# Review and UGC apps with MCP servers: Idukki vs Okendo vs Tolstoy vs EmbedSocial

Idukki, Okendo, Tolstoy and EmbedSocial each run an MCP server for ChatGPT and Claude. How each signs in, what it can read or change, and what to ask first. We make Idukki.

By Rohin Aggarwal · 2026-10-13

You open Claude and type: which products got the most one-star reviews last month? Four review and UGC apps can now answer that from your own data. They differ on who signs in, what the assistant can change and which plan you need.

**Quick answer**

- **Okendo:** three read tools over your published reviews and Q&A. No sign-in. Needs the Reviews Growth plan.
- **Tolstoy:** OAuth 2.1 with PKCE. Its agent creates media, publishes it and tags products.
- **EmbedSocial:** read-only access to posts, UGC, reviews and widget clicks, through your API key.
- **Idukki:** 12 read tools and 3 write tools. Sign in or use a key. Write access is off unless you tick it. We make it.
- Before you connect any of them, check scopes, revocation and the audit log.

## What an MCP server gives a review app

MCP is the Model Context Protocol. It lets an AI assistant call tools in another app. For a review or UGC app, that means Claude or ChatGPT can query your reviews directly. You skip the CSV export.

The four servers here answer different questions. Okendo reads public reviews. EmbedSocial reads your feeds and widget clicks. Tolstoy runs an agent that makes and publishes media. Idukki reads posts, products and sales, and can tag products if you allow it.

## How we compared them

- **Sign-in.** No auth, an API key, or OAuth through the client.
- **Read or write.** Can the assistant change anything in your store?
- **Clients.** Which AI apps the vendor documents.
- **Plan.** The plan the vendor says you need.
- **Data.** What the assistant can see.

Facts come from each vendor's own help page or blog, read 13 October 2026. We make Idukki.

## The four MCP servers side by side

| App | Sign-in | Read or write | Clients documented | Plan | Data |
| --- | --- | --- | --- | --- | --- |
| Idukki (ours) | API key, or OAuth sign-in | 12 read tools, 3 write if allowed | Claude Code, Cursor, Claude Desktop, claude.ai, ChatGPT | No separate plan named | Posts, products, galleries, analytics |
| Okendo | No auth, store-specific URL | Read, 3 tools | ChatGPT, Claude | Reviews Growth plan | Published reviews and Q&A |
| Tolstoy | OAuth 2.1 with PKCE | Read and write | ChatGPT, Claude, Cursor, Codex CLI | Not stated in its guide | Media, products, store and ad analytics |
| EmbedSocial | Connector sign-in, runs on your API key | Read only | Claude, ChatGPT, Claude Code | Not stated on its MCP page | Posts, UGC, reviews, widget clicks, media |

_From each vendor's own docs, read 13 October 2026. Last updated 13 October 2026._

## Okendo MCP: public reviews, three tools

Okendo's server has three tools. The reviews_aggregate tool returns totals, rating spread, averages and recommendation share. The reviews_search tool filters reviews by text, rating, date and media. The questions_list tool returns approved Q&A for a product.

You switch it on under Settings, then Integrations, and copy a store URL. In ChatGPT and Claude you add it as a custom connector with no authentication. That works because the data is public. Okendo says the server only shows published, storefront-visible reviews and Q&A.

It needs an active Okendo Reviews Growth plan and admin access. It cannot read orders or order value.

**Best for:** an Okendo merchant analysing review themes in Claude. **Limits:** read only, reviews only, and anyone with the URL can query public data. See [Idukki vs Okendo](/compare/okendo).

## Tolstoy MCP: an agent that makes and publishes

Tolstoy's connection gives your assistant the Tolstoy agent and your media Library. It signs in with OAuth 2.1 and PKCE, so there is no key to paste. Its guide covers ChatGPT, Claude, Cursor and Codex CLI.

The agent can create and revise images and videos. It publishes media to your store, Meta Ads, Instagram, TikTok and X. It reads store, ad and AI widget analytics, builds AI widgets and tags products on videos.

**Best for:** a team that wants to make and ship video from a chat window. **Limits:** the guide names no read-only mode and no plan. Ask how publishing is approved before you connect. See [Idukki vs Tolstoy](/compare/tolstoy).

## EmbedSocial MCP: read your feeds and widget clicks

EmbedSocial's server is read access to your own account. Name a social account to pull its posts, UGC and reviews. Name a widget to read post, icon, lightbox and CTA clicks. Name a source to fetch media.

You add it in Claude or ChatGPT as a custom connector, then click Connect. EmbedSocial says it works through your API key and sees what you see.

**Best for:** a team reporting on review and social widgets. **Limits:** read only, and its MCP page names no plan. Its pricing page lists the API on Premium. See [Idukki vs EmbedSocial](/compare/embedsocial).

