<- all tokdocs
2026.09.25@kevbuildsapps

The package in this clip is real, but "npm install social-sdk" installs nothing and the scheduling it promises only works on YouTube

Coding
Watch on TikTok

View on TikTok ->

A 27-second vertical video at 720x1280, uploaded 2026-09-25 by @kevbuildsapps (channel name kevbuildsapps), carrying 21,700 views, 947 likes, 162 comments, 287 reposts and 1,337 saves at capture, over an "original sound" track credited to kevbuildsapps. I read all 14 frames at 2-second intervals against a 91-word Whisper transcript. The visuals are a talking-head lower half with an animated upper card: a pixel-art owl under a "TARGET LOCK" reticle, then the Hootsuite owl logo hit by a red laser, then a green "OPEN SOURCE" plate with a GitHub mark, a "SOCIAL SDK" title card over a Kramer reaction GIF, a fake terminal reading $ agent.load(social-sdk) and > spinning account, an "UNLIMITED / ACCOUNTS + POSTS" card above a scrolling strip of TikTok, X, LinkedIn, YouTube, Facebook, GitHub and Instagram icons, a "SCHEDULE IT / DIRECT FROM THE AGENT" card, a "BUILD YOUR OWN / THEIR MOAT IS GONE" card showing the Sprout Social and Hootsuite logos, and a closing "COMMENT SOCIAL" card. No real install command, package name, repo URL or working code appears in any frame. The only code shown is agent.load(social-sdk), which is not valid syntax in any package manager or agent framework.

The tool exists, but the name in the clip resolves to a dead package

There is a real project behind this. It is opencoredev/social-sdk, MIT licensed, created 2026-09-08, sitting at 312 stars and 21 forks, with its documentation at social-sdk.dev. It describes itself as a "Typed TypeScript SDK for direct and managed social platform integrations, with capability checks, explicit outcomes, and deterministic testing."

The install command is not what the clip implies. The README gives it as:

npm install @opencoredev/social-sdk

The unscoped name is a trap. Querying the npm registry for social-sdk returns a document with zero versions and an unpublished record: version 0.0.1 was published 2020-03-02 and unpublished 2020-03-03. The npm downloads API for that name returns {"error":"package social-sdk not found"}. Anyone who takes step 1 of the description literally and runs npm install social-sdk gets an error, not an SDK.

The near-miss is worse. socialsdk without the hyphen is a real published package at v1.0.3, but it is an unrelated React component library from April 2024 by maintainer eligrayy under The-UX-Company, providing a LogInBox, ProfileComponent and FeedComponent for building a social network. It has 22 downloads in the month ending 2026-09-26 and has nothing to do with scheduling. A viewer typing the name they heard has two ways to land somewhere wrong and one way to land nowhere.

The genuine package, @opencoredev/social-sdk, first published 0.1.0 on 2026-09-22 and reached 0.5.0 on 2026-09-24, eight versions in three days. It recorded 2,194 downloads in the week ending 2026-09-26, and the same 2,194 for the month, which confirms the package did not exist before that week.

The scheduling claim is wrong on six of the seven platforms

This is the clip's central promise. The transcript says:

You can now give this package to your agent and spin up unlimited amount of social accounts and posts and schedule directly with this tool.

The description repeats it as step 3: "Schedule direct posts without a third-party tool." An on-screen card reads "SCHEDULE IT / DIRECT FROM THE AGENT" above icons for X, LinkedIn, YouTube, Facebook, GitHub and Instagram.

The SDK's own capability matrix contradicts this. The posts.schedule operation is marked available on YouTube only, requiring the https://www.googleapis.com/auth/youtube.upload scope. It is marked unsupported-by-platform on Bluesky, Threads, TikTok, Instagram and LinkedIn, and not-implemented-by-adapter on X. Pull request #41, merged 2026-09-24 at 16:29 UTC, is the commit that added YouTube schedule cancellation and wrote those platform-limit declarations into the codebase. It was merged the day before this video went up.

So the one capability the video is named around works on exactly one of the platforms whose logos it shows. The docs also warn that an availability marker is not a guarantee: "An available declaration describes an implemented route. It does not certify credentials, product approval, account eligibility or a successful live request."

"Spin up unlimited social accounts" describes something the SDK does not do

The "UNLIMITED / ACCOUNTS + POSTS" card and the fake terminal line > spinning account suggest the SDK provisions accounts. It does not. The accounts concept doc defines a connected account as "a platform identity a backend can act as" and instructs developers to "List accounts from the configured backend instead of constructing identities from user input." It is explicit about the ceiling: "Direct adapters return the single account their credentials are configured for, after checking that the platform reports the same identity."

One credential set, one account. Scaling to many accounts means many OAuth connections, each separately authorized by a real account holder. Nothing in the SDK creates a social media account, and no software can, because account creation is gated by platform signup, phone verification and terms of service.

What a viewer following these steps actually has to do

The clip's five-step description ends at "Deploy it fast, no monthly fees." The real prerequisites are substantial and none are mentioned.

