Loading ToolBench
MCP server for social media creators — pull TikTok, Instagram, Facebook, YouTube analytics into a local vault, get weekly digests, draft brand-outreach emails with real numbers. Official APIs only, no scraping.
socials-mcp has 22 tools with mostly complete descriptions (194-char baseline met) and reasonable naming conventions. However, critical gaps exist: 8 tools lack input schemas entirely (connection_status, connect_youtube, connect_meta, connect_tiktok, media_kit_data, audience_overview, profile_get, pipeline_list), capping their schema scores at 0. Parameter descriptions are present but inconsistent in depth. Error handling is minimal, no recovery guidance or actionable error messages visible. Output schemas are not documented. Tool composition is reasonable (single responsibility mostly observed), but several tools expose OAuth flows and credential management without clear security boundaries or confirmation patterns for destructive operations.
Audience demographics (age/gender/country/city/source) from the latest snapshot of each platform.
Metric deltas: last N days vs prior N days (e.g. views this week vs last week).
Connect Instagram + Facebook Page via one Meta OAuth flow. Needs an IG Business/Creator account linked to a FB Page. Requires meta app credentials (docs/onboarding-meta.md).
Connect TikTok via official Display API OAuth (video.list + user stats — engagement counts on your own videos). Studio-only data (retention/traffic) still needs weekly CSV imports. Requires tiktok app credentials (docs/onboarding-tiktok.md).
Connect YouTube via Google OAuth. The consent URL is printed to the server log immediately; finish in the browser (localhost callback). Tokens store encrypted. Requires google app credentials (docs/onboarding-google.md).
8 tools have no input schema (connection_status, connect_youtube, connect_meta, connect_tiktok, media_kit_data, audience_overview, profile_get, pipeline_list).
OAuth connection tools (connect_youtube, connect_meta, connect_tiktok) lack confirmation/dry-run patterns and do not document recovery steps if OAuth flow fails. No error guidance for LLM.
set_platform_credentials accepts credentials as additionalProperties object without validation hints. LLM cannot infer required fields (accessToken, refreshToken, expiresAt) or their types. Needs explicit schema with required array.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Show connected social accounts, token health, vault history depth, and results of any background OAuth flows.
Weekly digest payload: summary of analytics, top content, audience changes for the specified period.
Import a TikTok Studio CSV export (retention/traffic/search data) into the vault. Studio-only metrics are not available via the official API.
Verified numbers for media kits: lifetime metrics and audience demographics across all connected platforms.
Log a drafted brand pitch. Draft-first — never send without explicit human approval.
List outreach attempts, optionally filtered by status (drafted, sent, replied, rejected, closed).
Update an outreach attempt (mark sent/replied, add notes or a thread reference).
Add a content idea or deliverable to the creator's pipeline (idea → scripting → script_review → brand_review → approved → posted → measured).
List pipeline items (the creator's production calendar), optionally filtered by stage.
Move a pipeline item along or edit fields. After posting, set stage=posted with post_url.
Read the creator profile (niche, tone, series, rate floor, goals, keywords) that tunes all skills to this specific creator.
Create or update the creator profile (partial merge — only provided fields change). Tunes scripts, pitches, and media kits to this creator's niche and voice.
Force-refresh stored tokens for a platform (Meta long-lived / Google / TikTok).
Store OAuth credentials for a platform (from your developer app / local onboarding). Tokens are encrypted at rest. Credentials shape: { accessToken, refreshToken?, expiresAt?, extra?: { pageId, igUserId, open_id, channel } }
Pull fresh analytics from all connected platforms into your vault (server-side fetches with token refresh). Runs weekly to accrue history.
Best content by metric (views, likes, comments, shares, engagement_rate).
Read-only SELECT against vault tables (accounts, snapshots, account_metrics, videos, video_metrics, audience, outreach_log).
vault_query accepts raw SQL without sanitization guidance. No mention of SQL injection prevention or query limits. LLM could pass malicious queries.
No output schemas documented for any tool. LLM cannot plan downstream calls or extract fields reliably. Violates pattern:tool and mxe:response-field-naming.