## Idukki MCP: read your sales, write only if you say so (ours)

We make Idukki. Our server has 12 read tools. They cover posts, products, albums, galleries, conversion, engagement, product and post analytics. One tool finds UGC for a product. Another identifies the products shown in a post.

There are three write tools. They tag a product on a post, untag it, or switch a gallery on or off. A read-only key does not see them. Every write attempt goes in the audit log with the key that made it.

You can connect two ways. Claude Code, Cursor and Claude Desktop take an API key starting idk_mcp_. Idukki stores only its hash. The claude.ai and ChatGPT connector screens sign you in with OAuth and PKCE. The consent page names the app, its return address and the business. Write access is a separate box, unticked by default.

A second, public MCP endpoint serves shopping agents. It has five read tools over rights-cleared UGC, reviews and ratings. The [MCP page](/mcp) explains both.

**Best for:** asking an assistant which posts sold, then tagging products from the chat. **Limits:** three write tools only. The protocol version is 2024-11-05.

## What to ask a vendor before you connect an AI assistant

1. **What can it read?** Public reviews only, or orders and analytics too? Ask for the tool list.
2. **Can it write, and is that off by default?** Publishing and tagging should need a separate grant.
3. **Which workspace does it connect?** With several stores, check the sign-in names the right one.
4. **How do I revoke it?** Find the screen that lists connected apps or keys.
5. **Is there an audit log?** You want to see which connection changed what, and when.
6. **Who else can call it?** A server with no auth answers anyone who has the URL.

For the shopper side of the same protocol, read [MCP, tool calls and product feeds](/blog/mcp-tool-calls-product-feeds-the-merchants-guide). For AI engines reading your reviews, see [the best AI visibility tools for reviews and UGC](/blog/best-ai-visibility-tools-for-reviews-and-ugc-2026).

Weighing MCP against feeds, rights and page weight? Our [guide to choosing a UGC platform for AI shopping](/blog/how-to-choose-a-ugc-platform-for-ai-shopping) covers all eight questions.

### Three ways these servers sign you in
_From the four vendors' own docs, read 13 October 2026._

**Open: No auth**
A store URL is the only key.
- ✓ Fastest setup
- ✓ Fine for public data
- ✗ Anyone with the URL can query
- ✗ No per-person revoke

**Key: API key**
Paste a key into the client config.
- ✓ Works in Claude Code and Cursor
- ✓ One key per teammate
- ✗ Keys must be stored safely
- ✗ Not every client takes headers

**Sign-in: OAuth**
Sign in from the connector screen.
- ✓ No key to paste
- ✓ Consent page shows scopes
- ✗ Needs a client that supports it
- ✗ Tied to one workspace per sign-in

**The takeaway:** Pick by what the assistant may change. Read-only is safe to try today; write access deserves a demo first.

### Questions merchants ask

**Q: Does Okendo have an MCP server?**

A: Yes. It has three read tools for published reviews and Q&A. It needs the Okendo Reviews Growth plan.

**Q: Can I connect a Shopify review app to ChatGPT?**

A: Yes. Okendo, EmbedSocial, Tolstoy and Idukki all document ChatGPT. Tolstoy also has a published app there.

**Q: Which UGC MCP servers can make changes?**

A: Tolstoy's agent creates and publishes media. Idukki can tag products and publish galleries, only with write access granted.

**Q: Is it safe to connect an MCP server with no authentication?**

A: For public data, the risk is low. Anyone with the URL can query it, so never use it for private data.

**Q: How do I stop an assistant using my Idukki data?**

A: Revoke the key or the connected app in Settings, AI tools (MCP). It stops on the next request.

### Sources
- [Okendo: connect your MCP server to ChatGPT and Claude](https://support.okendo.io/en/articles/12672009-connect-your-okendo-mcp-server-to-chatgpt-and-claude) — Tools, no-auth setup, scope and Growth plan. Read 13 October 2026.
- [Tolstoy: connect Tolstoy MCP to ChatGPT, Claude and Codex](https://www.gotolstoy.com/blog/connect-tolstoy-mcp-chatgpt-claude-cursor-codex) — OAuth 2.1 with PKCE, clients and agent actions. Read 13 October 2026.
- [EmbedSocial: Claude MCP connector](https://embedsocial.com/docs/api-access/claude-mcp-connector/) — Read access through your API key. Read 13 October 2026.
- [EmbedSocial: MCP in Claude and ChatGPT](https://embedsocial.com/blog/embedsocial-mcp-claude/) — Claude Code setup. Read 13 October 2026.
- [EmbedSocial: pricing](https://embedsocial.com/pricing/) — API listed on Premium. Read 13 October 2026.
- [Idukki: MCP server](/mcp) — Tools, keys, sign-in and the public agent feed MCP.
- [Model Context Protocol](https://modelcontextprotocol.io) — The open protocol these servers use.

---
Canonical: https://idukki.io/blog/review-and-ugc-apps-with-mcp-servers
Tags: mcp, ai-assistants, comparison, okendo, tolstoy, embedsocial, reviews, ugc