MCP Server
Review the 15-tool production, 11-tool held, and 16-tool local stdio MCP surfaces.
Wahlu's public MCP connector exposes 15 intention-level production tools backed by the same SDK and contracts as the REST API. The local stdio package adds upload_media_from_file for an exact 16-tool inventory. Wahlu's isolated held policy remains fixed at 11 tools.
Connect the public package
Create a Wahlu API key with only the scopes and brands the workflow needs, then configure your local MCP host to launch the current public package over stdio:
{
"command": "npx",
"args": ["-y", "@wahlu/mcp-server@latest"],
"env": {
"WAHLU_API_KEY": "wahlu_live_your_api_key_here"
}
}Keep the key in the host's secret environment rather than in a shared configuration file or prompt. The package connects to https://api.wahlu.com by default.
Canonical tool inventory
| Intent | Tools |
|---|---|
| Discovery | get_context, list_targets, get_target_dynamic_options, get_platform_capabilities |
| Media | import_media_from_url, get_media, create_media_repair_derivative, upload_media, upload_media_from_file (local stdio only) |
| Content | create_draft, update_draft_tiktok_privacy, preflight_draft |
| Schedules | create_schedule, get_schedule, get_publish_run_receipt |
| Cleanup | cleanup_provider_publications (production only; exact receipt-bound authority) |
All 15 production tools delegate to the same SDK and canonical contracts as the REST API. The held surface advertises 11 tools: it keeps receipt lookup but strips cleanup authority and cleanup links, and omits live TikTok option discovery, same-draft privacy updates, byte upload, and cleanup. Tool results keep the API's structured success, error, request metadata, HTTP status, and idempotency replay truth.
Safety boundary
For a TikTok draft, call list_targets, then pass the selected brand and exact TikTok integration_id to get_target_dynamic_options. Choose only a returned privacy value and send it with that same integration ID to update_draft_tiktok_privacy. Wahlu validates the value against a fresh target-specific provider read immediately before updating onlytiktok_settings.privacy_level on the existing draft. A stale or unsupported value fails clearly; Wahlu never guesses PUBLIC_TO_EVERYONE. Rerun preflight_draft against the same draft ID afterwards.
The privacy update creates no replacement draft, Schedule, Job, or provider post.
Draft preflight is write-free. Schedule creation requires an explicit approval state and caller-owned idempotency key. A pending_review Schedule is held and creates no execution, job, or provider effect. An approved Schedule additionally requires publish:execute and may cause a later external publication.
Receipt lookup returns redacted per-platform outcomes for one exact Schedule/run. Production cleanup is available only through the cleanup authority from that bounded receipt and requires publish:execute; the held surface never returns that authority or its cleanup link.
See the discovery and preflight reference and Schedule reference.
For the complete non-publishing flow, follow the held Schedule recipe.
Deliberately absent
There is no generic request tool, second transport, media or Schedule collection tool, polling loop, execution action, approval action, generic draft update, cancellation, rescheduling, retry, provider operation, or administrative tool in the default inventory.