Medium Ops MCP Server

medium-ops

Standalone Medium CLI + 22-tool MCP server. Your IDE drafts the replies. Zero AI API keys.

Stories, responses, claps, feed, profiles, stats, reply engine, MCP server. One Python install, one binary, MIT licensed. Sibling of substack-ops.

TL;DR — MCP-native (no API key, one command)

uvx medium-ops mcp install cursor          # or claude-desktop, claude-code, print
# Restart your host. Then in chat:
#   "list unanswered responses on post abc123def456"
#   "draft a warm reply to response r1"
#   "post that draft"

Your host's LLM (Cursor's, Claude's) does the drafting via the propose_reply / confirm_reply tools. No ANTHROPIC_API_KEY / OPENAI_API_KEY needed.

Why a hybrid

Medium exposes three usable surfaces and we use all of them:

1. Public RSS (reads, no auth). medium.com/feed/@{user} returns the author's ~10 most recent stories with body_html, pubDate, tags, hero image, and dc:creator. Zero credentials, faster than GraphQL, stable. Used by default for list_posts / get_post / get_post_content. Inspired by Portfolio_V2's blog page.
2. Dashboard GraphQL (authenticated reads). medium.com/_/graphql + medium.com/_/api/* with the sid cookie. Used as a fallback when you ask for more than ~10 posts, when the post isn't in the RSS window, or for things RSS can't give you (responses, claps, feed, stats, search).
3. Official REST (writes). api.medium.com/v1/* with an Integration Token. Supports createPost, createPostInPublication, getUser, getPublications. That's it.

Force a specific transport with --source rss|graphql|auto on posts list, posts show, and posts content. The dashboard + GraphQL endpoints are undocumented and Medium can change them at any time. See Known gaps.

Setup (dev / from source)

git clone https://github.com/06ketan/medium-ops && cd medium-ops
uv sync
uv sync --extra mcp     # mcp SDK for the MCP server (recommended)
uv sync --extra tui     # textual for the TUI

Auth is read from ~/.cursor/mcp.json's mcpServers.medium-ops.env (or medium-api / medium). Override with env or .env.

uv run medium-ops auth verify
uv run medium-ops quickstart

Command surface

Every write defaults to --dry-run. Flip with --no-dry-run. All writes land in .cache/audit.jsonl and are dedup-checked against .cache/actions.db.

Auth (3)

Read — Stories (5)

Read + Write — Responses (3)

Read + Write — Claps (2)

Read — Discovery + Profile (5)

Reply engine (3)

Operations + safety (2)

MCP server (3)

Other (1)

Reply modes

MCP server

medium-ops mcp install cursor              # auto-add to ~/.cursor/mcp.json
medium-ops mcp install claude-desktop      # auto-add to claude_desktop_config.json
medium-ops mcp install claude-code         # uses `claude mcp add`
medium-ops mcp install print               # print the snippet only
medium-ops mcp serve                       # stdio server
medium-ops mcp list-tools                  # 22 tools

Manual config snippet:

{
  "mcpServers": {
    "medium-ops": {
      "command": "medium-ops",
      "args": ["mcp", "serve"]
    }
  }
}

If the mcp SDK is not installed, the server falls back to a minimal stdin/stdout JSON-line dispatcher:

echo '{"tool":"list_posts","args":{"limit":3}}' | medium-ops mcp serve

MCP-native draft loop (no API key)

The safety + drafting stack that makes the unattended mode safe:

LLM strategy

Two layers, both free:

1. MCP-native (default). Host LLM drafts via propose_reply / confirm_reply. No env vars, no API key. Use this for interactive replies.
2. Subprocess CLI (daemon path). For reply bulk when no human is in the loop. Auto-detects claude (Claude Code), cursor-agent, or codex on PATH. Override with MEDIUM_OPS_LLM_CMD.

There is no paid-API-key path.

