PlanVortex

planvortex-mcp

The official Model Context Protocol server for PlanVortex. It lets an AI assistant — Claude Desktop, Claude Code, Cursor, VS Code — schedule posts, read the comment inbox and answer private messages across all your social networks: Facebook, Instagram, Threads, LinkedIn, TikTok, X, WhatsApp, YouTube, Google Business, Bluesky, Discord, Telegram, Slack and Pinterest.

You need a PlanVortex app, and every plan has them — the free one included.

The server authenticates with a client_id and a client_secret that you create in the

PlanVortex panel under Settings → Apps. How many apps you get is what changes with the plan:

1 on Free, 2 on Basic, 5 on Pro, 10 on Custom.

Install

Nothing to install: your MCP client starts it with npx.

Claude Desktop, Cursor, VS Code

{

"mcpServers": { "planvortex": { "command": "npx", "args": ["-y", "planvortex-mcp"], "env": { "PLANVORTEX_CLIENT_ID": "...", "PLANVORTEX_CLIENT_SECRET": "...", "PLANVORTEX_ORGANIZATION_ID": "optional, but saves a call per conversation" } } } }

Claude Code

claude mcp add planvortex \

--env PLANVORTEX_CLIENT_ID=... \ --env PLANVORTEX_CLIENT_SECRET=... \ -- npx -y planvortex-mcp

Then ask for something: _"what do I have scheduled this week, and which comments are still unread?"_

What it can do

Thirty-one tools, grouped by what they act on — and a thirty-second, create_ai_plan, that you switch on yourself (see Generating with AI).

Plus three prompts — weekly_plan, inbox_triage, publish_from_brief — and four resources with the per-network limits, capabilities, comment matrix and your organizations.

Generating with AI

PlanVortex does not just schedule what you wrote: it can write the week for you. Its planner turns a theme, your own photos, an article or a connected shop's catalogue into a week of posts, and get_planner_templates publishes the five templates with what each one costs. For a shop connected to PlanVortex (a WooCommerce store), list_store_products finds the products to write about.

Reading is always available. Creating a plan is not, unless you switch it on:

"env": { "PLANVORTEX_MCP_ALLOW_AI": "1" }

That is deliberate, and it is about your money rather than your safety. Generating a plan spends AI credits from your account, and an agent that retries in a loop is the worst possible caller for an endpoint that bills. The protocol's own answer to this — asking you to confirm from inside the server — is implemented by almost no client yet, so the confirmation is this line instead: a person writes it once, before any agent starts. With it absent, create_ai_plan is not in the tool list at all, so nothing can call it.

Two more things worth knowing. create_ai_plan does not return posts: it queues the plan and returns the budget, and generation takes minutes — poll get_ai_plan. And what comes out are drafts; scheduling them is still a person's decision, one post at a time, through update_publication.

Two things it deliberately cannot do

It never deletes anything. No tool removes a post, an account, a contact or a comment. This is not a switch you can turn on; the code is not there. The reason is in the security section below.

It cannot connect a social account. Connecting Instagram is an OAuth flow with a person clicking "authorize" on Meta's own screen, and an app with client credentials cannot do that — nobody's app can. create_connect_link returns a single-use link that expires in fifteen minutes; hand it to the user and let them open it.

Security

This server runs on your machine with your app's client_secret inside the process, and it feeds a language model text that members of the public wrote — comments, reviews, DMs — while that same model holds tools that publish under your brand.

That is a prompt-injection surface by construction, and it is worth knowing how it is handled:

• Every comment, review and incoming message arrives wrapped in an untrusted_content block with an explicit notice that it is data, not instructions. It is not a guarantee — no wrapper is — but it raises the bar.
• Nothing that deletes. If an injection succeeds, the worst case is a post you can see and delete, not four thousand deleted contacts.
• The tools that publish, send, overwrite, hide a comment or spend AI credits are annotated destructiveHint: true, because none of that can be taken back once it is out, and the ones that only read are readOnlyHint: true. Every tool carries all three hints explicitly.
• Third-party text never enters a tool description or a cached resource, where your client would not mark it as untrusted.
• Whether a publish is confirmed by a human is decided by your MCP client, not by this server. The tools declare the annotations that make clients show the warning; keep them on.

Set PLANVORTEX_MCP_READ_ONLY=1 to remove the nine write tools from the listing entirely — useful if you want to give an unsupervised agent read access and nothing else.

The --http mode

planvortex-mcp --http serves MCP over HTTP for a self-hosted deployment. The process holds your `client_secret`, so anything that can reach the port can publish to your accounts with a plain curl. Therefore:

• it binds to 127.0.0.1 by default;
• binding anywhere else requires PLANVORTEX_MCP_AUTH_TOKEN and the server refuses to start without it;
• the Origin header is validated on every request (DNS rebinding);
• TLS is your reverse proxy's job — put one in front;
• and a token from the request is never forwarded to PlanVortex. It authenticates against this process and stops here.

docker run --rm -p 127.0.0.1:3000:3000 \

-e PLANVORTEX_CLIENT_ID=... -e PLANVORTEX_CLIENT_SECRET=... \ -e PLANVORTEX_MCP_AUTH_TOKEN=$(openssl rand -hex 32) \ planvortex-mcp --http --host 0.0.0.0

The flags are not optional there: the image speaks stdio by default, because that is what an MCP client starts (docker run -i planvortex-mcp) and what a server directory introspects. --http is the deployment mode, and you ask for it.

The --hosted mode

--hosted is the multi-user mode that PlanVortex runs itself, so that people can connect their PlanVortex account to an assistant by signing in, with no app credentials. You do not need it to self-host: that is --http. It holds no client_secret of any app, and it refuses to start if it finds one, a default organization, PLANVORTEX_MCP_ALLOW_AI, PLANVORTEX_MCP_AUTH_TOKEN or PLANVORTEX_MCP_UPLOAD_DIRS, because on a shared server those would apply to everybody.

Every request has to carry an OAuth access token issued by PlanVortex's Keycloak for this server (its aud) and for one of the assistant clients it accepts (its azp). The server verifies it, exchanges it for a token of its own (RFC 8693) and only that one reaches the API, so the token an assistant stores never opens the PlanVortex API by itself. A request without a valid token gets a 401 whose WWW-Authenticate points at /.well-known/oauth-protected-resource. The scopes are planvortex:read (required) and planvortex:write: without the second one the write tools are not listed. Creating AI plans is not available in this mode, and neither is create_connect_link: a connection link can only be issued to an app, so the user connects social accounts in the PlanVortex panel and the server tells the model so.

Everything the server remembers between requests (the exchanged token, the list of organizations, the duplicate guard and the rate limit) is kept per person, keyed by the token's sub. Run planvortex-mcp --help for its environment variables.

Each request that gets past authentication logs one line when it ends: the sub, the assistant client, the method, the tool and how it ended (with the PlanVortex error code if the API refused), the HTTP status and the duration. Tool calls are logged at info and the rest at debug, and nothing in the line is a token, an argument or a result.

Environment variables

Uploading media

With stdio the server runs on your machine, so upload_media accepts an absolute local path — but only inside PLANVORTEX_MCP_UPLOAD_DIRS, which is empty by default. Set it to the folders you actually want reachable:

PLANVORTEX_MCP_UPLOAD_DIRS=/Users/you/Pictures,/Users/you/Downloads

Reading an arbitrary path is exactly what an injected prompt would ask for, so there is no way to disable the allowlist. In --http mode a local path is refused outright: it would be a path on the server, not on your machine. Pass a public https URL there.

Which organ