The Secure Social Publishing Gateway
Engineered for AI Assistants.
Empower Claude Desktop, Cursor, and autonomous AI swarms to draft, schedule, publish, and analyze content across Twitter/X, YouTube, and Instagram with zero-trust credential isolation.
"Publish our product launch video 'AI Gateway v1.0' to YouTube with tags #AI #MCP, and tweet the announcement link on Twitter/X."
dQw4w9WgXcQ (Public, Resumable Upload Succeeded)
1892019482710491 (Idempotency Key Locked)
Built for Modern Social APIs.
Zero wrappers, zero fragile scraping. Direct, hardened OAuth 2.0 implementations engineered for high availability and strict rate compliance.
Twitter / X API v2
Autonomous thread composition, chunked image/GIF uploads, quote retweets, and real-time impression telemetry with PKCE S256 security.
- OAuth 2.0 PKCE Authorization
- Multi-post automated thread chains
- Real-time engagement analytics
- Idempotent retry deduplication
YouTube Data API v3
Enterprise resumable 8MB chunk video upload engine for long-form content and YouTube Shorts with automatic daily quota budget protection.
- 8MB chunked resumable upload sessions
- 10,000 unit daily quota tracker & refund
- YouTube Shorts & Video categorization
- Video analytics (watch time, views, likes)
Meta Graph API v21.0
Direct publishing for Instagram Business & Creator accounts. Supports single photos, 10-item carousels, and 9:16 vertical Reels with automated PNG-to-JPEG transcoding.
- Feed Photos, Carousels & Reels
- Automated image transcoding (PNG $\rightarrow$ JPEG)
- Container status polling state machine
- 60-day token silent refresh engine
Zero-Trust Hardened Gateway.
Designed in Go 1.26 for microsecond latency, zero heap bloat, and enterprise-grade multi-tenant security.
AES-256-GCM Vault
User credentials and OAuth tokens never touch LLM contexts. Encrypted at rest with distinct 12-byte random nonces and out-of-band master keys.
- Zero plaintext credential persistence
- Key derivation domain separation
- Instant platform credential revocation
Redis 7 Stream Queue
Sync-First execution: direct immediate publish with automatic fallback to Redis Stream retry workers during transient 429 / 503 platform outages.
- 5-stage jittered exponential backoff
- Dead Letter Queue (DLQ) isolation
- Fail-Closed rate limit enforcement
Postgres 16 Auto-Migrator
Embedded database migration engine (`//go:embed`) provisions all 7 versioned relational tables on first boot with atomic transactional safety.
- Strict idempotency & rollback drills
- Multi-tenant IDOR row-level isolation
- SHA-256 state integrity snapshots
60-Second Claude & Cursor Setup.
Connect your AI assistants to the live gateway in seconds using the standard Model Context Protocol configuration.
{
"mcpServers": {
"social-publisher": {
"url": "https://social-mcp.duckdns.org/mcp/sse",
"headers": {
"Authorization": "Bearer YOUR_JWT_OR_USER_TOKEN"
}
}
}
}Hardcore Security Drill Results.
Automated penetration test battery executed prior to commercial release across all API attack vectors.
| Attack Vector / Security Battery | Test Scope & Probes | Vulnerabilities Detected | Compliance Status |
|---|---|---|---|
| Kernel Socket SSRF & DNS-Rebinding | 49 private IP / metadata probes (`169.254.169.254`, RFC 1918) | 0 Leaks / 49 Blocked | PASSED |
| Multi-Tenant IDOR Matrix | 110 cross-tenant tenant isolation probes | 0 Cross-Access | PASSED |
| SQL Injection Adversarial Fuzzing | 390 malicious SQLi payloads (Tautologies, UNION, Stored Procedures) | 0 Bypasses (0.00%) | PASSED |
| Dual-Layer Secret Redaction in Telemetry | 500 log stream evaluations containing bearer tokens & secrets | 0 Secret Leaks | PASSED |
| Strict TLS 1.2+ Network Handshake | Real TCP socket handshakes (SSLv3, TLS 1.0, 1.1, 1.2, 1.3) | Legacy Protocols Blocked | PASSED |
Frequently Asked Questions.
Concrete technical answers regarding credentials, rate quotas, media limits, and commercial terms.
Can the LLM view my raw social media passwords or tokens?
No. The AI interacts solely through defined JSON-RPC MCP tool interfaces. All OAuth access tokens and refresh tokens remain locked in the AES-256-GCM database vault and are never reflected back into the LLM context window.
How does the server handle YouTube daily upload quotas?
YouTube grants 10,000 quota units/day per project. A standard video upload consumes 1,600 units. The server contains an atomic quota tracker that reserves units before initiating chunked uploads and automatically refunds units if preflight validation fails.
How are Instagram 60-day tokens refreshed?
Meta issues Long-Lived User Tokens valid for 60 days. When an action occurs within that window, the adapter silently refreshes the token with Meta Graph API. If the window elapses without activity, re-authentication is prompted via `/auth/instagram/connect`.
What happens if Twitter or Instagram is down (HTTP 503 / 429)?
The server operates on a Sync-First architecture: it attempts immediate execution, and if the platform returns a transient error, the payload is AES-encrypted into a Redis 7 Stream for 5-stage jittered exponential backoff retry.
Can I deploy this on Render, Kubernetes, or Docker?
Yes. The repository includes fully automated Docker multi-stage builds, Docker Compose stacks with Prometheus & Grafana telemetry, and production-ready Kubernetes manifests in `deploy/k8s/`.
What is the commercial licensing model?
Social Publishing MCP Server is proprietary commercial software. Production deployments and team usage require a valid commercial license key or enterprise agreement. Contact kuldeep.poonia.dev@gmail.com for license inquiries.
Transparent Enterprise Pricing.
Choose the right commercial tier for your AI applications, agencies, or self-hosted enterprise infrastructure.
Solo Builder
Ideal for independent AI developers and solopreneurs running personal publishing workflows.
- 1 Production Gateway Instance
- Twitter, YouTube & Instagram Adapters
- Claude Desktop & Cursor Integration
- 5 Connected Social Accounts
- Standard Email Support
Agency Pro
Built for marketing agencies, content teams, and multi-client AI publishing operations.
- Unlimited Connected Social Accounts
- Redis 7 Stream Async Worker Queue
- Multi-Tenant IDOR Security Vault
- Real-Time Grafana Telemetry Dashboard
- Priority 24/7 Developer Support
Enterprise Custom
For large organizations requiring air-gapped on-premise Kubernetes deployments and source code escrow.
- Air-Gapped Kubernetes On-Premise
- Custom SLA & Security Compliance
- Source Code Escrow Agreement
- Dedicated Solutions Architect
- Custom Platform Adapters