43
/ 100
16 days ago
glama

posthive

Schedule and manage social media posts across 13 platforms (Bluesky, Threads, Instagram, LinkedIn, Mastodon, YouTube, Facebook, Pinterest, Telegram, Nostr, X/Twitter, Discord, Tumblr and more). OAuth 2.0 + PKCE, 10 tools, draft-first workflow for AI agents.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
6 flows detected: THREADS_TEST_TOKEN, DISCORD_BOT_TOKEN, NEXT_PUBLIC_API_URL. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 25 credentials: BLUESKY_APP_PASSWORD, DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, DODO_API_KEY, DODO_WEBHOOK_SECRET, ENCRYPTION_KEY, FACEBOOK_APP_SECRET, INSTAGRAM_APP_SECRET, JWT_ACCESS_SECRET, JWT_REFRESH_SECRET, LINKEDIN_CLIENT_SECRET, MASTODON_CLIENT_SECRET, PINTEREST_CLIENT_SECRET, PINTEREST_SANDBOX_TOKEN, POSTHIVE_API_KEY, RESEND_API_KEY, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY, THREADS_APP_SECRET, THREADS_TEST_TOKEN, TUMBLR_CONSUMER_KEY, TUMBLR_CONSUMER_SECRET, X_API_KEY, X_API_SECRET, YOUTUBE_CLIENT_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAPI_URL
configAUTH_PROVIDERNo local (default) or supabase
🔐 secretBLUESKY_APP_PASSWORD
configBLUESKY_HANDLE
🔐 secretDISCORD_BOT_TOKENBot token (Bot tab in your Discord app)
configDISCORD_CLIENT_IDOAuth2 Client ID from discord.com/developers
🔐 secretDISCORD_CLIENT_SECRETOAuth2 Client Secret
configDISCORD_REDIRECT_URIMust be public HTTPS — OAuth 2.0 callback URL
🔐 secretDODO_API_KEYBilling Dodo API key
configDODO_ENVBilling test_mode or live_mode
configDODO_PRODUCT_CREATORBilling Dodo product ID for Creator plan
configDODO_PRODUCT_PROBilling Dodo product ID for Pro plan
configDODO_PRODUCT_TEAMBilling Dodo product ID for Team plan
🔐 secretDODO_WEBHOOK_SECRETBilling whsec_... webhook signing secret
configEMAIL_FROMNo Verified sender address. e.g. Posthive <noreply@posthive.co>
configENABLE_BILLINGSet =false for self-hosted mode all features unlocked, no plan limits
🔐 secretENCRYPTION_KEY64-char hex> # NEVER change after accounts are saved
configFACEBOOK_APP_IDMeta app ID
🔐 secretFACEBOOK_APP_SECRETMeta app secret
configFACEBOOK_REDIRECT_URIMust be public HTTPS
configINSTAGRAM_APP_IDMeta app ID
🔐 secretINSTAGRAM_APP_SECRETMeta app secret
configINSTAGRAM_REDIRECT_URIMust be public HTTPS
🔐 secretJWT_ACCESS_SECRET64-char hex>
🔐 secretJWT_REFRESH_SECRET64-char hex>
configLINKEDIN_CLIENT_IDLinkedIn app client ID
🔐 secretLINKEDIN_CLIENT_SECRETLinkedIn app client secret
configLINKEDIN_REDIRECT_URIMust be public HTTPS
configMASTODON_CLIENT_IDClient key from Mastodon app settings
🔐 secretMASTODON_CLIENT_SECRETClient secret from Mastodon app settings
configMASTODON_REDIRECT_URIMust be public HTTPS
configNEXT_PUBLIC_API_URLYes API URL from the browser. http://localhost:3001 in dev
configNEXT_PUBLIC_ENABLE_BILLINGNo Must match ENABLE_BILLING in the API
configNEXT_PUBLIC_WEB_URLYes Public URL of the web app. Used for OG images, sitemap, robots.txt. http://localhost:3000 in dev, https://yourdomain.com in prod
configOPENAI_APPS_CHALLENGE
configPINTEREST_CLIENT_IDPinterest App ID from developers.pinterest.com
🔐 secretPINTEREST_CLIENT_SECRETPinterest App secret key
configPINTEREST_REDIRECT_URIMust be public HTTPS
configPINTEREST_SANDBOXSet true while app has Trial access routes API calls to the sandbox
🔐 secretPINTEREST_SANDBOX_TOKENManually-generated sandbox token (My Apps → Generate Access Token → Sandbox). Only used when PINTEREST_SANDBOX=true
configPORTNo API port. Defaults to 3001
🔐 secretPOSTHIVE_API_KEY
configPOSTHIVE_API_URL
configPUBLIC_API_URLInstagram Public HTTPS URL of the API Meta fetches images from here
configREDIS_URLYes Upstash or Railway Redis URL
🔐 secretRESEND_API_KEYNo [Resend](https://resend.com) API key. Falls back to console in dev
configSECURE_COOKIESProd Set to true to require HTTPS for auth cookies
configSENTRY_DSNNo Sentry DSN. Omit to disable
configSENTRY_ENABLED
configSTORAGE_PROVIDERFor production, use Supabase Storage instead — set =supabase and the SUPABASE_ vars.
🔐 secretSUPABASE_ANON_KEYSupabase Supabase anon key
🔐 secretSUPABASE_SERVICE_ROLE_KEYSupabase Supabase service role key
configSUPABASE_STORAGE_BUCKETSupabase Bucket name. Defaults to media
configSUPABASE_URLSupabase https://your-project.supabase.co
configTHREADS_APP_IDMeta app ID
🔐 secretTHREADS_APP_SECRETMeta app secret
configTHREADS_REDIRECT_URIMust be public HTTPS
🔐 secretTHREADS_TEST_TOKEN
🔐 secretTUMBLR_CONSUMER_KEYConsumer Key from tumblr.com/oauth/apps
🔐 secretTUMBLR_CONSUMER_SECRETConsumer Secret
configTUMBLR_REDIRECT_URIMust match the Default callback URL registered in your Tumblr app exactly
configWEB_URLYes Frontend origin for CORS + OAuth redirects. http://localhost:3000 in dev
🔐 secretX_API_KEYAPI Key (Consumer Key) from developer.x.com
🔐 secretX_API_SECRETAPI Key Secret (Consumer Secret)
configX_CALLBACK_URLMust be public HTTPS — OAuth 1.0a callback URL
configYOUTUBE_CLIENT_IDGoogle OAuth client ID
🔐 secretYOUTUBE_CLIENT_SECRETGoogle OAuth client secret
configYOUTUBE_REDIRECT_URIUse http://localhost:3001/auth/youtube/callback Google rejects tunnel domains; localhost is exempt
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/astablackclove-posthive-1e6xnz)](https://m8ven.ai/mcp/astablackclove-posthive-1e6xnz)
commit: c2aa8f4262a13427d3eb510a31107988a4e05e4c
code hash: 2fc14c098783ba614346213d968967e3753df226b89ed24d0fe99e5e5cec6a68
verified: 7/15/2026, 8:47:50 AM
view raw JSON →