What is Upload-Post MCP?
Upload-Post MCP is the official server for Upload-Post, a paid social media posting API. With one Upload-Post API key or an OAuth sign-in, an agent can publish video, photos, text and LinkedIn documents, schedule and cancel posts, read analytics and audience data, moderate comments, send Instagram DMs and run auto-reply monitors across TikTok, Instagram, YouTube, LinkedIn, Facebook, X, Threads, Pinterest, Bluesky, Google Business, Discord and Telegram. Reddit is listed but publishing to it is switched off for now.
It is MIT-licensed TypeScript, created in May 2026, with about 17 stars and v0.17.2 released on 28 October 2026; commits were still landing on 11 November 2026. It runs locally over stdio through npx, or as a hosted connector at mcp.upload-post.com that is listed in Claude's and ChatGPT's connector directories.
How to install Upload-Post MCP
npx -y @upload-post/mcpIs Upload-Post MCP worth it?
The risk with this server is not a bug; it is the job. One credential lets an agent post in public, as you, to every account connected to your Upload-Post profiles, and the docs we read describe no read-only or per-platform API key. The README's tool table names about 75 tools (its own setup note still says 58), and many of them write: upload_video, upload_text, send_dm, public_reply_to_comment, start_autodm, unpublish_post, delete_user.
The vendor has thought about that. The tools that publish or reach other people run in two steps: called without confirmed: true they return a preview of the text, media, platforms and timing and do nothing, and the model is meant to show it to you before repeating the call. delete_user also requires the profile name to be typed back, and every tool carries MCP read-only and destructive hints so clients can prompt. The catch is that confirmed is just an argument. Nothing stops a model from passing it on the first call, or after a malicious comment tells it to, so the real safeguard is your client's own approval prompt. Leave write tools on ask, never auto-approve.
That matters because the server reads untrusted text by design. get_post_comments, list_dm_conversations and get_google_business_reviews pull in whatever strangers wrote, and the same session can reply publicly or send DMs. Mistakes are also hard to undo on two of the biggest networks: according to the docs, Instagram and TikTok have no delete API, so unpublish_post cannot pull a wrong post there. cancel_scheduled and delete_comment are not on the confirmation list.
Quotas are published and generous. The API allows 60 requests a minute on Free and Basic, up to 500 on Business plus 2 per profile, with a hard ceiling of 1,000. Each social account has its own 24-hour cap: 15 posts on TikTok, 30 on YouTube, 50 on Instagram, 150 on LinkedIn, and 10 to 30 on X depending on plan. Live per-post analytics are limited to 100 requests every 5 minutes. One open issue reports that the MCP silently drops youtubePublishAt because its SDK is pinned at 2.13.0.
Our take: for a marketer who wants an agent to draft and queue posts, this is one of the better-built vendor servers we have read, with candid docs and fast releases. Treat it like handing someone your phone with every social app logged in: fine for drafts and scheduling you review, unwise for anything left to run on its own.
Where it earns its place
A two-person marketing team at a B2B software firm
Turn a product demo video into scheduled posts for LinkedIn, YouTube Shorts and X
The agent writes captions per network and calls upload_video with a scheduled date; each call returns a preview to approve first. Basic at $24/month covers 5 profiles with unlimited uploads; TikTok needs a paid plan.
A social media manager at a 10-client agency
Pull last month's post analytics for every client into one report
Use get_cached_post_analytics, which replays stored results and avoids the 100 requests per 5 minutes live limit, then get_audience for follower data. Professional at $50/month covers 25 profiles and adds white-label.
A café owner managing their Google Business Profile
Draft replies to new reviews each week
The agent reads reviews with get_google_business_reviews and proposes replies; reply_to_google_business_review asks for confirmation before posting. Review text is untrusted input, so read every reply before approving.
Before you commit
- Setup
- Hosted: add https://mcp.upload-post.com/mcp as a custom connector (or from the Claude or ChatGPT directory) and sign in with OAuth. Local: npx -y @upload-post/mcp with UPLOAD_POST_API_KEY set. Social accounts must first be connected in the Upload-Post dashboard. Minutes to a first call.
