Plugins and apps

Status

Partly built. MCP, personal API tokens, OAuth sign-in with scoped tokens for MCP clients, and signed outgoing webhooks for a workspace (Receive webhooks) exist today. Everything else on this page is the accepted design, not yet built.

The constraint

Pickpost holds every user’s social network tokens. Any code running inside the server process can read all of them. That decides who may run code where.

Who writes it	Where it runs	What it can reach
Pickpost	inside the server, compiled in	everything, like the rest of the code
anyone else	its own server, as an app	only what a user granted it, through the public API

Pickpost will not load community plugins into the hosted service. One malicious or buggy plugin would expose every user’s accounts.

Official plugins

Built by the Pickpost team and compiled into the server. Each is one extension point:

• Networks. A new social network (LinkedIn, Bluesky, Instagram).
• Actions. A new capability. It shows up in the UI, the assistant, MCP and the REST API at once, with the same approval rules.
• Content hooks. Change a post just before it is published, for example add UTM tags.
• Event sinks. React to post.published, post.failed, account.disconnected.
• Notification channels. Email first, then others.

Community apps

A community plugin is an app, the same model as Slack or Shopify apps:

1. Manifest. The app publishes pickpost-app.json with its name, the scopes it needs (posts:read, posts:write, …) and the events it wants.
2. Install is an OAuth consent. The user sees the scopes and approves. The app gets a token for that user only.
3. The app calls Pickpost through the REST API or MCP, within its scopes. Public actions still become approval cards.
4. Events arrive as signed webhooks: an HMAC-SHA256 signature and a timestamp, retries with backoff, and a delivery log.
5. UI inside Pickpost runs in a sandboxed iframe from the app’s own origin. Pickpost never runs third-party JavaScript in its own page.

Order of work

1. Scoped tokens and OAuth for MCP clients, through Pickpost’s sign-in service. Done.
2. Signed outgoing webhooks. Done for workspaces, added by their owners and admins; apps will subscribe to them at install.
3. App registry and install screens (third-party applications in the sign-in service).
4. UI surfaces for apps.