Skip to content
gongong AI
Start free
Included on every plan

Let an agent actually run your social accounts.

Gongong AI ships a Model Context Protocol server, so Claude — or any MCP client — can draft, repurpose, schedule, publish, read analytics and answer comments through the same domain services the app uses. Claude and ChatGPT connect through a hosted consent screen and an OAuth 2.1 authorization server we run ourselves, so there is no key to paste into a chat window.

Get started — freeREST API docs
  • Every plan and the trial
  • One workspace per connection
  • Idempotent writes

Connect

Two ways in, depending on your client

Assistants that speak OAuth get a consent screen. Local clients that read a config file can send a scoped API key instead. Both reach the same eleven tools with the same permissions.

Claude and ChatGPT

No key to paste
  1. In your assistant's settings, add a custom connector and paste https://gongongai.com/api/mcp.
  2. Leave any client ID or client secret field empty. The connector registers itself.
  3. Approve on the Connect with Gongong screen: sign in, choose the one workspace it may act in, read the permission list, approve.
  4. Ask it something small first — “which social accounts are connected?” makes it call list_accounts and prove the connection.
mcp.json — API-key clients
{
  "mcpServers": {
    "gongong": {
      "url": "https://gongongai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${GONGONG_API_KEY}"
      }
    }
  }
}

Before you use a key

  • Create it in Automation → API keys and grant only the scopes the agent needs.
  • Keys are workspace-scoped, so an agent cannot reach another client's content.
  • Leave approvals on while you build trust — the agent drafts, a human ships.
  • Every change an agent makes is audit-logged against the key or connection that made it.

Add it yourself — we are not in a directory yet

Gongong is not listed in Anthropic's connector directory or in ChatGPT's apps directory. The connector itself is live and deployed; adding it is the custom-connector flow above, which takes about a minute. When a listing exists, this paragraph will say so.

Tools

Eleven tools, the whole loop

These map onto the same services the portal calls, so an agent can never do something the product would not. Your role, your approval rules and your workspace boundary apply to every call.
  • create_postCreate a post and its per-account targets, optionally scheduling in the same call.
  • generate_contentGenerate platform-tailored drafts with variants, in a brand voice.
  • repurpose_sourceTurn a linked article, video or PDF, or pasted text, into a set of platform drafts.
  • get_jobRead a generation run’s status, and its drafts once it has finished.
  • schedule_postSchedule an existing post now, at a time, at the next free slot, or at the best time.
  • next_free_slotResolve the next open slot for an account from its queue rules.
  • get_analyticsRead cross-account analytics for a date range, with the top posts.
  • list_accountsList connected accounts and their health.
  • list_postsList posts with their status and schedule, to pick the one to schedule.
  • list_inboxList open comments, mentions, DMs and reviews, with their text marked as untrusted.
  • reply_to_commentReply to an engagement in the unified inbox.

Permissions

What you approve, and what is withheld

The consent screen lists permissions in plain language, and the list you read is the list enforced on every call — the same scope vocabulary API keys use, not a second, looser one for agents.

Granted by default (7)

  • posts:readRead your drafts, scheduled posts and their publishing status.
  • posts:writeDraft, edit, schedule and publish posts on your behalf.
  • accounts:readSee which social accounts are connected and their health.
  • analytics:readRead post performance, engagement and audience metrics.
  • inbox:readRead comments, mentions and direct messages in your inbox.
  • inbox:writeReply to and manage comments, mentions and direct messages.
  • ai:generateUse AI to generate captions, images and repurposed content.

Not granted unless asked for

  • media:readBrowse the images and videos in your media library.
  • media:writeAdd images and videos to your media library.
  • accounts:writeConnect, disconnect and reconfigure your social accounts.
  • webhooks:manageCreate and configure outbound webhook subscriptions.

Connecting or disconnecting social accounts and configuring outbound webhooks sit outside the default deliberately: a connector that wants them has to ask, and the extra lines appear on the approval screen before you press approve. The media scopes are absent for a simpler reason — no tool browses or uploads to the media library, so asking for them would be theatre. A post can still attach an asset you uploaded, by id. No tool deletes a post, an asset or an account.

How the connection is secured

An OAuth 2.1 authorization server, not a pasted secret

We run both halves ourselves: /api/mcp is the protected resource and the authorization server that guards it. The details below are the ones that decide what happens on a bad day.

No client secret to leak

Claude and ChatGPT register themselves through RFC 7591 dynamic client registration, and every code exchange is PKCE with S256 — the only method accepted. There is no secret for you to paste and none for us to lose.

A code is worth 60 seconds, once

An authorization code lives 60 seconds and is consumed in the same transaction that mints the tokens. Presenting a code a second time does not just fail: it revokes the grant it belonged to, because a replayed code means someone else has a copy.

Refresh tokens rotate, and reuse kills the grant

Each refresh returns a new token and burns the old one. If a consumed refresh token is ever presented again, the whole grant and every token under it are revoked in one transaction rather than the stolen copy quietly continuing to work.

One workspace, checked on every call

You choose a single workspace when you approve, and the connection is bound to it. Your membership and role are re-read from the database on every tool call, so a seat you remove is denied on the connector’s next request — not at the next token expiry.

The token is bound to this resource

RFC 8707 resource binding, RFC 9728 protected-resource metadata and RFC 8414 authorization-server metadata are all served, so a token minted for Gongong is not a token that can be replayed at some other MCP server.

You can end it from our side

Settings → Connected apps lists every app you have approved across your workspaces — which workspace it can act in, when it connected, when it last called, and its exact permissions. Disconnect ends access immediately; RFC 7009 revocation is there for the client to do the same.

What it looks like

A week of posting, in a conversation

Illustrative example of the tool sequence an agent runs. Nothing publishes without the approval rules your workspace already has.

Take the release notes at example.com/changelog and get Tuesday and Thursday covered on X and LinkedIn.

Called list_accounts first, then repurpose_source on that URL — it found three angles. Drafting two posts per network in your Acme brand voice.

Called next_free_slot for both accounts, then schedule_post. Tuesday 13:30 on X, Thursday 08:45 on LinkedIn — both resolved from those accounts’ own engagement history. All four are waiting on your reviewer; nothing is live.

How did last week’s thread do?

Called get_analytics: 24k impressions, 3.1% engagement, up 40% on your median for the previous period.

Availability

Not an enterprise add-on

Competitors gate automation behind their top tier. That is the assumption this product was built against.
  • Free trial · MCP included
  • Starter · MCP included
  • Creator · MCP included
  • Team · MCP included
  • Agency · MCP included

Rate limits scale, access does not

Higher plans get more headroom, but no plan — including the fourteen-day trial — has the API or the MCP server switched off. An MCP connection spends the same per-minute budget as the REST API, so an agent cannot double a quota by changing protocol.

Point your agent at it tonight

Create a workspace, paste the connector URL, approve one workspace. Fourteen days free, no card.

Start free — no cardRead the REST docs

No credit card · Cancel anytime · Every plan includes the API and the MCP server