xPST (TysAIs/xPST) is an MCP server listed on the M8ven Trust Index. It scores 41 out of 100, grade D. It declares 29 tools. No publisher has claimed this listing.

Warning

41/100

xPST

Item: xPST
Rating: 41
Author: M8ven

xPST — free, local cross-posting for short-form video (YouTube Shorts, Instagram Reels, X). TikTok is supported as a source, not a publish destination; Threads/Messenger are opt-in. MIT OR Apache-2.0.

→ TysAIs/xPST · listed on github_code

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

TysAIs

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Reads files from sensitive locations

Touches: ~/.xpst/credentials

🔐

You'll be asked for 15 credentials: XPST_X_API_KEY, XPST_X_API_SECRET, XPST_X_ACCESS_TOKEN, XPST_X_ACCESS_TOKEN_SECRET, XPST_X_BEARER_TOKEN, XPST_INSTAGRAM_GRAPH_ACCESS_TOKEN, XPST_TIKTOK_CLIENT_KEY, XPST_TIKTOK_CLIENT_SECRET, XPST_TIKTOK_ACCESS_TOKEN, XPST_TIKTOK_REFRESH_TOKEN, XPST_THREADS_GRAPH_ACCESS_TOKEN, XPST_MESSENGER_PAGE_ACCESS_TOKEN, XPST_MESSENGER_APP_SECRET, XPST_MESSENGER_VERIFY_TOKEN, XPST_TELEGRAM_BOT_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes29 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

xpst_run

Check for new videos and cross-post them to configured platforms

xpst_post

Manually post a local video file or carousel to platforms

xpst_analytics

xpst_cross_post_analytics

xpst_followers

xpst_best_time

xpst_security_audit

xpst_suggest_caption

xpst_generate_ideas

xpst_transcript

xpst_search

xpst_schedule_list

List scheduled posts (pending, completed, failed) with times and targets

xpst_schedule_add

xpst_health

Test connectivity to all platforms and sources (no uploads)

xpst_status

Show cross-posting statistics and health status

xpst_backfill

Retry failed or incomplete posts from history

xpst_config_show

Display current configuration (with sensitive values masked)

xpst_auth_status

Show authentication status for all platforms

xpst_bio_get

xpst_providers

List supported content sources and posting destinations with capabilities

xpst_disconnect

xpst_delete

Delete a post record from state

messenger_send

messenger_set_rules

xpst_messenger_check_comments

kb_add

Ingest a local file or URL into the knowledge base

kb_query

Return stored knowledge nuggets whose text matches the query

kb_organize

Discover areas, tag difficulty, and assign nuggets

kb_areas

List discovered knowledge areas in course order (beginner -> advanced)

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configXPST_MCP_READONLY1 — Blocks all mutating tools entirely (read-only mode)

configXPST_MCP_ALLOW_MUTATIONS

configXPST_MCP_REQUIRE_CONFIRM1 — Requires confirm: true in the arguments (consent tier)

configXPST_UI_DIST

configXPST_DASHBOARD_PORT

configXPST_CONFIG_DIR

configXPST_LIVE_PLATFORM_EVIDENCE

configXPST_FFMPEG_PATH

configXPST_TIKTOK_USERNAME

configXPST_TIKTOK_COOKIES_FROM_BROWSER

configXPST_TIKTOK_PROXY

configXPST_YOUTUBE_ENABLED

configXPST_YOUTUBE_CLIENT_SECRETS

configXPST_YOUTUBE_TOKEN_FILE

configXPST_YOUTUBE_PROXY

configXPST_X_ENABLED

configXPST_X_COOKIES_FILE

configXPST_X_PROXY

configXPST_X_AUTH_MODE

🔐 secretXPST_X_API_KEY

🔐 secretXPST_X_API_SECRET

🔐 secretXPST_X_ACCESS_TOKEN

🔐 secretXPST_X_ACCESS_TOKEN_SECRET

🔐 secretXPST_X_BEARER_TOKEN

configXPST_INSTAGRAM_ENABLED

configXPST_INSTAGRAM_SESSION_FILE

configXPST_INSTAGRAM_USERNAME

configXPST_INSTAGRAM_PROXY

configXPST_INSTAGRAM_AUTH_MODE

🔐 secretXPST_INSTAGRAM_GRAPH_ACCESS_TOKEN

configXPST_INSTAGRAM_GRAPH_IG_USER_ID

🔐 secretXPST_TIKTOK_CLIENT_KEY

🔐 secretXPST_TIKTOK_CLIENT_SECRET

🔐 secretXPST_TIKTOK_ACCESS_TOKEN

🔐 secretXPST_TIKTOK_REFRESH_TOKEN

configXPST_TIKTOK_SANDBOX

configXPST_THREADS_ENABLED

🔐 secretXPST_THREADS_GRAPH_ACCESS_TOKEN

configXPST_THREADS_USER_ID

configXPST_THREADS_PROXY

configXPST_MESSENGER_ENABLED

🔐 secretXPST_MESSENGER_PAGE_ACCESS_TOKEN

configXPST_MESSENGER_APP_ID

🔐 secretXPST_MESSENGER_APP_SECRET

🔐 secretXPST_MESSENGER_VERIFY_TOKEN

configXPST_MESSENGER_PAGE_ID

configXPST_MESSENGER_AUTO_REPLY

configXPST_MESSENGER_REPLY_RULES

configXPST_MESSENGER_COMMENT_REPLY_ENABLED

configXPST_MESSENGER_COMMENT_PLATFORMS

configXPST_MESSENGER_PROXY

configXPST_X_USERNAME

configXPST_YOUTUBE_CHANNEL_ID

configXPST_YOUTUBE_USERNAME

configXPST_LOCAL_PATH

configXPST_MAX_RETRIES

configXPST_LOG_LEVEL

configXPST_LOG_FILE

configXPST_NOTIFICATIONS_ENABLED

configXPST_DISCORD_WEBHOOK_URL

🔐 secretXPST_TELEGRAM_BOT_TOKEN

configXPST_TELEGRAM_CHAT_ID

configXPST_PROVIDER_MODE

configXPST_YTDLP_PATH

configVIRTUAL_ENV

configXPST_HOME

configXPST_USE_KEYRING

configXPST_NO_KEYRING

configXPST_FFPROBE_PATH

configXPST_KB_VECTOR_BACKEND

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

29/29 tools missing one or more hints — xpst_run (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); xpst_post (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); xpst_analytics (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +26 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

20/29 tools referenced in tests (69%)

Write tests that reference each tool by name so every tool has at least one test.

No access to sensitive paths

Reads sensitive paths: ~/.xpst/credentials

Remove reads of sensitive system paths. If you genuinely need them, document why in the README.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/tysais/xpst?variant=verified)](https://m8ven.ai/mcp/tysais/xpst)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: d63f3acae1bb81496e4db4ef150d45c3603fc92b

code hash: 31cbf0cc2eb209051b3efe7fa96447e712a47e73dfe2062e1e2798594c5225cd

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client