Truth Social MCP Server
Truth Social post and account data management via an authorized Python MCP server.
Data last scanned today · Reviewed today
Overview
Truth Social MCP provides a Python-based interface for interacting with Truth Social data using standard Model Context Protocol. Designed for users with explicit platform authorization, the server enforces a strict safety boundary by requiring a specific environment variable, TRUTH_SOCIAL_MCP_AUTHORIZED, to be set before any live network calls are executed. The server separates tool definitions from credential management, utilizing local OS-level credential stores via Python's keyring library to handle bearer tokens. Users manage authentication out-of-band using a dedicated CLI utility, ensuring that sensitive tokens are never exposed within AI conversation logs.
Our verdict
This server carries a high risk level with a security score of 30/100. It is a community-maintained project that has not yet undergone editorial review or comprehensive security assessment. The requirement to explicitly authorize network calls and manage tokens via an external CLI tool suggests it is intended only for users who have obtained the necessary written permissions or API agreements from the platform, as automated access is restricted by the platform's terms of service.
- Requires explicit environment variable activation for network calls
- Uses local OS credential storage for sensitive bearer tokens
- Maintains zero direct dependencies for a smaller attack surface
- Includes separate CLI utilities for authenticated token management
- Community-maintained project lacking official vendor support
- Automated access prohibited by platform Terms of Service
- Security architecture has not been independently reviewed
- Limited repository activity with only one contributor
Tools
| Tool | Description | Risk |
|---|---|---|
| truth_auth_status | Reports local configuration without reading the network. | low |
| truth_logout | Logs out the user. | medium |
| truth_instance_info | Retrieves public information about the Truth Social instance. | low |
| truth_lookup_user | Looks up a user on Truth Social. | low |
| truth_get_user_posts | Retrieves posts for a specific user. | low |
| truth_get_status | Retrieves a specific status. | low |
| truth_verify | Verifies the current user's credentials. | low |
| truth_get_user | Retrieves details about a specific user. | low |
| truth_followers | Retrieves a list of followers. | low |
| truth_following | Retrieves a list of users being followed. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›Do I need special permission to use this server?
Yes. Because Truth Social's terms of service prohibit automated access, you must obtain written authorization or an official API agreement before setting the environment variable TRUTH_SOCIAL_MCP_AUTHORIZED=1 to enable live network calls.
›How are credentials managed and stored?
Credentials are managed via the truthsocial-auth command and stored in your operating system's native credential store, such as the macOS Keychain, rather than being stored in local configuration files.
›Can I perform write operations like posting or liking statuses?
Write operations are disabled by default. To enable them, you must set the TRUTH_SOCIAL_MCP_ALLOW_WRITES environment variable to 1 and ensure the authorized token imported via truthsocial-auth includes the necessary write scope.
›Does the server function without an internet connection?
Yes, the server can still report local configuration status via the truth_auth_status tool even when network access is disabled.
›Where should I define my bearer token?
You should import your token using the provided truthsocial-auth tool in your terminal. Never paste tokens, passwords, or access codes directly into an MCP conversation or chat interface.
›What are the core installation requirements?
You need Python 3.10+, an OS-supported keyring for credential storage, and an externally issued bearer token. Using uv 0.11.26 is recommended for a reproducible installation.
Alternatives
Badge
Maintain this server? Add the live badge to your README.