Mastodon
Post, search, follow and read on any Mastodon instance — the fediverse, where every server is its own API with its own limits and rules.
About
Mastodon ships in the w6w first-party pack. It declares 18 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.
- App id
io.w6w.mastodon- Version
- 0.1.1
- Author
- w6w
- Licence
- MIT
- Categories
- Social Media · Communication
Overview
Mastodon is the fediverse — thousands of independently run servers speaking a shared API, and a connection here means a connection to exactly one of them. This app posts, reads, searches, follows and reacts on that instance: post a status (checked against that server’s own character limit, not a fixed 500), read a thread, favourite or boost, follow or unfollow an account, read the home and public timelines, list notifications, upload media, and read the instance’s own limits and rules before pointing a workflow at somebody’s server.
Because every server differs in character limits, media limits, poll rules and even which API version it runs, the app reads those limits from the instance itself rather than assuming defaults, and returns both the raw HTML a status arrives as and a plain-text version alongside it. Favouriting and boosting report whether the call actually changed anything, and following a locked account is tracked separately as a pending request rather than conflated with an accepted follow. Posts are deduplicated using a key derived from their own content, so a retried request lands once rather than twice.
Build with Mastodon
Three routes to the same 18 actions. The Workflow tab is generated from Mastodon's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
Follow an account
account-follow Follow someone. For a locked account this is a REQUEST — `requested` comes back true and `following` stays false until they approve.
Look up an account
account-lookup Resolve a handle to an account. A bare `@name` means a LOCAL account — across the fediverse the same name usually exists on several servers.
Get an account's posts
account-statuses One account's posts. For a REMOTE account this is whatever federated in, not their history — and boosts arrive as the original author's post.
Unfollow an account
account-unfollow Stop following, and withdraw a pending request — there is no separate cancel. It does not block, mute or notify.
Get instance information
instance-get What this server allows — the character limit, media count and poll options every other action respects, plus the rules, which usually say something about automated posting.
Upload media
media-upload Upload an image or video for a post. v2 is ASYNCHRONOUS — a 202 means the server is still processing, and attaching it before it is ready fails.
List notifications
notification-list Mentions, follows, boosts and favourites. Mastodon has NO read flag — 'what is new' means paging from the last id you saw, so nothing here marks anything read.
Boost a status
status-boost Boost a post to your followers. Mastodon has no quote-boost — adding a comment means a new post linking to it.
Get a thread
status-context The statuses above and below one post, as two flat arrays. Replies from servers this instance does not federate with are simply absent, with nothing to say so.
Delete a status
status-delete Remove one of your posts. Other instances are SENT a delete and expected to honour it — a server that was offline may never process it.
Favourite a status
status-favourite Favourite a post. Unlike a record-based network there is no separate object to keep — undoing it takes the same status id.
Get a status
status-get One status. `content` is HTML, not text — the stripped form is returned alongside — and the id is local to this instance while `uri` is the federated identity.
Post a status
status-post Post to the connected instance. The length limit is that INSTANCE'S, not Mastodon's, and a retry deduplicates because the idempotency key is derived from the content.
Search
status-search Search this instance's view of the network — which is not the network. Pasting a URL RESOLVES it instead, pulling a remote post or account in so it can be acted on.
Remove a boost
status-unboost Undo a boost, using the same status id. Followers who already saw it are not notified.
Remove a favourite
status-unfavourite Un-favourite a post, using the same status id. `changed` says whether there was anything to remove.
Get the home timeline
timeline-home What the connected account follows. For 'everything since last run', pass the previous `nextMinId` — it walks forward without gaps, which `since_id` does not.
Get a public or hashtag timeline
timeline-public The instance's public firehose, or one hashtag. `local` is this server's own members; federated is whatever arrived here — and neither is the whole network.
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Mastodon's real ids.
{
"manifestVersion": "2",
"name": "mastodon-example",
"steps": [
{
"id": "account-follow",
"uses": {
"app": "io.w6w.mastodon",
"action": "account-follow",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"id": "<id>"
}
}
]
}Here are some of the things you can do
-
Follow an account
performaccount-follow -
Look up an account
readaccount-lookup -
Get an account's posts
readaccount-statuses -
Unfollow an account
performaccount-unfollow -
Get instance information
readinstance-get
+13 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Mastodon, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Mastodon. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "account-follow",
payload: {
id: "<value>",
// reblogs: "<value>",
// notify: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value);npm install -g @w6w/cliw6w run conn_YOUR_CONNECTION_ID --action account-follow --payload '{"id":"<value>"}'Give an AI agent Mastodon — without giving it Mastodon's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.mastodon#account-follow",
"input": {
"id": "<id>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Mastodon connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
What the agent gets
Credentials it can't read
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
A tool surface scoped to the caller
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
A durable workflow in one call
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Health-aware discovery
Mastodon's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Mastodon itself is MIT, and the runtime that executes it is source-available (FSL).
Health checks
Mastodon declares its own checks, so its health is a property of the app rather than something the host guesses at.
Mastodon service status
Instance reachable
Whether this instance answers, and whether its limits still match what was recorded. A server changing its character limit announces it nowhere.
Request headroom
Remaining requests in the current window, from this instance's own headers. The limit is the server's — a small instance may allow a fraction of what mastodon.social does.