Postroom MCP authorization and workflows
Read and publish only within approved workspace access.
Service endpoint
The remote server remains at https://social.notacompanynameyet.com/mcp . OAuth authenticates the Postroom owner and approved scopes. Never embed app secrets or customer tokens in a skill.
Write safeguards
Preview the content, destination, media and time before approval. Missing Pinterest boards need an explicit choice. Separate read permission from scheduling permission. Revocation prevents future tool calls, not existing queued jobs.
Errors
Reconnect if authorization expires. Check workspace access and scopes when tools are denied. A connected assistant is not proof that every provider permission is available.
Read before write
Begin with a request to list connected accounts and do not publish. Prepare a draft with exact destinations, media and any channel-specific fields. Inspect the returned plan. Approve only that plan and schedule once; then read the saved queue or receipt.
Revocation and negative tests
Test an unauthorized destination and a missing Pinterest board without publishing. The service should reject the request rather than guess. Revoking a client grant should prevent further tool calls under that grant. Successful OAuth authorization and a marketplace listing are separate conditions.
