An AgentKit MCP gateway with per-user auth gives every person a separate, scoped connection to the tools an agent calls. Instead of handing an agent one shared API key that can touch every account, the gateway issues credentials tied to one user and one permission set. Creator OS applies the same idea to social: each workspace has its own API key and MCP connection.
User A --> gateway --> scoped key A --> workspace A socials
User B --> gateway --> scoped key B --> workspace B socials
Agent --> gateway --> read-only key --> read tools only
(one connection per user, never one shared key)The MCP gateway layer is where permissions get decided before a tool call ever reaches a social account. That single idea explains most of the design decisions in this post.
What Is Scalekit AgentKit and Why Per-User Auth Matters
AgentKit is an MCP gateway: a layer between an AI agent and a catalog of MCP tools that handles authentication per user instead of per install.
The useful question with any gateway is not how many tools it lists. It is whether the gateway can answer a harder one: which tools is this specific user allowed to call, with which credentials? Identity first, then permissions, then the tool call. Without that order, a large catalog just means a large blast radius.
If you build with Creator OS, the same pattern shows up in a smaller, social-specific form. The hosted MCP server at https://mcp.creatoros.ca/mcp exposes about 160 tools, and every connection is tied to one workspace. You can read the tool list and the connection steps in the MCP docs.
How Per-User Auth Works in an MCP Gateway
Per-user auth means the gateway stores and refreshes credentials per person, so an agent never holds one key that speaks for everyone.
A typical flow looks like this:
- Identify the user. Someone signs in to the gateway, not to each tool.
- Resolve scopes. The gateway looks up what this user granted, read only or read and write.
- Issue a scoped credential. The agent gets a key that maps to that user and that scope.
- Call the tool. The request carries the scoped credential, and the tool decides based on it.
Creator OS runs steps 1 through 3 in the connector flow. In Claude, open Settings, then Connectors, then Add custom connector, paste the URL, sign in, and pick the workspace. Each connection gets its own key, listed under Settings, then Connected apps. On agency plans you create one connection per client, so each client’s agent is isolated by design.
Why Social Agents Need Per-User Permissions, Not Shared API Keys
A shared key turns one mistake into a multi-account incident. Per-user permissions keep the failure inside one workspace.
Think about what a social agent actually touches: captions, comments, direct messages, ad budgets. A single shared key means a prompt injection, a bug, or a careless loop can post to every connected account and reply to every inbox. Scoped auth narrows that to one set of socials.
Creator OS enforces this at the API level. A key is pinned to one workspace, and an agent holding one workspace’s key cannot post to another. Read-only keys can be created in Settings, then API keys. Read-only connections only see read tools, and the API refuses writes from them. Destructive tools such as delete post, delete comment, or delete automation are flagged so your AI app asks first. The details are in the authentication docs.
When you want a guard on top of that, the Claude Code plugin adds a publish guard that asks Proceed or Cancel before anything is published, spent, or deleted. See the Claude Code plugin docs.
Can One Gateway Cover LinkedIn MCP, Facebook MCP, and Instagram MCP?
Yes, one gateway can front several networks, but only if it keeps each network’s permissions separate underneath. One front door, separate rooms.
Social platforms do not share a permission model. LinkedIn has company pages and audience targeting. Facebook has Pages, Reels, and Messenger. Instagram has Reels, Stories, collaborators, and comment funnels. If a gateway collapses those into one scope, you lose the ability to grant “publish to Instagram but do not touch the LinkedIn page.”
Creator OS keeps permissions attached to the account that was connected. Practical examples drawn from its platform handling:
- Connected accounts are the unit.
posts:createaccepts either--platformsor specific--accounts, so a post can be narrowed to chosen accounts. - Platform rules are applied per network.
create_postsends Instagram Reels as Reels and YouTube vertical videos as Shorts, with each platform’s own settings. - If a network named in a post is not connected, it comes back in
missing_platformsand the rest still go out. Nothing gets redirected to a different account. - Accounts can be disconnected individually through
accounts:disconnect <accountId>, which removes that one grant.
That last point is the practical test of any gateway: can you revoke one network without rebuilding the whole connection?
How Creator OS Agents Use Scoped Auth to Publish and Pull Analytics
Scoped auth is what lets an agent publish a post, then read the numbers, without holding a key that can do anything else.
Here is a worked loop for one client workspace. Check the connections, publish, then measure:
creatoros accounts:health
creatoros media:upload ./reel-final.mp4
creatoros posts:create --text "Three fixes for a cold email opener" \
--platforms instagram,tiktok,youtube \
--media med_8f2c --scheduledAt 2026-03-04T14:00:00Z --timezone America/Toronto
creatoros analytics:posts --from 2026-03-04 --sortBy engagement --limit 10
creatoros analytics:best-time --platform instagramThen the interesting part. For Instagram Reels, per-post analytics include reelsSkipRate, the share of views that swiped away in the first three seconds, plus igReelsAvgWatchTime and igReelsVideoViewTotalTime in milliseconds. Meta reports these for Reels only. An agent can read them after posting and change the next video’s hook or length. Creator OS provides the posting and the numbers. Your agent’s prompt or workflow decides what to change. The fields are listed in the posts API docs.
