Resources

Threads publishing gateway for AI assistants

Readyweek

A gateway that lets a person's own AI assistant draft Threads posts over MCP, with every post held for human review before it publishes.

Status
In Meta App Review · not yet public
Period
2026 → present
Role
Solo: architecture, backend, MCP server, infrastructure, Meta compliance
Node 22FastifyPostgres (Supabase)MCP + RESTFly.ioAWS KMS envelope encryptionCloudflare R2Threads API

01Problem

The problem

Every scheduling tool ships its own built-in AI. People who already have an assistant they trust do not want a second one, and they do not want a tool posting on their behalf without seeing it first.

02Build

What I built

  • A multi-tenant gateway exposing an MCP server and REST API. A user connects the assistant they already use, the assistant proposes posts, and each proposal lands in a review queue.
  • A publishing worker with a heartbeat-based readiness check, so the service reports unhealthy if the worker stops rather than silently queueing.
  • Envelope encryption for platform tokens: a single KMS key reached through workload identity (OIDC), so there are no static cloud credentials anywhere in the deployment.
  • Privacy and terms pages, account disconnect, and data-deletion behaviour built to Meta's review requirements.

03Decisions

The decisions that mattered

Anyone can list a stack. These are the calls that changed the outcome.

Bring your own assistant

The product supplies no model. That removes a second AI bill for the customer and makes the gateway's job narrow: authenticate, hold for review, publish safely.

Review by default

Nothing posts without a person approving it. This is the same human-in-the-loop stance as the support triage pipeline, applied to outbound content.

Host workload identity over cheap hosting

A bare VPS was cheaper, but the security review required no long-lived cloud keys. The stack was chosen around that constraint, not around price.

04Result

Result

~$31

per month baseline infrastructure cost

0

static cloud credentials in the deployment

1

KMS key, reached via OIDC workload identity

05Next

What I'd do next

  • Complete Meta App Review and the external penetration test that gates launch.
  • Billing.