MCP for agents

yeetpost ships a hosted MCP server, so agents can post without you writing any glue. Streamable HTTP, five tools, and either the same API key or a login.

#Point a client at it

The server speaks Streamable HTTP at POST https://api.yeetpost.com/api/v2/mcp and authenticates with the same API key as the REST API, in either header.

claude code

claude mcp add --transport http \
  --header "Authorization: Bearer $YEETPOST_API_KEY" \
  yeetpost https://api.yeetpost.com/api/v2/mcp

Any other MCP client works the same way: point it at that URL with an Authorization: Bearer <api-key> header, or x-api-key.

Some MCP clients have a browser and no config file to paste a secret into. claude.ai is one. So the MCP endpoint takes an OAuth 2.1 access token as well as a key, and yeetpost runs the authorization server that issues it. Add https://api.yeetpost.com/api/v2/mcp as a custom connector, leave the key out, and there is nothing else to set up.

Discovery. The client calls the endpoint with no token and gets a 401 carrying WWW-Authenticate: Bearer resource_metadata="...", scope="mcp". It reads that document (RFC 9728), which names this API as the authorization server, then reads /.well-known/oauth-authorization-server (RFC 8414) and registers itself with POST /api/v1/oauth/register (RFC 7591, no credential needed). Those documents live outside /api/v2, so they are not in the spec and not in the reference above.

Consent. The client opens https://app.yeetpost.com/oauth/authorize in your browser with PKCE. You sign in to yeetpost, pick whether the app reaches your whole account or one profile, pick live or test, and approve. It exchanges the code at POST /api/v1/oauth/token for an access token good for an hour and a refresh token good for 30 days. Refresh tokens rotate, and a spent one presented again revokes the whole grant, because that is two holders and one of them is not you.

Revoke. The apps you have approved are listed on the MCP screen in the console, with the profile and mode each one got and when it last called. Revoking one there kills its tokens at their next request.

A grant behaves exactly like a key with the same two scopes: a grant given one profile sees that end customer only, a test grant reaches sandbox connections only, and rate limits are 60 requests a minute counted per grant. REST stays key-only. The full flow, endpoint by endpoint, is the "OAuth for MCP clients" section of the OpenAPI spec description.

#The five tools

list_connectionsGET /connections

The accounts and channels available, with their slugs.

create_postPOST /posts

Posts text to connectionSlugs[], optionally at scheduledFor. Returns the same per-connection results array as POST /posts.

list_postsGET /posts

Recent posts, with an optional status filter and limit.

get_postGET /posts/{postId}

One post by postId, with metrics.latest: the newest numbers read off its platform.

cancel_scheduled_postDELETE /posts/{postId}

Cancels a scheduled post by postId.

Tool arguments use the same camelCase names as the JSON endpoints: text, connectionSlugs, scheduledFor, postId, status, limit.

There is no analytics tool. get_post carries metrics.latest, which is the newest read of that post's numbers and is what an agent reporting on a post it made needs. A window of totals, a per-day series and a per-platform split is GET /analytics over REST.

#What a call looks like

tools/call

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "create_post",
    "arguments": {
      "text": "shipped the new api docs today",
      "connectionSlugs": [
        "linkedin",
        "x"
      ]
    }
  }
}

create_post returns the same per-connection results array as POST /posts, and a single connection failing is a failed item rather than a tool error. Tool errors are reserved for problems with the whole call: empty text, a bad scheduledFor, or none of the slugs matching a connection.

Every endpoint page on these docs carries an MCP tab where a tool maps to the endpoint, so you can read the REST call and the tool call side by side.

#Rate limits

The MCP endpoint has its own bucket: 60 requests per minute per API key, or per grant when the caller signed in, counted separately from /posts and /webhooks. See rate limits and request ids.

#Point a client at it

#Or connect with a login

#The five tools

#What a call looks like

#Rate limits