Boring Threads Publisher

Publish posts and threads to Threads (by Meta) using Boring. Use when the user says 'post to Threads', 'create a thread', 'publish thread', 'write a Threads...

Security Scan

The skill's requirements and runtime instructions align with its stated purpose (publishing to Threads via the Boring service), but it relies on a sensitive MCP connector URL and transmits user media to Boring's servers — review trust and privacy before use.

Purpose & Capability

The skill is an instruction-only connector for publishing to Threads via Boring. The sole required credential (an MCP Connector link that contains an embedded auth token) matches the described architecture and is necessary for Boring to act on the user's behalf.

Instruction Scope

Instructions are narrowly scoped to listing accounts, preparing media, splitting long content, and calling Boring endpoints (publish/list/upload). They do instruct uploading local files or re-hosting URLs to Boring's Google Cloud Storage, which means user files and post content will be transmitted to a third-party service — this is expected for the stated purpose but is a privacy/data‑exfiltration consideration.

Install Mechanism

No install step or code is included (instruction-only), so nothing is downloaded or written to disk by the skill itself. This lowers code-execution risk but also means there is no local code to audit.

Credentials

No environment variables are requested. The single required credential is the MCP link (embedded token) stored as a Connector. That is proportionate to the function, but it is a high-value secret — if compromised it grants the third party (Boring) ability to publish as the connected account.

Persistence & Privilege

always:false and default model invocation are set; the skill is not force-installed and does not request persistent system-level privileges or modify other skills. Autonomous invocation is permitted by the platform default, which is expected for skills.

Assessment

This skill appears to do what it says, but before installing or connecting your account consider: (1) The MCP Connector URL contains an embedded auth token — treat it like a password. Only paste it into systems you trust and be prepared to revoke/regenerate it if needed. (2) Using the skill will upload any local media and post content to Boring's servers (re-hosted in Google Cloud Storage) before publishing to Threads — do not upload sensitive files or secrets. (3) Verify the Boring documentation and domain (boring-doc.aiagent-me.com) and confirm the connector URL matches that vendor. (4) If you want tighter control, avoid enabling autonomous invocation or limit the agent's permissions so posts require explicit user confirmation. (5) Because this is instruction-only (no code to inspect), you cannot locally audit behavior beyond the provided docs — if you need stronger assurances, request a verifiable code package or official integration documentation from the vendor.

Publish posts, multi-post threads, and replies on Threads. Powered by Boring.

Security & Data Handling

• MCP link is a credential: Your MCP Server URL contains an embedded authentication token. Treat it like a password — do not share it publicly. Regenerate anytime in Settings.
• Media uploads: Local files or URLs are uploaded to Boring's Google Cloud Storage to make them accessible for publishing. Social media APIs require publicly accessible media URLs.
• Data flow: Your content and media are sent from Boring's server to Threads' API on your behalf via your connected OAuth token.
• No local credentials: No local API keys or environment variables needed. All auth is embedded in the MCP link.

Prerequisites

1. Sign up at boring.aiagent-me.com with Google
2. Connect Threads account via OAuth
3. Get your MCP link: Go to Settings → copy your MCP Server URL (contains your auth token — treat it like a password)
4. Add to Claude: Paste the MCP link as a Connector — no install, no API key needed

Workflow

Step 1: List Accounts

Call boring_list_accounts and filter for threads platform. Show connected accounts.

Step 2: Determine Post Type

Threads supports multiple content types:

Type	Description	Limit
Text	Text-only post	500 characters
Photo	Single image	JPG/PNG/WEBP, max 8MB
Carousel	Multi-image	2-20 images (more than other platforms!)
Video	Single video	MP4/MOV, max 512MB, 5 min
Thread	Multi-post thread	Array of text posts, each up to 500 chars

Step 3: Choose the Right Tool

Single post (text, photo, carousel, video) → use boring_publish_post:

boring_publish_post(
  account_id="<threads_account_id>",
  platform="threads",
  text="Your post content",
  media_urls=["https://..."]  (optional)
)

Multi-post thread (long-form content split into connected posts) → use boring_publish_thread:

boring_publish_thread(
  account_id="<threads_account_id>",
  platform="threads",
  texts=["First post in thread", "Second post continues...", "Third post wraps up"],
  media_urls=["https://..."]  (optional, added to first post only)
)

Reply to existing post → use boring_reply_to_post_threads:

boring_reply_to_post_threads(
  account_id="<threads_account_id>",
  reply_to_id="<original_post_id>",
  text="Your reply here",
  media_urls=["https://..."]  (optional, first URL only)
)

Step 4: Handle Long Content

If the user provides content longer than 500 characters:

1. Automatically split into multiple posts for a thread
2. Split at sentence boundaries when possible
3. Use boring_publish_thread with the array of texts
4. Inform the user: "Your content was split into X connected posts"

Step 5: Prepare Media

• Local files: boring_upload_file with file_path
• URLs: boring_upload_from_url to re-host
• Google Drive: Pass directly

Step 6: Publish and Report

Show results:

• Post ID(s) for each published post
• Thread URL if it was a multi-post thread
• Any errors encountered

Scheduling

Add scheduled_at in ISO 8601 format to schedule:

boring_publish_post(..., scheduled_at="2025-12-25T10:00:00Z")
boring_publish_thread(..., scheduled_at="2025-12-25T10:00:00Z")

Threads-Specific Notes

• Text-only posts: Threads is one of the few platforms that supports pure text posts
• Carousel limit: Up to 20 images (vs 10 on Instagram/Facebook)
• Token: 60-day expiration with auto-refresh 5 days before expiry
• Rate Limit: 250 calls/hour per user
• Permissions: threads_basic, threads_content_publish, threads_manage_replies

Error Handling

Error	Solution
TextTooLong	Split into thread using boring_publish_thread
InvalidCarouselSize	Carousel needs 2-20 images
TokenExpired	Reconnect at boring.aiagent-me.com (rare due to auto-refresh)
MediaTooLarge	Images max 8MB, videos max 512MB

Documentation

Full API docs: boring-doc.aiagent-me.com