r · 1w · 0d

Transport

stdio

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server that connects to multiple social media platforms, allowing users to create and publish content across platforms through natural language instructions.

Features

Natural Language Interface: Create posts for multiple platforms with simple instructions
Research Capabilities: Automatically research hashtags, trends, facts, and news
Multi-platform Support: Post to Twitter/X, Mastodon, and LinkedIn with platform-specific formatting
Content Generation: Generate engaging content using multiple AI models
Rate Limit Management: Handle API rate limits gracefully with queuing and fallbacks
Analytics: Track post performance and optimize content strategy

Getting Started

Prerequisites

Node.js (v18+)
npm or yarn
API keys for:
Twitter/X
Mastodon
LinkedIn
OpenAI and/or Anthropic (for content generation)
Brave Search (for research)

Installation

Clone the repository:

git clone https://github.com/yourusername/social-media-mcp.git
cd social-media-mcp

Install dependencies:

npm install

Create a .env file with your API keys:

# Twitter API Credentials
TWITTER_API_KEY=your_api_key
TWITTER_API_SECRET=your_api_secret
TWITTER_BEARER_TOKEN=your_bearer_token
TWITTER_ACCESS_TOKEN=your_access_token
TWITTER_ACCESS_SECRET=your_access_secret
TWITTER_OAUTH_CLIENT=your_oauth_client
TWITTER_CLIENT_SECRET=your_client_secret

# Mastodon API Credentials
MASTODON_CLIENT_SECRET=your_client_secret
MASTODON_CLIENT_KEY=your_client_key
MASTODON_ACCESS_TOKEN=your_access_token

# LinkedIn API Credentials
LINKEDIN_CLIENT_ID=your_client_id
LINKEDIN_CLIENT_SECRET=your_client_secret
LINKEDIN_ACCESS_TOKEN=your_access_token

# AI API Keys
ANTHROPIC_API_KEY=your_anthropic_key
OPENAI_API_KEY=your_openai_key
BRAVE_API_KEY=your_brave_key

# Application Settings
LOG_LEVEL=info
CACHE_ENABLED=true
RATE_LIMIT_ENABLED=true

Build the pr

Read from source at commit 3a817233cabdOBSERVED · 2026-10-10

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add social-media-mcp-scripts --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env BRAVE_API_KEY=${BRAVE_API_KEY} --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} --env GOOGLE_API_KEY=${GOOGLE_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "social-media-mcp-scripts": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "BRAVE_API_KEY": "${BRAVE_API_KEY}",
        "DEEPSEEK_API_KEY": "${DEEPSEEK_API_KEY}",
        "GOOGLE_API_KEY": "${GOOGLE_API_KEY}"
      }
    }
  }
}

Exposed tools (3)

2 read · 1 write · 0 destructive.

Tool	Risk	Description
`create_post`	write	Create and post content to social media platforms based on natural language instructions
`get_trending_topics`	read	Get trending topics from social media platforms
`research_topic`	read	Research a topic using Brave Search and Perplexity

Trust audit

BLOCKgrade F · trust 58/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (5 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (14)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/linkedin-oauth.js:89

exec(`start "" "${url}"`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/linkedin-oauth.js:91

exec(`open "${url}"`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/linkedin-oauth.js:93

exec(`xdg-open "${url}"`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

scripts/linkedin-oauth.js:192

console.log(`Access Token: ${access_token}`);

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

scripts/linkedin-oauth.js:195

console.log(`Refresh Token: ${refresh_token}`);

LOWInventory / provenance · inv.hidden_file · CWE-1104

.clinerules

.clinerules

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence