Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/HasData/tiktok-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/hasdata/tiktok-mcp/hasdata-tiktok)<a href="https://agentmods.dev/rules/hasdata/tiktok-mcp/hasdata-tiktok"><img src="https://agentmods.dev/badge/rules/hasdata/tiktok-mcp/hasdata-tiktok/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/hasdata/tiktok-mcp/hasdata-tiktok"><img src="https://agentmods.dev/badge/rules/hasdata/tiktok-mcp/hasdata-tiktok.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00765 |
| Opus 5.5 | $0.00008 | $0.00306 |
| Sonnet 5.5 | $0.00004 | $0.00153 |
| Haiku 4.5 | $0.00002 | $0.00076 |
Grade A, and why
hasdata-tiktok scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 43 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TikTok through HasData
Four tools. hasdata_tiktok_profile_getTikTokProfile and hasdata_tiktok_posts_getTikTokPosts take a handle, hasdata_tiktok_search_getTikTokSearch takes a keyword, and hasdata_tiktok_comments_getTikTokComments takes a videoId.
type on the search chooses between video and user, so the same keyword answers two different questions depending on which one you send.
A handle that does not exist looks like a success
The call returns 200, requestMetadata.status reads ok, and the payload carries an error string with no profile or posts key. Nothing else marks it. Test for the object you came for before reading fields, or an account that does not exist is reported as an account with nothing to say.
A malformed handle is the other case and it fails the schema with a 422 on handle, so the two failures need different messages.
Engagement is on the post, not the profile
A post carries likes, comments, shares, plays, reposts and collects, alongside description, createTime, duration, width, height and an author block. The profile carries the account totals as followers, follows, friends, likes and videos.
createTime is an ISO timestamp on posts and comments, so recency is answerable directly rather than by inference.
Optional fields follow the account, not the endpoint
hashtags and mentions are present only on videos that carry them, and the rate swings with the account rather than with the tool. Sampled feeds ran from no tagged posts at all to every post tagged, so a single account tells you nothing about the next one and an absent array means this account does not tag rather than that the field is missing. Parse the description when you need tags the account wrote inline.
The media URLs are optional too. playUrl, downloadUrl, dynamicCoverUrl and ratio are missing on some videos while coverUrl is there throughout, so test the key rather than assuming a video is playable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +6 lines ac8b2da687e9
- 23d ago First seen · 37 lines · 20 tokens per session scan A 6d1bc311e18a
hasdata-tiktok is a cursor rule published in the GitHub repository HasData/tiktok-mcp (10 stars, last pushed 3d ago), licensed MIT. It adds 20 tokens to every session and 765 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-23.
Other cursor rules, from other repositories
hasdata-zillow
How to pull Zillow listings and property details through the HasData MCP server.
hasdata-airbnb
How to pull Airbnb stays and listing details through the HasData MCP server.
hasdata-google-maps
How to pull Google Maps places, reviews, photos and posts through the HasData MCP server.
hasdata-instagram
How to pull public Instagram profiles and post feeds through the HasData MCP server.
hasdata-booking
How to pull Booking.com hotel search and property details through the HasData MCP server.
cursor-rules
This project uses pyobfus (the Python obfuscator). The canonical agent protocol is AGENTS.md at the project root, which Cursor reads natively. Copy AGENTS.md into your repo; keep this .mdc only for Cursor-scoped glob targeting.