Postiz vs Swello

Postiz is an open-source, self-hostable social media scheduler. The visible record since March is dominated by urgent security releases — one PSA advisory in June, two GHSA advisories in March, each recommending immediate upgrade — with a single new network (MeWe) as the only integration work in that span. The August release breaks the pattern: provider media uploads now stream rather than buffering whole files in memory, a pending-post workflow guards against duplicate posts, and the MCP server got stability and OAuth fixes.

The project is working on the parts that fail at scale rather than the parts that demo well. Streaming uploads is a worker-memory fix for large media, and duplicate-post protection addresses the failure mode that actually costs a scheduling tool its users' trust. That an MCP server exists and is being maintained puts Postiz on the agent-accessible path, but this release treats it as infrastructure to harden, not a surface to expand. The six-week gap between releases suggests a small maintainer group prioritizing correctness over cadence.

Given that MCP OAuth is being fixed rather than built out, the next visible step is likely more provider integrations or a stable MCP release once the auth path settles. The security-release cadence makes another advisory-driven patch equally plausible.