Loading…
Social media management for Threads and Bluesky with post scheduling, analytics, and team collaboration.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The BlackTwist MCP server exposes 30 tools, focused primarily on developer capabilities. Its published description reads: "Social media management for Threads and Bluesky with post scheduling, analytics, and team collaboration". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates BlackTwist F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Hidden instructions in a tool description". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check BlackTwist's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add BlackTwist to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://blacktwist.app/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List all connected social media accounts (Threads and Bluesky) for the authenticated user. Returns provider ID, platform, username, display name, and profile picture for each account.
List scheduled and published posts within a date range. Returns threads with their posts, scheduled time, provider info, and analytics. IMPORTANT: Always send from/to as local times WITHOUT a timezone
List all draft posts (posts that have not been scheduled yet). Returns threads with their posts and content.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: list_posts
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
and analytics. IMPORTANT: Always send from/to as local times WITHOUT a tiRecommendationRemove model-directed instructions from tool descriptions.
tool: create_post
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
ved as a draft. IMPORTANT: Always send scheduleAt as a local time WITHOUTRecommendationRemove model-directed instructions from tool descriptions.
tool: reschedule_thread
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
in the thread. IMPORTANT: Always send scheduledAt as a local time WITHOUTRecommendationRemove model-directed instructions from tool descriptions.
tool: set_thread_follow_up
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
ent thresholds. IMPORTANT: This creates an AutoPlug record (not a DefaultARecommendationRemove model-directed instructions from tool descriptions.
tool: edit_post
A tool description tries to alter the model’s use of another tool.
be edited. Use get_thread first to retrieve post IDs.RecommendationDescriptions must describe only their own tool.
tool: set_thread_auto_repost
A tool description tries to alter the model’s use of another tool.
ult delays, and get_thread to see a thread's current autoRepostDelay.RecommendationDescriptions must describe only their own tool.
tool: get_best_time_to_post
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: list_viral_template_categories
A tool description tries to alter the model’s use of another tool.
before calling list_viral_templates to discover valid category values. Requires MCPRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: delete_thread
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Get a specific thread by its thread ID. Returns all posts in the thread with their content, media, scheduling info, and analytics.
Create a new post or thread. A thread is multiple posts linked together. Supports text content, topic tags, images (via public URL), auto-repost configuration, and scheduling. If scheduleAt is not pro
Delete a thread and all its posts. This action cannot be undone.
Edit the text content, topic, or media of a single post by its ID. Only posts with status READY (drafts or scheduled) can be edited. Use get_thread first to retrieve post IDs.
Edit a thread by adding, removing, or reordering its posts. Provide the full desired list of posts — existing posts (with id) are updated, new posts (without id) are created, and existing posts not in
Reschedule a thread to a new date/time. Updates all posts in the thread. IMPORTANT: Always send scheduledAt as a local time WITHOUT a timezone offset. The server converts to UTC using the user's confi
Set or remove auto-repost on an existing thread. Auto-repost republishes the thread's first post after the given delays have elapsed since publishing. Pass enabled: false to turn it off. Use get_user_
Get live engagement metrics for a social account over a date range. Returns views, likes, replies, reposts, and quotes with percentage change vs. the previous period. Works with both Threads and Blues
Get time-series data points for a specific metric. Available metrics: VIEWS, LIKES, REPLIES, REPOSTS, QUOTES, ENGAGEMENT_RATE, FOLLOWERS_COUNT. Returns daily data points.
Get analytics for individual posts published within a date range. Returns engagement metrics (views, likes, replies, reposts, quotes, engagement rate) for each post, plus a `thread` array of continuat
Get follower count over time for a social account. Returns daily follower count data points.
Get posting consistency data for the past 365 days. Returns a heatmap-style array of daily post counts, total posts, and number of days with posts.
Get yesterday's daily recap for a social account. Returns new followers gained and number of posts published.
Get AI-generated posting recommendations based on your analytics and performance patterns. Returns best posting times and content suggestions.
Get the best times to post for a social account, based on historical engagement over the last 10 weeks. Hours are reported in the user's own timezone (resolved automatically from their account setting
Get all follow-up (auto-plug) templates for a specific provider. These are reusable templates that define what reply to attach to a post after it reaches engagement thresholds.
Get the follow-up (auto-plug) configuration for a specific thread.
Set or update the follow-up (auto-plug) for a thread. The follow-up is a reply that gets posted after the original post reaches engagement thresholds. IMPORTANT: This creates an AutoPlug record (not a
List all configured posting time slots for a provider. Time slots define the preferred times when posts should be scheduled. Each slot has an hour, minute, and array of weekdays (0=Sunday, 6=Saturday)
Get the current user's subscription and plan information. Returns plan type, remaining posts, account limits, and team limits.
Get the current user's settings including timezone, date format, auto-repost configuration, and reminder preferences.
List all teams the authenticated user belongs to, including their role and which team is currently active. Use the team ID as the teamId parameter in other tools. To access the personal workspace (no
List viral post templates extracted from high-performing posts. Each template includes the category, the template structure, usage instructions, an example post, and engagement metrics (views, likes,
List all available viral post template categories with the number of templates in each. Use this before calling list_viral_templates to discover valid category values. Requires MCP access, included in
List the tags available in the workspace for organizing posts.
Get the tags currently on a thread.
Set the tags on a thread. This single tool covers setting, updating, and removing tags: it replaces the thread's existing tags with the exact set you pass in. Tag names that don't exist yet are create