# Post*back* MCP for agents Connect an MCP-compatible agent to Post*back*'s acquisition, onboarding, conversion, revenue, and attribution data with app-scoped OAuth. Read scopes are non-destructive. Optional provider scopes add separately approved Apple Ads and TikTok Ads actions. ## Connect Use this remote MCP server URL: ```text https://api.postback.sh/mcp ``` 1. Add the URL as a remote HTTP MCP server in your agent. 2. The agent opens Post*back*'s authorization page in your browser. 3. Sign in, inspect the requesting client and redirect hostname, then choose one app. 4. Review every permission. Apple Ads and TikTok Ads write scopes appear separately when requested. The client must support remote Streamable HTTP MCP and OAuth with PKCE, Resource Indicators, and Dynamic Client Registration as the compatibility registration path used during private preview. ## Tools | Tool | Purpose | | --- | --- | | `list_apps` | List the app visible to this connection | | `diagnose_app` | Check ingestion, attribution, and integration health | | `get_analytics_overview` | Read aggregate installs, events, revenue, and performance | | `get_funnel_performance` | Read onboarding and conversion performance and largest drop-offs | | `get_tiktok_ad_performance` | Compare TikTok ads by spend, paid conversions, revenue, and ROAS | | `get_integration_status` | Check connected and verified integrations | | `list_recent_events` | Read safe event metadata without raw parameters | | `explain_attribution` | Explain the evidence behind an install's attribution | | `propose_ad_change` | Create an exact plan from live Apple Ads or TikTok Ads state | | `list_ad_changes` | List recent plans and their status | | `get_ad_change` | Read exact values, approval, and execution state | | `execute_approved_ad_change` | Execute and verify a separately approved plan | Read tools are non-destructive. Planning does not touch an ad account. Execution requires the matching provider write scope and a separate dashboard approval for the exact plan. ## Human approval for ad changes 1. The client reads revenue and funnel evidence. 2. It calls `propose_ad_change` with one bounded change and an evidence-based reason. 3. The proposal returns an `approvalUrl`, exact before and proposed state, risk, and expiry. 4. A signed-in person reviews and decides in the Post*back* dashboard. The MCP credential cannot approve the plan. 5. The client calls `execute_approved_ad_change` only after approval. 6. Post*back* re-reads live provider state, applies the change once, and verifies the result. Plans expire after 30 minutes. Post*back* stops stale plans and does not replay an ambiguous provider failure automatically. ## Security - OAuth access is bound to `https://api.postback.sh/mcp` and one Post*back* app. - Authorization uses exact registered redirects and PKCE S256. - Access tokens expire after one hour. Refresh tokens rotate and expire after 30 days. - Reuse of a rotated refresh token revokes the full grant. - Bearer tokens are accepted only in the Authorization header, never in a URL. - Removing the approving user from the organization immediately invalidates access. - Requests are rate-limited and recorded in a metadata-only audit trail. - Provider writes require an explicit scope plus a separate dashboard decision for each exact plan. --- ## Docs navigation Use the Markdown URLs when reading the docs programmatically. Use the HTML URLs when you need the interactive docs UI. - [Overview](https://postback.sh/docs) ([Markdown](https://postback.sh/docs.md)) — Introduction to Post*back* - [Quickstart](https://postback.sh/docs/quickstart) ([Markdown](https://postback.sh/docs/quickstart.md)) — Get up and running in 5 minutes - [Agent CLI](https://postback.sh/docs/cli) ([Markdown](https://postback.sh/docs/cli.md)) — Revenue intelligence and controlled ad actions - [MCP for agents](https://postback.sh/docs/mcp) ([Markdown](https://postback.sh/docs/mcp.md)) — Connect an MCP-compatible agent with OAuth - [React Native](https://postback.sh/docs/react-native) ([Markdown](https://postback.sh/docs/react-native.md)) — React Native / Expo SDK reference - [iOS (Swift)](https://postback.sh/docs/ios-swift) ([Markdown](https://postback.sh/docs/ios-swift.md)) — Native Swift SDK reference - [Android (Kotlin)](https://postback.sh/docs/android) ([Markdown](https://postback.sh/docs/android.md)) — Native Android SDK reference - [Flutter](https://postback.sh/docs/flutter) ([Markdown](https://postback.sh/docs/flutter.md)) — Flutter plugin reference - [RevenueCat](https://postback.sh/docs/revenuecat) ([Markdown](https://postback.sh/docs/revenuecat.md)) — Webhook integration for subscription attribution - [Superwall](https://postback.sh/docs/superwall) ([Markdown](https://postback.sh/docs/superwall.md)) — Webhook integration for paywall attribution - [Apple Search Ads](https://postback.sh/docs/apple-search-ads) ([Markdown](https://postback.sh/docs/apple-search-ads.md)) — Keyword and ad attribution - [TikTok Ads](https://postback.sh/docs/tiktok-ads) ([Markdown](https://postback.sh/docs/tiktok-ads.md)) — Events API server-side event forwarding - [Meta Ads](https://postback.sh/docs/meta-ads) ([Markdown](https://postback.sh/docs/meta-ads.md)) — In review