Skip to main content
Glama
davidmosiah

TikTok Agent Publisher

⭐ If this agent-first tool helps your workflow, please star the repo. Stars make this tooling easier for other builders to discover and help Delx keep shipping open infrastructure. 🧱 Part of the Delx agent stack — 15 open-source MCP servers across body, reach and coordination.


Local-first TikTok Content Posting API tooling for AI agents. It gives Codex, Claude, Cursor, Hermes, OpenClaw and other MCP clients a safe way to check readiness, build OAuth URLs, dry-run publish flows and upload TikTok videos only when live mode is explicitly enabled.

Use it when an agent needs to publish or inspect TikTok content without browser automation, hidden state or token leakage.

Why It Exists

Most social publishing scripts are built for humans at a terminal. Agents need a different contract:

  • a manifest that explains install/runtime rules

  • a connection status tool before write operations

  • privacy boundaries that never return token values

  • dry-run by default

  • structured JSON outputs for planning, retries and audit trails

This repo packages that contract around TikTok's official Content Posting API.

Related MCP server: Upload-Post

Install

npm install -g tiktok-agent-publisher

Or run without installing:

npm exec --yes --package=tiktok-agent-publisher -- tiktok-agent-publisher doctor

First Post (Dry-Run) Walkthrough

No TikTok credentials are required to try this. With no .env, dry-run is on by default, so every command below returns structured JSON without touching the live API. This is the exact sequence an agent should follow before its first real post. The outputs are real CLI runs, lightly trimmed.

1. Check readiness. doctor reports mode and what is still missing — never any token values.

$ tiktok-agent-publisher doctor
{
  "ok": true,
  "dry_run": true,
  "configured": {
    "client_key": false,
    "client_secret": false,
    "access_token": false,
    "refresh_token": false,
    "public_media_base_url": false,
    "supabase_storage": false
  },
  "missing": [
    "TIKTOK_CLIENT_KEY",
    "TIKTOK_CLIENT_SECRET",
    "TIKTOK_ACCESS_TOKEN",
    "TIKTOK_REFRESH_TOKEN"
  ],
  "ready_for_live_publish": false,
  "ready_for_direct_video_upload": false,
  "next_steps": [
    "Current mode is dry-run. Use dry-run to validate agent workflow before live posting."
  ]
}

2. Confirm the privacy boundaries. privacy-audit states what stays local and what is sent to TikTok, so the agent can reason about the contract before any write.

$ tiktok-agent-publisher privacy-audit
{
  "project": "tiktok-agent-publisher",
  "secrets_returned_to_agent": false,
  "token_storage": "Environment variables or local .env with user-only file permissions; tokens are never returned by tools.",
  "safety_rules": [
    "Dry-run is the default.",
    "Only post content the user owns or has permission to publish.",
    "Use explicit confirmation before live direct posting."
  ]
}

3. Build the publish payload (dry-run). This validates the job shape and caption without uploading anything. result.platformPostId is a synthetic dryrun_* id and raw.dryRun is true, so you can wire up retries and audit logging safely.

$ tiktok-agent-publisher publish-video \
    --video ./short.mp4 \
    --caption "First agent post — testing the dry-run flow" \
    --title "Hello from an agent"
{
  "ok": true,
  "dry_run": true,
  "job": {
    "id": "tiktok_1780082349025",
    "platform": "tiktok",
    "status": "queued",
    "caption": "First agent post — testing the dry-run flow",
    "mediaPaths": ["./short.mp4"],
    "metadata": { "title": "Hello from an agent" }
  },
  "result": {
    "provider": "tiktok_official",
    "platformPostId": "dryrun_1780082349025",
    "raw": { "dryRun": true, "jobId": "tiktok_1780082349025" }
  }
}

4. Poll status (dry-run). publish-status returns a DRY_RUN status so the polling loop can be exercised end to end.

$ tiktok-agent-publisher publish-status --publish-id dryrun_1780082349025
{ "dryRun": true, "publishId": "dryrun_1780082349025", "status": "DRY_RUN" }

5. List recent videos (dry-run). Returns an empty, well-formed list — the same shape the live API returns, so post-publish confirmation code works unchanged.

