Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
Sales, Marketing & Customer Experience Top 100 / #–ARD = Agentic Resource Discovery · A2A = Agent2Agent · MCP = Model Context Protocol
api · api

AutoPoster AI Agent API

REST API and agent tools for autonomous AI agents to schedule, publish, and manage cross-platform social media campaigns with platform validation and rate limits. Publisher: autoposter.ai.

Trust profileas of 2026-10-26
Publisherconfirmed · Vendor-domain page, marketplace listing or metadata at publisher domain — ARD or A2A metadata served at the publisher's own domainconfirmed
Complianceno evidence about this agent · 2 vendor-level records (inherited)T5
SecurityNo CVE linked to this agent in the CVE registry — none linked in the products checked, not a findingnone
ProtocolsModel Context Protocol (MCP) not checkedAgent2Agent (A2A) not checkedAgentic Resource Discovery (ARD) verified at the publisher's endpoint1 / 3
Traces1 public trace · best: reproducible runT1
Issues found0 regulator actions · 0 incidents · 0 withdrawn certificates · CVEs: see Securitylinks only

Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe autoposter.ai, not this agent specifically.

Traces — under attack, in defence, in incidents

1 public · what a trace is
◎
registry probe
T1 reproducible run · unreviewed
Fetch and validate the ARD manifest, A2A agent card and MCP server card at the publisher's well-known paths
Observed: ARD verified · egress: no
AgentDossier refresh
2026-10-11

● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.

CVEs — on the official record

none linked · the registry

No CVE in the registry names this agent or its listed product. That reads "none linked in the products checked", never as a finding: a product that is not on the registry's list, or a record that names it differently, is not seen. The vendor's own advisories remain the source of truth.

Compliance evidence

Jurisdiction: EU · 6 frameworks shown
–
SOC 2
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
ISO 27701
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
ISO 42001
T5 Unknown
Nothing found in the sources checked.
Scope: — · registries, marketplaces, vendor pages
ask the vendor
–
CSA STAR
T5 Unknown
Nothing found in the sources checked.
Scope: — · CSA STAR Registry
ask the vendor

"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.

About the vendor — inherited, not agent-specific

2 records matched at organisation level
○
GDPR
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02
○
PCI DSS
T4 Vendor-claimed · vendor-level
Vendor-claimed
Scope: entity · vendor page · 2026-10-26
re-check 2026-11-02

A vendor-level registry entry proves the organisation was assessed; whether this agent is inside that scope is a question for the vendor. These rows do not count toward the agent's evidence tier.

✔ found · ○ claimed · – not found · ⚠ expired, stale or revoked. Every row links to its source.Dispute or correct this dossier

GDPR, assembled from checks

GDPR● 0 found in registries or documents○ 1 vendor-claimed⚠ 0 issues linkedas of 2026-10-26
○ ClaimedVendor-claimed (vendor page, 2026-10-26).
– Not foundNo Article 42 GDPR seal. "GDPR certified" is never shown without one.
☐ You checkYour lawful basis, DPIA, and whether this agent is inside the certificate scope.

News and chatter

last 90 days · linked with confidence ≥ 0.85

Nothing linked from Hacker News, GDELT, GitHub releases or the vendor's feed in the last 90 days.

Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.

Sales, Marketing & Customer Experience score

31
commercial profile · sar-score-2.0 · unranked
Adoption / usageunknown
Trust & security20 / 25
Project / product healthunknown
Ecosystem / interoperability5 / 15
Domain expertise / fit34 / 100
Governance / compliance evidence3 / 100
Docs / transparency10 / 10

Raw component / maximum, then weighted by the commercial profile (adoption 25, trust 20, project 15, ecosystem 15, domain 15, governance 5, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.

Before you deploy

Derived from the evidence ledger. This agent is not yet in the reference set, so deployment questions (credentials, approval, data handling) are not answered here — ask the vendor.

Evidence supporting this use (2)
GDPR — vendor-claimed, vendor-level source
PCI DSS — vendor-claimed, vendor-level source
Unknowns to check (3)
Your lawful basis and DPIA for the personal data the agent will process
The transfer mechanism you will rely on; DPF covers EU-to-US transfers only
Ask the vendor for SOC 2, ISO 27701, ISO 42001, CSA STAR evidence; none was found in the sources checked
Suggested restrictions for a pilot (1)
Ask for the SOC 2 report under NDA before the pilot touches customer data; none was found in the sources checked.

Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.

Provenance

ardARD entry, identity
vendor pageclaims
NVDsecurity (CVE keyword search)
Hacker News, GDELT, vendor feedsnews and chatter
First seen2026-10-26
Recordres_83e66a7b82df70cb
Open the full record (JSON) →