Kervly
GitHub Open Cloud
Open source · AGPL-3.0 · built-in MCP server

Your videos, carried to every platform. On time.

A self-hosted scheduler for YouTube Shorts, Instagram Reels and TikTok. Multi-brand, secure by default, free to run on Cloudflare Workers — and your AI agent drives it over MCP.

Start with Kervly Cloud → Self-host for free
✦ no monthly post caps✦ official platform APIs✦ EN / TR dashboard
YouTube Shorts Instagram Reels TikTok MCP · OAuth 2.1 Cloudflare Workers D1 queue AES-256-GCM TOTP 2FA

Kervan is Turkish for caravan.

Kervly carries your videos across every platform, on schedule. Paid schedulers cap your posts per month. Kervly is a small app you own: it talks to the official APIs directly, and you set the limits.

How it works

From prompt to published,
without a browser tab.

01 / ASK

Tell your agent

Claude calls schedule_post over MCP. Or schedule from the dashboard yourself.

02 / QUEUE

Lands in D1

One post per platform. Allowlist, daily limit and duplicate checks run before anything is queued.

03 / CRON

Every five minutes

A cron picks up due posts and claims each one with a conditional update, so nothing posts twice.

04 / STREAM

Straight to the APIs

The .mp4 is streamed from your allowlisted URL — never buffered — to YouTube, Instagram and TikTok.

MCP server

Your agent runs
the content calendar.

Kervly exposes a Streamable HTTP MCP endpoint with OAuth 2.1 and PKCE. Tokens are issued only after you sign in and approve the client — and no tool can change your video allowlist.

list_brands schedule_post list_posts get_post cancel_post retry_post connection_status recent_activity
Explore the tools →
claude · kervly /mcp
you › Post dune-timelapse to all three, tomorrow 18:00
⟡ calling kervly.schedule_post
{
"brand": "studio-north",
"platforms": ["youtube", "instagram", "tiktok"],
"media_url": "https://…/clips/dune.mp4",
"publish_at": "2026-10-15T18:00:00+04:00"
}
✓ created 3 posts · status: scheduled
allowlist ok · daily limit ok · no duplicates
Features

Small app.
Serious machinery.

Everything a multi-brand video team needs, running on Cloudflare's free tier.

Brands

Each brand has its own YouTube, Instagram and TikTok accounts, video allowlist, daily limit and time zone.

Publisher

YouTube resumable uploads, Instagram Reels containers, TikTok Direct Post. Videos are streamed, never buffered.

Dashboard

Brands, account connections, scheduling, a post list with cancel and retry, and an audit log. In English and Turkish.

Tracked to the end

Instagram and TikTok processing is followed until it finishes, and platform tokens refresh before they expire.

Allowlisted media

A brand can only publish .mp4 files under its own allowed prefixes. A compromised client still can't post arbitrary content.

Free on Cloudflare

Workers, D1 and KV on the free tier. Push to main and GitHub Actions redeploys and applies migrations.

The queue, live

Watch the caravan move.

A time-lapse demo of the post list: scheduled, publishing, processing, published.

Posts · studio-north
next cron run in 0:05
dune-timelapse.mp4
YouTube Shortsin 00:03scheduled
dune-timelapse.mp4
Instagram Reelsin 00:04scheduled
dune-timelapse.mp4
TikTokin 00:05scheduled
night-market-tour.mp4
TikTokin 00:14scheduled
caravan-bts-ep3.mp4
YouTube Shortsin 00:22scheduled
Secure by default

Locked down
at every layer.

Single admin, mandatory 2FA, encrypted tokens and least-privilege scopes. No secrets in the repository — CI scans the history with gitleaks.

How Kervly is secured →

Password + mandatory 2FA

PBKDF2-SHA256 and TOTP, per-IP rate limit, codes cannot be reused.

Hardened sessions

__Host- cookie, HttpOnly, Secure, SameSite=Lax, 8 h. Only a hash is stored.

CSRF on every write

X-CSRF-Token header plus an Origin check.

OAuth 2.1 for MCP

PKCE and dynamic client registration. One-hour access tokens.

Encrypted platform tokens

AES-256-GCM in D1, bound to brand and platform. Never returned anywhere.

Least privilege

Upload and publish scopes only — nothing more from any platform.

No double posting

Each post is claimed before processing; finished uploads are never retried.

Strict browser policy

Nonce-based CSP, frame-ancestors none, HSTS, nosniff, no-store.

Why Kervly

Your schedule. Your limits.

TYPICAL PAID SCHEDULER
  • ✕Monthly caps on how many posts you can send
  • ✕Your platform tokens live on someone else's servers
  • ✕Closed source — you trust what you can't read
  • ✕Built for clicking, not for agents
KERVLY
  • ✓You set the daily limit per brand and platform
  • ✓Tokens AES-256-GCM encrypted in your own D1
  • ✓AGPL-3.0 — read it, fork it, self-host it
  • ✓An MCP server is part of the product
Two ways to ride

Run it yourself,
or let us run it.

Self-host

Free · AGPL-3.0

Everything runs on Cloudflare's free tier. Fork the repo, set a few variables, run the Deploy workflow.

# create the resources
npx wrangler d1 create kervly-db
npx wrangler kv namespace create kervly-oauth
npx wrangler kv namespace create kervly-sessions
# then: Actions → Deploy → open /setup
Read the self-hosting guide →

Kervly Cloud

Paid · hosted

The same open-source Kervly, hosted and maintained for you. Connect your accounts and start scheduling in minutes.

  • ✦No Cloudflare or GitHub setup
  • ✦MCP endpoint ready for Claude
  • ✦No Google, Meta or TikTok developer apps to create
  • ✦Updates applied for you
See Cloud plans →

Load the caravan.

Schedule once. Kervly carries it to Shorts, Reels and TikTok — on time, every time.

Start with Kervly Cloud → Star on GitHub