One control panel reaches Chinese and international networks
AiToEarn puts creation, scheduling, publishing, engagement, and paid promotion tasks in one application. Its channel list covers Douyin, Rednote, Kuaishou, Bilibili, WeChat, TikTok, YouTube, Facebook, Instagram, Threads, X, Pinterest, and LinkedIn. That reach is the reason to consider it. A creator working across China and the wider web would otherwise stitch together several dashboards and authorization flows.
The default README is Chinese, while a full English README and a Japanese translation sit beside it. Release v2.5.0, published June 24, 2026, moved Relay settings into the configuration interface and separated social authorization from hosted AI access. The English guide covers the web service, OpenClaw, MCP, Docker, and source development. Some issue discussion still requires translation, but an English-speaking operator can follow the main deployment path.
The 128.8 MB checkout is a platform, not a posting script
Our measured checkout contained 3,397 files and about 332,747 lines of source before dependencies. The repository includes a Next.js web interface, separate NestJS server and AI services, plus an Electron project. Content generation can call outside image and video models, while the browser extension handles actions such as likes, follows, bookmarks, and replies. Each added surface brings another account or policy boundary.
The Docker Compose file starts MongoDB, Redis, S3-compatible RustFS, initialization jobs, both backend services, the frontend, and Nginx. It exposes the application on port 8080 and object storage on port 9000. The deployment guide recommends at least 4 GB of RAM and 20 GB of disk. Those are project requirements, not results from our 3-CPU, 8 GB sandbox.
What happened when we ran it
Our sandbox installed commit 3581f51 in 49 seconds from project/aitoearn-backend/. Pnpm added 1,487 packages, and the installed workspace occupied 986 MB. The run used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node 22, and no secrets. Dependency installation completed without a reported error.
There was no build script or target in the measured backend package, so the harness skipped that step. It found no test script or target either, and skipped tests. The repository scan found 6 CI workflow files, Dockerfiles, workspace configuration, and no tests directory. We therefore have no build time, compiled artifact, test count, or test result to report for commit 3581f51.
The distinction matters because a successful 49-second install proves that pnpm could resolve this dependency graph. It does not prove that the 986 MB workspace compiles, that the services agree on configuration, or that a remote network receives exactly one post. We did not start the Compose stack, connect an account, generate media, or publish from the sandbox.
Self-hosting still depends on credentials outside your server
The shortest documented path is docker compose up -d, followed by a browser visit to port 8080. For normal publishing, the README strongly recommends Server Relay, which uses AiToEarn's hosted social credentials. AI Relay supplies hosted model access. Both paths require an AiToEarn API key tied to either the Chinese or international environment; choosing the wrong environment produces a 401 response.
You can avoid Relay by registering applications with each social platform and supplying your own OAuth credentials. Model providers such as OpenAI, Gemini, and Anthropic also need their own API keys if you do not use AI Relay. That choice trades hosted dependence for credential setup. Either way, a private Docker network does not make the whole publishing chain private.
Public authentication defaults block a casual production launch
Open issue 591, filed September 7, 2026, reports source-controlled fallback values for JWT signing and an internal bearer token. The report says deployments that leave those values unchanged could accept forged manager tokens or calls to internal endpoints. We did not reproduce the attack, so this is a public security report rather than a sandbox finding.
The revision history makes it hard to dismiss as stale. GitHub's comparison shows 4 commits between the reported affected revision and our measured commit 3581f51; they changed 3 README files and added 2 sponsor images. None touched the authentication files named in the report, and the issue remained open on September 28. A production review should replace those defaults, rotate affected tokens, and verify that startup fails when unique secrets are absent.
An agent needs a receipt for every public action
AiToEarn exposes HTTP and SSE MCP endpoints for Claude, Cursor, and other compatible clients. That is useful for drafting or listing connected accounts. Publishing is different. A timeout can leave the agent unsure whether a network accepted the request, so every mutating tool needs a durable remote identifier and a human-readable result before retrying.
Open issue 586 describes that exact failure on TikTok Direct Post: the platform accepts initialization, local persistence fails, and an automatic retry may create a second post. A related fix pull request closed without merge in August, and the issue remained open on September 28. Test ambiguous timeouts against a disposable account before trusting any channel with a campaign.
September activity is healthy, while the release gate is not
GitHub showed 26,518 stars, 18 open issues, and 2 open pull requests on September 28, 2026. The last push was September 18, and a new YouTube authorization bug was filed September 28. That combination points to current use and maintenance. The latest tagged release was v2.5.0 from June 24, so a stale tag alone would give the wrong picture.
AiToEarn earns a trial when its cross-region channel list replaces several tools at once. Start with one disposable account, rotate every supplied secret, disable actions your platform policy forbids, and record the remote result of each publish. Until the project exposes a build and test target that our lab can run, keep that trial outside the path to valuable brand accounts.