Auth setup

Medium has two auth layers that map to different feature surfaces:

1. Integration Token — Authorization: Bearer <token>. Used against api.medium.com/v1/*. Gets you: publish_post, list_own_publications. Token generation at https://medium.com/me/settings → "Integration tokens". Note: Medium stopped issuing new tokens in 2023. If you never generated one, the write path will 401 and you'll have to use the sid-cookie response path for any writes.
2. sid cookie — from medium.com (Application → Cookies → sid). Used against medium.com/_/graphql and medium.com/_/api/*. Gets you: all reads (stories, responses, claps, feed, stats, profile), plus clap_post and post_response (fragile — undocumented).

medium-ops auth verify
medium-ops auth test
medium-ops auth setup
medium-ops auth har ./medium.har    # ingest a Chrome devtools HAR export

Refreshing auth from a HAR

When cookies rotate or Medium changes a GraphQL schema, the fastest fix is:

1. Open medium.com in Chrome with devtools → Network panel.
2. Reproduce the failing action (publish a draft, post a response, etc.).
3. Right-click any request → "Save all as HAR with content".
4. medium-ops auth har ./medium.har

This:

• merges fresh sid, uid, xsrf, cf_clearance cookies into .env (preserving everything else)
• writes a redacted snapshot to .cache/har-snapshot.json listing every Medium GraphQL operation observed plus its request-variable / response-data key shapes — useful for diffing against the queries hard-coded in client.py to spot schema drift before users hit it.

Env vars (or ~/.cursor/mcp.json → mcpServers.medium-ops.env):

MEDIUM_INTEGRATION_TOKEN=2fb00...     # optional, for writes
MEDIUM_SID=1:...                      # optional, for reads
MEDIUM_UID=...                        # optional
MEDIUM_USERNAME=yourhandle            # optional but recommended

Architecture

mcp.json | env                  →  auth.py
                                      │
                            MediumConfig (token? sid? uid? username?)
                                      │
                                MediumClient (httpx)
                              ┌───────┼──────────┐
                              ▼       ▼          ▼
                   api.medium.com  medium.com/  medium.com/_/
                     /v1/* (REST)    _/graphql   api/* (dashboard)
                       │              │           │
                   Bearer token    sid cookie    sid cookie
                                      │
          ┌──────┬──────┬────────────┬──────┬────────┬──────────┐
          ▼      ▼      ▼            ▼      ▼        ▼          ▼
        posts  responses  claps  profile  stats  feed  reply_engine
                                                            │
                                        ┌───────────────────┼───────────────┐
                                        ▼                   ▼               ▼
                                    template            ai_bulk       MCP propose/confirm
                                        └───────────────────┬───────────────┘
                                                            ▼
                                                   base.post_response
                                                            │
                                                  ┌─────────┼─────────┐
                                                  ▼         ▼         ▼
                                                dedup     audit   dry_run
                                                (SQLite)  (jsonl)

 mcp/server.py ──── 22 tools ─── all share MediumClient

Endpoints used

Tests

uv run pytest -q

Coverage: auth loading, client transports + XSSI stripping, dedup DB, audit log search, MCP tool registry + dispatcher, MCP install host-config merging, propose/confirm flow + token expiry, reply-engine template matching + dedup+audit flow, subprocess LLM detection.

Known gaps

• Medium stopped issuing new Integration Tokens in 2023. If you never got one, publish_post / list_own_publications will 401. The read + response + clap paths still work via sid. The RSS read path needs no credentials at all.
• RSS is capped at ~10 posts and lacks clap/response counts and stats. When you need more, pass --source graphql (requires sid) or set --limit > 10 and the client will auto-fall back to GraphQL.
• GraphQL operation names and schemas change silently. The queries in client.py mirror what the dashboard uses today — expect breakage every couple of months. Pin this package's version.
• post_response uses GraphQL savePostResponse(deltas: [Delta!]!, inResponseToPostId: ID!). Delta shape is {type: 1, index: N, paragraph: {type: 1, text, markups: []}} (type=1 means insert; paragraph.type=1 is P). Reverse-engineered from error messages.
• update_draft_content uses dashboard POST /p/{id}/deltas with {baseRev, rev, deltas}. For a brand-new draft, baseRev=-1, rev=0. Subsequent edits should bump both.
• clap_post still uses the undocumented /_/api/posts/{id}/clap shape; not yet re-validated against the new GraphQL surface. Dry-run first.
• Members-only stories return a paywall preview unless the sid belongs to a paying member.
• No "restack" equivalent. Medium doesn't have reshares; the closest is a clap + a response. Use clap_post + post_response together for that.
• No notes / short-form. Medium killed short-form in 2018.
• Chrome cookie auto-grab (the auth_chrome flow from substack-ops) is not yet implemented. Paste your sid into .env for now.
• TUI not yet implemented; the extras pin is there for future work.

License

MIT. See LICENSE.