Connect an MCP client

pickpost’s MCP server is one URL, https://your-pickpost-host/mcp. Clients that support MCP authorization sign in on their own: add the URL, and the client opens a browser window where you sign in and approve what it may do. Other clients use a personal API token (see the end of this page). API & MCP in the app shows every snippet with your host filled in.

Claude Code

claude mcp add --transport http pickpost https://your-pickpost-host/mcp

Then type /mcp in Claude Code and pick pickpost to sign in. Add --scope user to make it available in every project, not only the current one.

Cursor, VS Code and other JSON-configured clients

Most clients read a JSON file with an mcpServers object (Cursor: ~/.cursor/mcp.json):

{
  "mcpServers": {
    "pickpost": {
      "url": "https://your-pickpost-host/mcp"
    }
  }
}

VS Code keeps MCP servers in .vscode/mcp.json under a servers key with "type": "http". The url and headers are the same.

MCP Inspector

To see the raw tool list and try calls by hand:

npx @modelcontextprotocol/inspector

Choose Streamable HTTP, enter the /mcp URL, and use its OAuth flow, or add an Authorization header with Bearer pp_….

Check that it works

Ask the client to list your Pickpost accounts. It should call accounts_list and answer with your connected accounts. If it gets 401, the token is wrong or revoked. If it gets 403 with “Origin not allowed”, see MCP server reference.

What the client may do

The consent screen lists four permissions. The client only sees the tools its permissions cover:

Permission	Tools
Read your posts, connected accounts and media library (posts:read)	the read-only tools
Create and edit drafts (posts:write)	posts_create, posts_update, posts_setVersionText
Ask to schedule, publish or delete posts (posts:publish)	posts_schedule, posts_publishNow, posts_delete
Ask to disconnect social accounts (accounts:manage)	accounts_delete

Holding posts:publish does not publish anything by itself: each request still becomes a card you approve in Pickpost. Access tokens last an hour; the client then asks you to sign in again.

With a personal API token

For clients without MCP sign-in, or servers without the sign-in service: create a token under API tokens and send it as a header.

claude mcp add --transport http pickpost https://your-pickpost-host/mcp \
  --header "Authorization: Bearer pp_…"

• One token per client. Revoking it under API & MCP cuts that client off at once.
• A personal token acts as you, with every permission, and does not expire. Publishing, scheduling and deleting still wait for your approval.