$ tiktok-agent-publisher list-videos --max-count 5
{ "dryRun": true, "videos": [], "cursor": null, "has_more": false }

Going live. Fill in TIKTOK_CLIENT_KEY / TIKTOK_CLIENT_SECRET (and complete OAuth — see auth-url), confirm doctor reports ready_for_live_publish: true, then set TIKTOK_DRY_RUN=false. The same five commands then operate against the real Content Posting API.

CLI

tiktok-agent-publisher manifest --client codex
tiktok-agent-publisher doctor
tiktok-agent-publisher privacy-audit
tiktok-agent-publisher auth-url --redirect-uri http://localhost:8787/callback
tiktok-agent-publisher publish-video --video ./short.mp4 --caption "Launch copy"
tiktok-agent-publisher publish-status --publish-id <publish_id>
tiktok-agent-publisher list-videos --max-count 10

Dry-run is enabled by default. Set TIKTOK_DRY_RUN=false only after doctor is clean and you are ready for live API calls.

MCP

Stdio:

tiktok-agent-mcp

HTTP (v2 stateless)

Default is stdio. Optional Streamable HTTP — no session id, JSON responses, loopback only:

npx -y -p tiktok-agent-publisher tiktok-agent-mcp --http
# GET  http://127.0.0.1:3031/health
# POST http://127.0.0.1:3031/mcp   (sessionless)

Env: TIKTOK_MCP_HOST, TIKTOK_MCP_PORT, TIKTOK_MCP_TRANSPORT=http.

Hermes-style config:

mcp_servers:
  tiktok:
    command: npx
    args: ["-y", "tiktok-agent-publisher"]
    sampling:
      enabled: false

Recommended first calls:

  1. tiktok_connection_status

  2. tiktok_privacy_audit

  3. tiktok_publish_video

Agent Surfaces

Tool

Purpose

tiktok_agent_manifest

Install/runtime guidance for Codex, Claude, Cursor, Hermes and OpenClaw

tiktok_connection_status

Dry-run, OAuth and media-hosting readiness without token values

tiktok_privacy_audit

Local file, token and live-publish boundaries

tiktok_publish_video

Dry-run or live video publish flow

tiktok_publish_status

Publish-status polling

tiktok_list_videos

Recent video list for post-publish checks

Copy-Paste Agent Prompt

Use tiktok-agent-publisher. First call tiktok_connection_status and tiktok_privacy_audit.
If dry-run is enabled, build the publish payload only. Do not request or print token values.

Configuration

Copy .env.example to .env and fill only the values you need. Do not commit .env, token files or .agent-data/.

For video inbox uploads, a local file can be uploaded directly through TikTok's upload URL. Photo and pull-from-url workflows can use Supabase Storage or another public media host.

Safety Model

  • Tokens are read from environment or local .env; tool responses never include token values.

  • Live publishing is disabled unless TIKTOK_DRY_RUN=false.

  • OAuth PKCE verifier is persisted locally in .agent-data/ and not returned in MCP output.

  • The package uses TikTok's official API surfaces; it does not automate a browser session.

Development

npm install
npm test
npm run check

šŸ“§ Contact & Support

Available Tools

6 tools
tiktok_agent_manifestTikTok Agent ManifestC
Read-onlyIdempotent

Machine-readable install, client, runtime and safety guidance for agents.

ParametersJSON Schema
NameRequiredDescriptionDefault
clientNogeneric
response_formatNojson

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true. The description adds 'safety guidance' context but doesn't detail behavioral traits like what the manifest contains or how it affects agent behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence, concise and front-loaded. It conveys the core purpose efficiently without unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description lacks details on the return value format or usage context. Given the absence of an output schema, the agent needs more information to interpret the manifest output correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description does not explain the 'client' or 'response_format' parameters. Although the parameter names are somewhat self-explanatory, the description should add meaning, which it fails to do.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the tool returns 'machine-readable install, client, runtime and safety guidance for agents.' While it doesn't use a verb+resource pattern, it clearly distinguishes this manifest tool from sibling tools that handle videos or connection status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The description implies it's for agents needing guidance, but doesn't provide criteria or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tiktok_connection_statusTikTok Connection StatusB
Read-onlyIdempotent

Check dry-run mode, OAuth readiness and live publish readiness without exposing tokens.