- Integrations
- About 75 tools by the README's table: upload, media staging, status, scheduling, analytics, audience, profiles and JWT connect links, comments and moderation, DMs and auto-DM monitors, TikTok music and places, an FFmpeg job runner, queue settings and send_feedback. Many are write tools.
- Data and privacy
- The API key or OAuth token can publish, message, unpublish and delete profiles across every connected account. The hosted server sees all tool arguments; the README says it stores nothing per user and logs only method, path, status and a request ID. OAuth tokens last 1 hour with 90-day rotating refresh. Self-hosted HTTP mode listens on port 8080 and reads local files only if UPLOAD_POST_MCP_ALLOW_LOCAL_FILES is set; stdio always can. Comments, DMs and reviews are untrusted text that reaches the model.
- Cost at scale
- Free: 10 uploads a month, 2 profiles. Paid plans are unlimited uploads from $24/month (5 profiles) to $438/month (225 profiles); links in X posts cost $19/month extra for up to 50. API rate limits run from 60 to 500 requests a minute by plan.
- Limits
- Daily caps per social account (TikTok 15, YouTube 30, Instagram 50, LinkedIn 150, X 10 to 30). Reddit publishing is off. Inline video is capped at 100 MB, or 10 MB per request in HTTP mode. An open issue says youtubePublishAt is silently dropped.
What’s good
- One key covers 22 networks, with scheduling and analytics
- Two-step confirmation on publishing and messaging tools
- Published rate limits and per-platform daily caps
- Hosted OAuth connector or local stdio, MIT-licensed
What’s not
- API key grants the whole account; no scoped keys documented
- Model can set confirmed: true itself
- Reads untrusted comments and DMs next to public-reply tools
- Instagram and TikTok posts cannot be deleted through it
Best for
Small marketing teams and agencies that already use Upload-Post and want an agent to draft, schedule and report on posts under human review.
Upload-Post MCP alternatives
Upload-Post MCP: common questions
- Is Upload-Post MCP worth it?
- A thorough, well-documented bridge from an agent to a dozen social accounts, whose confirm-before-publish step is a convention the model follows rather than a lock a person holds. We rate it 3.8 out of 5.
- How much does Upload-Post MCP cost?
- The server is free (MIT); Upload-Post itself is free for 10 uploads a month and 2 profiles without TikTok, then Basic $24/month ($16 billed yearly, 5 profiles), Professional $50/month ($33, 25 profiles), Advanced $147/month ($118, 75 profiles) and Business $438/month ($350, 225 profiles).
- What are the downsides of Upload-Post MCP?
- API key grants the whole account; no scoped keys documented; model can set confirmed: true itself; reads untrusted comments and DMs next to public-reply tools; instagram and TikTok posts cannot be deleted through it.
- Who is Upload-Post MCP best for?
- Small marketing teams and agencies that already use Upload-Post and want an agent to draft, schedule and report on posts under human review.
- How much does Upload-Post MCP cost for a team or in production?
- Free: 10 uploads a month, 2 profiles. Paid plans are unlimited uploads from $24/month (5 profiles) to $438/month (225 profiles); links in X posts cost $19/month extra for up to 50. API rate limits run from 60 to 500 requests a minute by plan.
- Is Upload-Post MCP safe for company data?
- The API key or OAuth token can publish, message, unpublish and delete profiles across every connected account. The hosted server sees all tool arguments; the README says it stores nothing per user and logs only method, path, status and a request ID. OAuth tokens last 1 hour with 90-day rotating refresh. Self-hosted HTTP mode listens on port 8080 and reads local files only if UPLOAD_POST_MCP_ALLOW_LOCAL_FILES is set; stdio always can. Comments, DMs and reviews are untrusted text that reaches the model.
- What are the best Upload-Post MCP alternatives?
- The closest alternatives we have reviewed are Zapier MCP and Composio.
Answers checked Nov 11, 2026.