SquidX logo
Open SquidX

MCP server

Give Claude, ChatGPT, Cursor or any MCP client a set of tools over your workspace: read the queue and the numbers, draft and schedule posts, and, if you allow it, publish.

What it is

The Model Context Protocol is how an AI client discovers and calls tools. SquidX runs an MCP server at

MCP endpoint
https://squidx.io/api/mcp
  • Transport: Streamable HTTP, stateless, JSON responses. Every request is authenticated on its own; there is no session to keep and no SSE stream to open.
  • Auth: OAuth 2.1, the way the MCP spec describes it. The client registers itself, sends you to squidx.io to sign in, and you pick the workspace and the access level on a consent page. A client that cannot do OAuth sends an API key as a bearer token instead. See Authentication.
  • Tools: the key's permissions decide the tool list. A read-only key never sees publish_post, so the model cannot even try. The full list is in Tools reference.

Connect a client

The URL is the same everywhere: https://squidx.io/api/mcp. Most clients sign in through the browser. Pick yours for the exact steps.

Claude CodeOne command in your terminalClaude DesktopA connector in the app settingsCursorA few lines of mcp.jsonChatGPTA connector in developer modeCodexTwo commands in your terminalAny MCP clientThe generic configuration

You can also start from the dashboard: the Connect your AI card in the sidebar opens the same steps.

How the sign-in works

  1. The client calls the server without a token and gets a 401 that names /.well-known/oauth-protected-resource.
  2. It reads that document, then /.well-known/oauth-authorization-server, and registers itself at /api/oauth/register. No secret changes hands for a public client; PKCE protects the exchange.
  3. Your browser opens /oauth/authorize. You sign in to SquidX if needed, pick the workspace and the access level, and press Allow.
  4. The client trades the code for an access token (one hour) and a refresh token (30 days, rotated on every use) at /api/oauth/token.

The app then appears under Settings › API and MCP access › Connected apps, where one click disconnects it. An access token is an API key with an expiry: the same permissions, the same rate limit, the same tool list.

Permissions and safety

  • Read only: the agent can list posts, read analytics, leads and mentions. It cannot change anything.
  • Read and write: adds drafting, scheduling, rescheduling, cancelling, deleting and publishing, image uploads, replies to mentions, lead statuses and the posting slots.
  • Custom: posts:write without posts:publish is the sweet spot for a content agent. It fills the queue at the times you set; nothing goes to X until the cron reaches the slot, and you can still read the queue first.
  • publish_post, reply_to_mention, delete_post and delete_agent take a confirm: true argument and describe themselves as actions to confirm with the person. A well-behaved client asks before calling them.
  • Writes are never retried by SquidX. The server instructions tell the model the same, and to check with list_posts or list_mentions instead of calling a write twice.
Images and videos
To attach an image, the agent calls upload_media with a public URL or the bytes as base64, then puts the returned id in the segment's media list. Videos are too large for a tool call: use the two-step upload on the Media page, or add the video from the dashboard composer.

Things to ask

  • "What is in my queue for this week?"
  • "Which of my posts got the most impressions in the last 90 days, and what do they have in common?"
  • "Draft a five-post thread on this article and put it in the next free slot."
  • "Move tomorrow's post to Thursday 9am Paris time."
  • "Show me the mentions I have not answered yet, and draft a reply for each."
  • "At which hours do my posts do best? Move my posting slots there."
  • "Plan my week of posts." (or the plan_week prompt)
  • "List new leads above 80 and write a first DM for each."

Troubleshooting

  • "Couldn't register with SquidX's sign-in service": the discovery documents did not answer. Check that https://squidx.io/.well-known/oauth-authorization-server loads in a browser, then remove and re-add the connector.
  • Sent back to the app with an error: you pressed Deny, or the request lacked PKCE. Add the connector again.
  • 401 with a key: the header is missing or the key is wrong. The header is Authorization: Bearer sqx_..., with the space.
  • No write tools in the list: the access is read-only. Disconnect the app in Settings and sign in again with Read and write, or create a key with it; then reconnect the client so it fetches the tool list again.
  • 405 on GET: expected. The endpoint only takes POSTed JSON-RPC messages; a client that opens a standalone SSE stream falls back to plain requests.
  • Tool answers inactive: the workspace has no active plan. Drafts still work; queuing and publishing need a subscription or credits.