ParametersJSON Schema
NameRequiredDescriptionDefault
response_formatNojson

TDQS

B3.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint true, destructiveHint false, and idempotentHint true, so the tool's safety is clear. The description adds value by explicitly noting that tokens are not exposed, which is a key behavioral trait beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that front-loads the tool's purpose. It is concise without wasted words, though it could benefit from including parameter guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter and no output schema, the description should explain what the output looks like or what the checked states mean. It mentions readiness checks but gives no return format details, leaving the agent uninformed about expected results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning no property descriptions in the schema. The tool's description provides no additional meaning for the lone parameter (response_format), leaving its purpose entirely to the schema which lacks narrative context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks dry-run mode, OAuth readiness, and live publish readiness, using the verb 'check' with specific aspects. It distinguishes itself from siblings like tiktok_publish_status by focusing on connection state rather than publishing status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. While sibling tools are listed, the description does not contrast usage contexts or provide when-to-use/when-not-to-use advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tiktok_list_videosList TikTok VideosB
Read-onlyIdempotent

List recent TikTok videos visible to the configured OAuth token.

ParametersJSON Schema
NameRequiredDescriptionDefault
cursorNo
max_countNo
response_formatNojson

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds that the videos are 'recent' and visible to the token, but does not disclose pagination behavior, rate limits, or what 'recent' means. Adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that efficiently communicates the purpose. It is not verbose, though it could be slightly expanded without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and undocumented parameters, the description is insufficient. It does not explain the response format, pagination, or what constitutes 'recent'. More detail is needed for a complete understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not mention any parameters. The three parameters (cursor, max_count, response_format) are left unexplained, leaving the agent without guidance on their usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'list', the resource 'TikTok videos', and the scope 'visible to the configured OAuth token'. This distinguishes it from siblings like tiktok_publish_video and tiktok_privacy_audit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide explicit guidance on when to use this tool vs alternatives. No comparison with sibling tools like tiktok_agent_manifest or tiktok_connection_status is given. Usage context is implied but not clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tiktok_privacy_auditTikTok Privacy AuditC
Read-onlyIdempotent

Return token, media-hosting, local-file and live-publish safety boundaries.

ParametersJSON Schema
NameRequiredDescriptionDefault
response_formatNojson

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description confirms it is a read-only operation (returns data), consistent with annotations (readOnlyHint=true, destructiveHint=false). It does not contradict annotations. However, it adds no extra behavioral context beyond what annotations already provide, such as rate limits or whether the audit is cached.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence (15 words) with no redundancy. It is concise, but the phrasing is somewhat cryptic ('safety boundaries') which slightly reduces clarity. Still, it front-loads the key action and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is present, so the description should explain what the returned 'safety boundaries' contain. It does not detail the structure or fields of the result. For a privacy audit tool, users need to know what kind of data (e.g., warnings, compliance status) they will receive. The description leaves this vague.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the only parameter, 'response_format', is not explained in the description. The schema shows it's an optional enum with defaults, but the description does not clarify that this parameter controls output format (JSON vs markdown). Given the low coverage, the description should compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns 'safety boundaries' for various aspects (token, media-hosting, local-file, live-publish), which aligns with the title 'TikTok Privacy Audit'. It distinguishes this tool from siblings like tiktok_list_videos or tiktok_publish_video by focusing on privacy audit results. However, 'safety boundaries' is somewhat jargon and could be more explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives. The description does not mention prerequisites, contexts, or when not to use it. With siblings like tiktok_connection_status, a user might need clarification on when to audit privacy versus check connectivity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tiktok_publish_statusTikTok Publish StatusB
Read-onlyIdempotent

Fetch TikTok Content Posting API publish status by publish id.

