Skip to content

Connecting an assistant with MCP

Minting an MCP token, the eleven tools the server exposes, and the exact state of the n8n node, the Make app definition and Zapier.

Updated

Social Studio runs a Model Context Protocol server, so an assistant or an automation platform can read and act on your organisation through a defined set of tools.

It speaks JSON-RPC over a single HTTP endpoint. There is no streaming transport and no standard-input transport. A client sends a request, gets a response, and that is the whole protocol surface.

Eleven tools are exposed, read-only ones first: read the organisation's status, list content, list campaigns, list the calendar, list approvals, list connected accounts, summarise a workspace report, list captured viral signals, add a research source, generate text, and schedule an approved post to a connected account. Recording an approval decision is deliberately not among them, so the separation-of-duties and reviewed-version rules stay enforced in one place.

BEFORE YOU START

  • The "administer" permission. Minting an MCP token needs it, and so does listing or revoking one.
  • A fresh security check, which minting asks for.
  • An assistant or automation platform that speaks the Model Context Protocol.

STEPS

  1. Open MCP, or go to /app/mcp for your organisation.
  2. Read the tool list on the page. It is generated from the server's own registry rather than copied.
  3. Name the token and mint it. Tokens minted here last thirty days.
  4. Satisfy the security check.
  5. Copy the token immediately. It is shown once.
  6. Configure your client with the MCP endpoint address, the token as a bearer credential, and the organisation identifier as a header.
  7. Revoke a token from the list when the assistant no longer needs it.

WHAT YOU SHOULD SEE

The token once, then a list showing its name, expiry and when it was last used. Your client should be able to list tools and call them.

WHAT THIS WILL NOT DO

  • It will not bypass permissions. Every tool checks the same permission the equivalent screen does, and every call passes the same governance gate.
  • It will not decide an approval.
  • It will not let a token act on another organisation. A token is bound to the organisation it was minted for.
  • It will not charge for reading. Only text generation reserves credits, and it can be run as a dry run to preview the cost and the gate decision without generating or charging.

WORTH KNOWING, ABOUT AUTOMATION PLATFORMS

An n8n community node ships in this repository and works. It is not published to the n8n community registry, because publishing needs the owner's own npm account and n8n's verification, so it has to be installed from source.

A Make custom app definition also ships, as a blueprint. Every module in it maps onto a tool the server implements, but it is not in Make's own import format and has never been run through Make's developer platform, so it has to be rebuilt in Make's editor rather than imported.

Zapier is not supported. There is no integration, no app and no code. The path that works today on every platform, Zapier included, is the REST API and webhooks directly.

IF IT DOES NOT WORK

  • "This credential is not authorised for MCP. Mint an MCP token." means you used a REST API token.
  • "This MCP token was issued for a different organisation."
  • "Method not found: tools/run." means the method name is wrong. The server implements initialize, ping, tools/list and tools/call.
  • "Invalid Request: batch requests are not supported by this server."
  • "No such tool: content.create." means the name is not one of the eleven.
  • "view or connect permission required." is a tool-level permission refusal.
  • "ActionGate returned 'require_confirmation' for this action." means governance stopped it.
  • "That token could not be revoked. It is still live." is precise: nothing changed.

COMMON QUESTIONS

Can I set a longer expiry?

The endpoint accepts up to ninety days. The page mints thirty and offers no field, so use the API if you need a different lifetime.

Is every call recorded?

Yes. Each tool call writes an audit entry naming the tool and the actor.

  • Using the developer API

    Minting an API token with read and write scopes, what the ninety-day lifetime means, where the OpenAPI contract lives, and what the request log does and does not record.

  • Receiving webhooks

    Registering an endpoint, the two events Social Studio sends, how to verify a signature, and the retry and replay behaviour you should build for.

  • Building automation recipes

    Composing a trigger, conditions and actions into a recipe, previewing it with a dry run, and the exact sense in which a recipe never runs silently.