Jul 27, 2026 · by Marc Gil · View source

MCP-Billing

OAuth 2.1 + usage-based Stripe billing for MCP servers

MCP-Billing

Editorial analysis

Why a Developer Billing Tool Is the Most Honest Thing I’ve Read About Social Media Automation This Month

If you’ve ever scheduled 30 posts across five platforms on a Sunday, only to wake up and find that a silent API error dropped half of them into the ether—with no notification, no retry, and a support ticket that takes three days to surface—you already know why I want to talk about a tiny PHP-like boilerplate for MCP servers that launched on Product Hunt. The product isn’t for social media managers. It’s for developers building AI-powered servers. But the story behind it—the edge cases that don’t throw errors, the trust gap between AI-generated code and production reality, the quiet courage of showing your work before asking for money—is exactly the conversation we should be having about every automation tool we rely on to run our creator businesses. Because the tools that look complete at first glance are the ones that steal your time in silence.

The Silent Failures That Kill Your Social Media Workflow

The maker of MCP-Billing—Marc Gil—led his launch note with a confession that stopped me mid-scroll. He built a custom MCP server using Claude Code as a pair. The AI wrote the code fast, but it generated a webhook handler that returned the same 400 error for an invalid Stripe signature as it did for a temporary database outage. That meant Stripe never retried the event, and billing updates vanished in silence. The punchline: “Generating code is cheap now; the decisions, the tests, and the edge cases someone already paid to discover are not.”

Replace “Stripe webhook” with “Instagram API post endpoint” and you have the exact nightmare that every social media operator who uses third-party scheduling tools has lived. I once spent two hours debugging why a batch of 20 LinkedIn carousels didn’t post on a Monday. The scheduler’s UI showed “scheduled,” the logs showed “sent,” and the error—a rate-limit cap that the tool’s code silently caught and swallowed—only surfaced when I inspected the raw API response. The tool’s documentation claimed “guaranteed delivery.” The reality was a try/catch that ate the failure and pretended everything was fine.

This isn’t a hypothetical edge case. Every major scheduling SaaS—Buffer, Hootsuite, Later—has had public outages or silent failures documented in their status pages. But the worst bugs are the ones that don’t announce themselves. They quietly drop a post, they fail to update an analytics dashboard, they double-count a UTM click. The creator never knows until the engagement numbers look wrong, and by then the damage is done—a missed launch, a broken campaign, a confused audience.

What Marc’s story highlights is that AI-generated code makes the problem worse. When I used a popular AI content repurposing tool last quarter to generate 15 TikTok clips from a YouTube long-form, the AI handled the 90% case beautifully: framing, captions, voiceover. But it failed to handle the 10% case—a tricky cut where the speaker’s lips were out of sync with the audio—and output a clip that looked amateurish. No error, no warning, just a silent trust violation.

What MCP-Billing Teaches Us About Trust and Transparency

The smartest thing Marc did was extract the core metering logic—the part that actually tracks usage and prevents double-counting—and publish it as a free, MIT-licensed npm package called mcp-metering. He says on the launch page: “You can install it, inspect the code, and judge the engineering quality yourself before deciding if the rest of the stack is worth €79. It’s a full proof of quality, not a stripped-down teaser.”

This is the exact opposite of how 90% of social media tools market themselves. They show you a shiny UI, a five-star Review snippet, and a “trusted by 10,000 creators” badge with no way to verify the actual reliability of the engine underneath. We buy scheduling tools based on integrations lists and prettified screenshots, not on the robustness of their retry logic or their webhook deduplication. And then we discover the silent failures.

I’ve tested over a dozen scheduling tools in the past two years—from Metricool to Typefully to the new breed of AI-first schedulers. Only two of them (Buffer’s public status page and Later’s detailed error logs) gave me a way to independently verify that a post actually delivered. The rest treat their back-end as a black box. MCP-Billing’s approach—show the critical code, invite inspection, charge for the assembly and the edge-case discovery—is a transparency model I’d love to see every social media automation tool adopt.

Compare that to the standard SaaS model: monthly subscription, no source code, and an SLA that promises 99.9% uptime but doesn’t cover silent failures. Marc’s one-time €79 price with a 7-day refund policy is a trust signal, not just a pricing tactic. He’s saying “I’ve already handled the hardest 5% of the work—you can check.”

Why Creators Should Care About OAuth, Rate Limiting, and Auth Flow

Another comment thread on the launch page digs into OAuth 2.1+PKCE, redirect URI validation, and the friction of authenticating desktop AI clients. A user named Abdullah Javaid pointed out that his stalled MCP server failed because the redirect_uri validation used a fixed whitelist that didn’t accept dynamic localhost ports (RFC 8252 pattern). Marc acknowledged the gap and added it to his backlog.