If you want a starting point for that loop, the open-source Social Agents harness runs your socials on Creator OS: it interviews you about your brand, then posts, replies to comments and DMs, and reports on a local dashboard. Start it with npm start creatoros social-agents, and read the walkthrough in the Social Agents repo post. The launch video shows the whole flow, and there are more builds on the KevBuildsApps YouTube channel.
What to Check Before Giving an Agent Posting and Ads Permissions
Before any agent gets write access to your socials and your ad accounts, confirm four things: scope, reversibility, spend limits, and previews.
| Check | Question to ask | How Creator OS handles it |
|---|---|---|
| Scope | Can this key publish to another client? | A key is pinned to one workspace; read-only keys see read tools only. |
| Reversibility | Can I revoke one account fast? | accounts:disconnect <accountId>, and each MCP connection has its own key. |
| Spend | Can an agent launch an ad at will? | Ads are created paused for review, budgets are confirmed, and every create can be dry-run with --validateOnly. |
| Previews | Do I see the post before it ships? | The Claude Code plugin’s publish guard asks Proceed or Cancel before publishing, spending, or deleting. |
Ads deserve extra care because money moves. The Ads add-on supports Meta, Google, TikTok, LinkedIn, X, and ChatGPT, and budgets are whole units of the ad account currency. Ad spend is billed by each network to your own ad account, and the add-on is $19.99/month on any plan with no percentage of spend. The full flow is in the ads docs.
AgentKit vs Hosted MCP Servers: Which Auth Model Fits Your Stack
Choose a gateway when you need many tools behind one identity layer. Choose a hosted MCP server when you want one platform’s actions done, with auth already solved.
A gateway like AgentKit earns its keep when your agent has to reach tools across many vendors and every end user needs their own slice. It is infrastructure you operate or configure, and the permission model is the product.
A hosted server takes the opposite approach: narrow scope, zero setup. Creator OS ships a hosted MCP server at https://mcp.creatoros.ca/mcp with nothing to install, reachable from Claude, ChatGPT, Claude Code, Cursor, Windsurf, and VS Code. If you only need social publishing, engagement, and analytics, the narrow server plus a scoped key per workspace usually gives you the same isolation with far less to maintain.
Many teams run both. A gateway routes the agent, and a social-specific server owns the social accounts. If you are mapping that out, start with best MCP servers for marketers and the one agent per client guide.
One unrelated release worth a look if you make video: showhow, an open-source tool from sirioberati that draws explainer reels in code, where every move lands on a spoken word and every render is checked.
FAQ
What is an MCP gateway and why does per-user auth matter?
An MCP gateway is a layer between an AI agent and a set of MCP tools that handles identity and credentials. Per-user auth matters because it keeps each person’s access separate, so one agent’s mistake cannot reach another person’s accounts. Without it, agents tend to run on a single shared key.
Can an MCP gateway handle LinkedIn, Facebook, and Instagram permissions separately?
A gateway can front all three networks, but the permissions still have to be tracked per connected account beneath it. Each network has its own rules: LinkedIn company pages, Facebook Pages and Messenger, Instagram Reels and comment funnels. In Creator OS, permissions attach to the connected account, and a post can be narrowed to specific accounts with --accounts.
How do social agents post and read analytics without over-privileged API keys?
A key scoped to one workspace gives the agent enough to publish and read metrics for that client only. Creator OS pins every key to one workspace and offers read-only keys for agents that should never write. Read-only connections only see read tools, and the API refuses writes from them.
Is AgentKit free, and how does it compare to hosted MCP servers?
Check AgentKit’s own site for its current pricing and licensing, since those terms change. The more useful comparison is the auth model: a gateway centralizes many tools behind one identity layer, while a hosted MCP server like Creator OS’s covers one platform’s actions with auth already handled and nothing to install. Many teams use both.
How do I connect my own accounts to Creator OS agents?
Pick a path: the web app, the iOS app, the REST API, the CLI with npx @creatoros/cli@latest init, or the hosted MCP server at https://mcp.creatoros.ca/mcp. For MCP, sign in, choose the workspace, and set the connection to read only or read and write. Agency plans use one connection per client workspace.
Get started
Start at https://www.creatoros.ca/sign-up and connect one set of socials. Creator OS plans start at $14.99/month for 11 platforms plus Skool, with the API, the MCP server, and the CLI included. Agency 5 gives you five client workspaces with a scoped API key for each at $49.99/month, which is the cleanest way to run one agent per client. New subscribers start for $0 with a free trial and can cancel anytime.
For setup steps, see https://www.creatoros.ca/docs. For more walkthroughs, watch the KevBuildsApps YouTube channel and the launch video.
Get started for $0
Free trial for new subscribers. Cancel anytime.