ParametersJSON Schema
NameRequiredDescriptionDefault
publish_idYes
response_formatNojson

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint, fully covering safety and idempotency. The description adds no extra behavioral context (e.g., rate limits, auth, or response structure), so it meets baseline but adds little value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with 9 words, front-loaded with verb and resource. No redundancy; every word serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite good annotations, the description lacks parameter details and does not explain the output format or how the status relates to other tools. Agents may not know what response_format values do or what to expect in the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description only mentions 'publish id' without explaining the parameter name or meaning of 'response_format'. It fails to compensate for missing schema descriptions, leaving agents uncertain about optional parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action (Fetch), resource (publish status), and required input (publish id). It distinguishes from sibling tools like tiktok_publish_video (which creates) and tiktok_privacy_audit (different resource).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. Only implied that it should be used when a publish id is available and status is needed, but no exclusions or context for sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tiktok_publish_videoPublish TikTok VideoA

Create a TikTok video publish job. Dry-run is enabled by default; live mode requires explicit TIKTOK_DRY_RUN=false.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleNo
captionNo
post_modeNoMEDIA_UPLOAD
target_urlNo
video_pathYes
response_formatNojson

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate non-read-only (readOnlyHint=false) and non-destructive (destructiveHint=false). Description adds the dry-run behavior, which is useful context. But it does not disclose other behavioral traits like response format, error handling, or side effects beyond job creation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, each adding value: first states purpose, second gives critical behavioral note. No filler or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the complexity of 6 parameters and no output schema, the description is minimal. It fails to explain parameter usage, return values, or workflow details (e.g., what happens after job creation). The agent needs more context for proper use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description adds no information about the 6 parameters (video_path, title, caption, etc.). The agent is left with only parameter names, enums, and types, which is insufficient for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Create a TikTok video publish job,' using a specific verb and resource. It is distinct from sibling tools like tiktok_list_videos and tiktok_publish_status, which focus on listing or status checking.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description provides clear guidance on dry-run default and environment variable for live mode. However, it lacks explicit when-not-to-use instructions or prerequisites (e.g., requiring authentication or video file format).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.5/5.0
Disambiguation5/5

Each tool serves a clear, distinct function: manifest provides metadata, connection_status checks readiness, list_videos retrieves videos, privacy_audit examines safety, publish_status queries job state, publish_video creates a publish job. No overlap.

Naming Consistency5/5

All tool names follow the consistent pattern 'tiktok_verb_noun' in snake_case, making it easy for an agent to predict tool names and purposes.

Tool Count5/5

With 6 tools, the set is well-scoped for a TikTok publishing server, covering essential operations without unnecessary bloat.

Completeness4/5

The set covers the main publishing lifecycle: list, publish, status, and safety checks. Minor gaps exist (e.g., no tool for updating or deleting a video), but these are outside the core publishing focus.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to interact with a TikTok-style social video platform, including video upload, live streaming, social interactions, and direct messaging.
    3
    AGPL 3.0
  • A
    license
    A
    quality
    A
    maintenance
    Upload-Post is the all-in-one social media MCP server the Model Context Protocol server for social media publishing, scheduling and analytics. Connect any MCP-compatible AI agent (Claude, Cursor, ChatGPT, Claude Desktop, n8n, and more) and publish, schedule and analyze content across 13+ social networks from one API: TikTok, Instagram, YouTube, YouTube Shorts, Instagram Reels, LinkedIn, Facebook
    51
    58
    5
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Lets any AI agent post to TikTok, Instagram, YouTube, X, LinkedIn, Bluesky, Telegram, Mastodon and Discord through a single post_to_social tool. Connect an account once, then publish everywhere.
    2
    348
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/davidmosiah/tiktok-agent-publisher'

If you have feedback or need assistance with the MCP directory API, please join our Discord server