tokportal-mcpSAFE
Official MCP server for the TokPortal API — 91 tools for TikTok, Instagram and YouTube managed accounts (npm: tokportal-mcp)
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/tokportal-mcp) [](./LICENSE)
TokPortal is the managed social infrastructure API: real TikTok and Instagram brand accounts created, warmed and operated by human account managers in 16+ countries, exposed as a REST API and an MCP server. Run geo-sharding across markets without connecting every social account through OAuth. YouTube bundle creation is not available through this API.
Upgrade before using the sandbox: local tokportal-mcp requires 1.15.1 or newer for dry_run. Version 1.15.0 advertised the argument but did not send the sandbox header, so a preview could execute a real operation. Upgrade and restart an older local server first. If you cannot verify the running local version, use the remote connector or REST with `X-TokPortal-Dry-Run: true`.
Docs https://developers.tokportal.com · API base https://app.tokportal.com/api/ext · OpenAPI https://developers.tokportal.com/openapi.json · MCP remote https://app.tokportal.com/api/ext/mcp · Get an API key https://app.tokportal.com/developer/api-keys?utmsource=npm&utmmedium=readme&utm_campaign=tokportal-mcp · llms.txt https://developers.tokportal.com/llms.txt
tokportal-mcp is the official Model Context Protocol server for the TokPortal API. It exposes every public API operation (91 tools) to Claude, Cursor, VS Code, Windsurf, Codex, Gemini CLI and any other MCP client — create bundles, upload videos, configure and publish accounts, read analytics, manage webhooks.
Two ways to use it:
e1a5cf80a342OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add tokportal-mcp --env TOKPORTAL_API_KEY=${TOKPORTAL_API_KEY} -- npx -y [email protected]Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
@modelcontextprotocol/sdk, @types/node, typescript
- Mutations accept an optional `idempotency_key` (sent as `Idempotency-Key`) except for secret-bearing operations (credential reveal, verification codes, webhook creation, signed upload URLs, report c
URL: `https://app.tokportal.com/api/ext/mcp` (Streamable HTTP). Add this URL in a client that supports remote MCP with OAuth and complete the TokPortal sign-in. Choose Full access to preview write too
Do not open public issues for vulnerabilities, API key exposure, authentication
Gates applied: no_behavioural_pass.
e1a5cf80a342full audit observations/trust-audit/mcp-server/tokportal__tokportal-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | e1a5cf80a342 | SAFE | B | 89 | first audit |
Questions
What is the tokportal-mcp MCP server?
Official MCP server for the TokPortal API — 91 tools for TikTok, Instagram and YouTube managed accounts (npm: tokportal-mcp)
Is tokportal-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does tokportal-mcp need?
It reads TOKPORTAL_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does tokportal-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as tokportal-mcp at 1.15.1.
How current is this page?
The grade is for one exact copy of the source (e1a5cf80a342), read on 2026-10-12. The repository is watched and re-audited when it changes.