// SCAN REPORT

Posterly

66 tools. 30 can modify or destroy data without limits.

9 destructive tools with no built-in limits. Policy required.

Last updated: 5 Jul 2026

30 can modify or destroy data

36 read-only

66 tools total

Community server · catalogue entry verified 05/07/2026

How to control Posterly ↓

TOOL MAP

What Posterly exposes to your agents

Read (36) Write / Execute (21) Destructive / Financial (9)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Posterly tools

Financial · High start_signup This tool initiates a paid signup/checkout flow, which commits the user to a financial obligation (subscription or purchase). Destructive · High delete_post_group This tool irreversibly deletes posts in bulk based on group identifiers. Destructive · High delete_api_key This tool permanently deletes authentication credentials, which cannot be undone. Destructive · High delete_google_business_media This tool irreversibly deletes media from a public business profile, which cannot be undone.

30 of Posterly's 66 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Posterly

PolicyLayer is an MCP gateway — it sits between your AI agents and Posterly, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "start_signup": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "delete_api_key": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_google_business_media": {
    "limits": [
      {
        "counter": "add_google_business_media_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "ask_support": {
    "limits": [
      {
        "counter": "ask_support_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Posterly — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON POSTERLY →

Instant setup, no code required.

FULL CATALOGUE

All 66 Posterly tools

FINANCIAL 1 tools

Financial start_signup Start the public Posterly paid signup flow for a user before Posterly API access exists. Returns a Posterly ch

DESTRUCTIVE 8 tools

Destructive delete_api_key Revoke a Posterly API key owned by the authenticated user. DESTRUCTIVE: call whoami or use a known key ID, sho Destructive delete_google_business_media Remove a photo or video from a Google Business Profile gallery. Get media_name from list_google_business_media Destructive delete_google_business_review_reply Delete the owner reply from a Google Business Profile review. DESTRUCTIVE: confirm the review and location wit Destructive delete_oauth_client Delete a self-serve OAuth developer client. DESTRUCTIVE: prevents new authorizations for that client_id; exist Destructive delete_post Delete a scheduled or draft post. DESTRUCTIVE and IRREVERSIBLE - the post and its caption cannot be recovered. Destructive delete_post_group Delete every draft/scheduled/failed/paused post matching a caller-defined group_id, post_group_id, api_group_i Destructive delete_webhook Delete a webhook subscription. DESTRUCTIVE: list the webhook first, show the user its URL/events/workspace, an Destructive disconnect_account Disconnect a connected social account from posterly. DESTRUCTIVE and IRREVERSIBLE: removes the account connect

EXECUTE 2 tools

Execute run_video_function Run a read-only Veo helper function before generation: list_input_modes, estimate_cost, or validate_request. T Execute test_webhook Send a signed webhook.test delivery to a webhook URL. OUTBOUND SIDE EFFECT: get explicit confirmation before s

WRITE 19 tools

Write add_google_business_media Add a photo or video to a Google Business Profile gallery (the media shown on Maps and Search). Provide a publ Write create_api_key Create a new Posterly API key for the authenticated user. SECRET-CREATING WRITE: only use after explicit user Write create_connect_session Create a short-lived Posterly dashboard handoff session for connecting a social account. Send the secure conne Write create_oauth_client Create a public OAuth 2.1 + PKCE developer client. WRITE: confirm app name, redirect URIs, and scopes with the Write create_post Schedule or immediately publish a social media post. This is a DESTRUCTIVE WRITE that creates content on the u Write create_posts_batch Create 1-25 scheduled or immediate social posts in one API request. This is a DESTRUCTIVE WRITE that creates c Write create_signed_upload Create a signed upload URL for a larger image or video. Upload the binary to upload_url; the API validates act Write create_webhook Create a webhook subscription for post/account/analytics events. WRITE WITH OUTBOUND SIDE EFFECTS: show the us Write dismiss_suggestion Dismiss a proactive post suggestion so it stops appearing. WRITE: confirm the exact suggestion with the user f Write generate_image Generate an AI image via Posterly\ Write generate_video Queue a Veo AI video generation job. COSTS VEO CREDITS: confirm prompt, model, duration, resolution, aspect ra Write reply_google_business_review Post or update the owner reply on a Google Business Profile review. WRITE: show the review, location, and exac Write update_oauth_client Update a self-serve OAuth developer client. WRITE: confirm changed redirect URIs, scopes, and active state bef Write update_post Update a scheduled or draft post. DESTRUCTIVE WRITE - overwrites the existing post\ Write update_post_release_id Set or repair an external release_id and optional group_id on a post. WRITE: call get_post first, show the tar Write update_post_status Pause, resume/schedule, or move a post back to draft. DESTRUCTIVE WRITE: changes whether content will publish. Write update_webhook Update a webhook URL, events, workspace, description, or active state. WRITE WITH OUTBOUND SIDE EFFECTS: list Write upload_media Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports J Write upload_media_from_url Fetch an image or video from a public HTTPS URL into Posterly storage. Returns a URL that can be used with cre