This is the same kind of auth friction that breaks creator workflows daily. How many times have you tried to connect a social account to a new scheduling tool, only to hit a “redirect URI mismatch” error and spend 40 minutes Googling the fix? How many tools have you abandoned because the auth flow required you to re-authenticate every 60 days with no warning? The difference between a tool that feels “professional” and one that feels “janky” is often just the auth UX—the silent decision to handle the edge case where the user is on a VPN, or using a custom domain, or has two-factor enabled.

For creators who run multi-platform operations, the reliability of authentication directly affects your ability to schedule reliably. If your tool’s OAuth flow breaks silently—say, it refreshes the token but fails to store the new one, and you only discover when the next post fails—you’ve lost time and reach. Marc’s honest admission that he hasn’t tested end-to-end against a live Claude Desktop client yet, and his willingness to admit the gap in the public thread, is more trustworthy than any polished documentation that claims “fully tested on all platforms.”

The Gap Between AI-Generated Code and Production-Ready Automation

The MCP-Billing story is also a case study in the current state of AI-assisted development, which has direct parallels to AI-assisted content creation. Marc built the initial version with Claude Code. It worked for the happy path. But the AI didn’t anticipate the webhook failure pattern where a non-2xx response from a temporary DB outage blocks Stripe from retrying. It didn’t know that a 60-second TTL on the authorization code after clicking “Allow” was fine, but that the consent page shouldn’t time out while the user is away from the keyboard.

In my own tests of AI content tools—like Canva’s AI Magic Studio and CapCut’s auto-captioning—I see the same pattern. The AI nails the first draft. The headline is snappy, the music syncs, the layout pops. But it misses the subtle brand consistency issues—the wrong logo, a trademark that’s misused, a call-to-action that doesn’t match the landing page. Those are the edge cases that matter when you’re publishing, not drafting.

The gap between “code that passes unit tests” and “code that handles real human behavior with money on the line” is the same as the gap between “AI-generated script” and “video that converts.” The AI can generate the script, but it can’t predict that your audience prefers a slower pacing, or that a certain phrase triggers a platform shadow-ban. The decisions, the tests, and the edge cases someone already paid to discover—those are the real value.

Where the Math Breaks: Double-Counting and Retry Logic

A commenter named Gal Dayan asked a critical question about deduplication: if Stripe retries a webhook, does MCP-Billing dedupe on the event ID before incrementing usage, or does the integrator have to guard against that? Marc’s answer—treat metering as a ledger, not a counter—is the kind of architectural decision that separates a hobby tool from a business tool.

Replace “Stripe webhook retry” with “analytics event from Instagram.” How many times have you looked at your Instagram Insights and seen a spike that didn’t match your content, only to realize that a scheduling tool double-counted the engagement when it retried a failed API call? Or had a UTM tracking service add duplicate conversions because the retry logic wasn’t idempotent? This is the silent failure that costs you accurate data, which leads to bad decisions—doubling down on a format that looks good in the dashboard but didn’t actually work.

The same goes for billing in the creator economy. If you’re using a paid scheduling tool that bills based on active projects or posting volume, you need to trust that their metering doesn’t double-count during retries. MCP-Billing’s open-source metering module is a rare example of making that logic inspectable. Most social media tools treat their usage counters as proprietary secrets.

What I’d Watch / Test Next

MCP-Billing isn’t for social media operators. But the lessons it surfaces are directly applicable to how you should evaluate every tool in your stack.

This week, take one scheduling or analytics tool you rely on and do the following:

  • Audit for silent failures. Check the last 30 posts or analytics events. Are there any gaps that you never noticed? Look at the raw API logs if the tool provides them. If it doesn’t, consider that a red flag.
  • Demand a test mode. Many tools have a sandbox environment for developers, but most don’t provide a “money path” checklist for creators. Ask your tool’s support if they have a way to simulate failures—e.g., what happens when the API returns a 429 or a 500? If they can’t answer, that’s silence.
  • Look for open-source or inspectable components. A tool that publishes its core logic (even partially) is more trustworthy than one that hides everything behind a paywall. Even if you never read the code, the act of publishing is a trust signal.
  • Check the authentication UX. Re-authenticate your accounts manually once. Does the tool handle it gracefully? Does it send a warning? Does it silently fail? If you had to re-authenticate last month and didn’t get a notification, that’s a risk.
  • Consider one-time pricing models. The subscription treadmill for social media tools adds up. A tool that charges a flat fee for the software—and trusts you to inspect the quality—is treating you like a partner, not a revenue stream.

The creator economy is full of tools that look complete and fail silently. MCP-Billing is a reminder that the real work is not the glitzy front-end; it’s the edge cases that don’t throw errors. The next time you pick a scheduling tool, ask the maker for their webhook failure story. If they don’t have one, they probably haven’t found it yet.

Ready to Create Your Own?

Join thousands of brands creating high-performing video ads with FLOWNIB. No editing skills required.

Start Creating for Free