READ 36 tools

Read ask_support Ask Posterly Support AI an authenticated question using Posterly docs plus read-only account/post diagnostics Read audit_google_business_profile Run a live local-profile audit for a connected Google Business Profile location, including completeness, categ Read find_available_slot Find available time slots for posting. Respects a 1-hour gap between posts and preferred hours (8am-10pm in th Read generate_captions Generate or adapt AI caption suggestions for one or more social platforms. Uses AI Caption Assist quota and re Read get_account_analytics Get daily analytics snapshots and a period summary for a connected social account. Supports Instagram, Faceboo Read get_agent_signup_info Explain how to use Posterly MCP for agent-led signup before an API key exists, including the safe human-in-the Read get_brand Get one brand/client by ID. Returns its workspace, source, linked legacy brand group if present, and the numbe Read get_brand_profile Get the extended brand profile for a brand/client. Returns voice/tone guidance, audience, keywords, dos and do Read get_connect_link List dashboard handoff links/readiness for connecting social accounts, or get one platform connection URL. Use Read get_connect_session Poll a Posterly connect session. Use the returned status and next-step guidance to keep the user updated in pl Read get_google_business_review_link Get the direct public Google review link for a connected Google Business Profile location. Requires account_id Read get_learned_voice Get the voice posterly has learned from a connected account’s real published captions (the Read get_mcp_status Report the Posterly MCP server version, latest npm version, MCP endpoint health, API key health, and update gu Read get_performance_profile Get the performance profile posterly has derived for a connected account from the last 90 days of per-post ana Read get_platform_schema Get the platform schema for a specific connected account or platform. Call this before creating posts with pla Read get_post Get details of a specific post by ID. Returns caption, status, scheduled time, media, and platform info. Read get_post_analytics Get per-post engagement metrics (likes, comments, reach, impressions, saves, shares, plays, clicks, watch time Read get_post_insights List per-post feedback insights from the posterly performance feedback loop: for recently published posts, the Read get_post_missing Inspect whether a post is missing required content, media, account, platform settings, or metadata before it c Read get_signup_session Poll a public Posterly signup session created by start_signup. Use this to narrate checkout, payment, password Read get_video_job Get one Veo video generation job by ID, or list recent video jobs when job_id is omitted. Use after generate_v Read get_video_options List read-only Veo video generation options, input modes, durations, resolutions, aspect ratios, and credit-co Read get_x_posting_quota Get managed X posting quota for a workspace, including total monthly allowance, used posts, remaining posts, a Read list_accounts List connected social media accounts. Returns platform, username, account ID, and workspace ID for each. Pass Read list_activity List recent activity and publish events for posts, including status changes, publish attempts, failures, and r Read list_brand_accounts List the connected social accounts assigned to a brand/client. Use this when a user refers to a brand name rat Read list_brands List brands/clients the caller can access. Returns each brand ID, name, workspace ID, source, and how many soc Read list_google_business_media List the photos and videos on a Google Business Profile gallery (the media shown on Maps and Search) for one l Read list_google_business_reviews List Google Business Profile reviews for one location/account or every accessible GBP location. Supports ratin Read list_oauth_clients List self-serve OAuth developer clients owned by the user. These are public PKCE clients for third-party app i Read list_platforms List posterly platform integrations, posting capabilities, content/media limits, settings schemas, helper tool Read list_post_suggestions List proactive post suggestions: evidence-based weekly drafts posterly writes in each account Read list_posts List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, o Read list_webhooks List API webhook subscriptions, their event filters, active state, and most recent delivery status. Read suggest_google_business_review_reply Generate short, brand-aware AI reply suggestions for a Google review. Uses the AI Caption Assist allowance; do Read whoami Return the authenticated user, API key scopes, the default (personal) workspace, and every workspace the calle

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Posterly

Can an AI agent move money through the Posterly MCP server? +

Yes. The Posterly server exposes 1 financial tools including start_signup. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the Posterly MCP server? +

Yes. The Posterly server exposes 8 destructive tools including delete_api_key, delete_google_business_media, delete_google_business_review_reply. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Posterly? +

The Posterly server has 19 write tools including add_google_business_media, create_api_key, create_connect_session. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Posterly.

How many tools does the Posterly MCP server expose? +

66 tools across 4 categories: Destructive, Execute, Read, Write. 36 are read-only. 30 can modify, create, or delete data.

How do I enforce a policy on Posterly? +

Register the Posterly MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Posterly tool call.

Deterministic rules across all 66 Posterly tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON POSTERLY →

Instant setup, no code required.

66 Posterly tools catalogued and risk-classified — across an index of 43,000+ MCP servers.