Start with the runtime. The package declares engines: {"node": ">=22.12"} and the README states it "runs in trusted server-side code on Node.js 22.12+ or Bun," with a warning to "Keep platform tokens, managed-provider keys, OAuth client secrets, and webhook secrets out of browser bundles." This is server infrastructure, which is not free and is not a browser project an agent one-shots.

Then platform access. The TikTok adapter doc requires an existing access token, a creator openId, TikTok Login Kit OAuth with user.info.basic and video.publish scopes, verified PULL_FROM_URL media origins registered with TikTok, and a creator consent preview step before every publish. TikTok's own Content Posting API guide adds the constraint that decides whether the project is useful at all: "All content posted by unaudited clients will be restricted to private viewing mode." Until TikTok audits your app, every post your agent publishes is invisible to the public. That audit is a review process with a queue, not a config flag.

The cost claim deserves the same scrutiny. The installation doc notes that "A managed integration uses the developer's own provider account and may create provider charges." Skipping a Hootsuite subscription means paying for a server, an OAuth app per platform, and possibly a managed backend instead.

The irony the clip misses: it routes through schedulers rather than replacing them

The "BUILD YOUR OWN / THEIR MOAT IS GONE" card frames this as the end of Sprout Social and Hootsuite. The SDK's own architecture says otherwise. The README lists "Optional managed backends for Zernio, Post for Me, PostFast, and Postiz." Postiz is itself an open-source social media scheduler, and the Postiz backend adapter plus a sponsor tagline commit dated 2026-09-26 show it is both an integration target and a sponsor of the project.

Social SDK is a typed client layer that can sit in front of a scheduler. It is not a scheduler that replaces one.

The transcript beats the graphics on the one biographical claim

Two claims about the author appear in the clip and they disagree with each other. The Whisper transcript and burned-in caption say "15," while the B-roll card in frame 4 reads "13 YEARS OLD."

because some 15 year old kid just released the open source alternative called Social SDK

The transcript is the correct one. The repository's dominant contributor is leoisadev1 with 168 commits, listed name "Leo," company Mastra, blog leodev.cv. That personal site states directly: "I'm Leo, a 15-year-old founder & developer in Florida." The video's own animated graphic is wrong by two years against its own voiceover.

The opening line, "So Claude just killed social media scheduling tools," is closer to literal truth than it sounds. The commit history carries Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> trailers on most feature commits from 2026-09-24 through 2026-09-26, including the LinkedIn media, X replies, Bluesky OAuth and scheduling commits. The SDK was written with Claude. It did not kill anything.

The billion-dollar figure is half right

The transcript claims Hootsuite and Sprout Social are "both worth over a billion dollars." One of those checks out and one does not.

Sprout Social is publicly traded as NASDAQ: SPT, so the number is observable. Stock Analysis shows a share price of $9.54 as of 2026-09-25, the day this video was posted, and a market capitalization of $578.05 million, down 29.7% from a prior period. That is roughly half the claimed figure, on the exact day of the claim.

Hootsuite is private and harder to pin down. Forge Global's Hootsuite page carries a $1.00B valuation against $284M raised across 10 rounds, with the most recent round reported at $16.8M in March 2023. That is a secondary-market reference mark rather than a priced primary round or an audited figure, so it supports the claim loosely at best.

Key Takeaways

  • The real package is @opencoredev/social-sdk, not social-sdk. Install with npm install @opencoredev/social-sdk or bun add @opencoredev/social-sdk.
  • npm install social-sdk fails. That registry name holds version 0.0.1 published 2020-03-02 and unpublished 2020-03-03, with zero installable versions as of 2026-09-27.
  • Scheduling, the clip's headline feature, is available on YouTube only. The capability matrix marks posts.schedule as unsupported-by-platform for Bluesky, Threads, TikTok, Instagram and LinkedIn, and not-implemented-by-adapter for X. PR #41 established those declarations on 2026-09-24.
  • The project is one day older than the video's framing suggests it is battle-tested. First npm publish was 0.1.0 on 2026-09-22, latest 0.5.0 on 2026-09-24, 2,194 total downloads through 2026-09-26.
  • "Unlimited social accounts" is wrong in both directions. The SDK connects existing accounts via OAuth and a direct adapter returns exactly one account per credential set. It creates no accounts.
  • The 15-year-old author claim is accurate and sourced to leodev.cv. The clip's own "13 YEARS OLD" graphic contradicts its own caption.
  • Sprout Social's market cap was $578.05M on 2026-09-25, not over a billion. Hootsuite carries a $1.00B secondary-market mark on Forge Global.
  • TikTok publishing is gated behind an app audit. Unaudited clients have all posted content restricted to private viewing, which makes an unaudited agent-driven poster useless for reach.
  • Social SDK ships a Postiz adapter and names Postiz a sponsor, so it interoperates with open-source schedulers rather than obsoleting the category.
  • The repo genuinely was built with Claude. Feature commits from 2026-09-24 onward carry Co-Authored-By: Claude Opus 5.5 trailers.
  • Unverified: Hootsuite's $1.00B figure came from a search result snippet because forgeglobal.com returned HTTP 403 to a direct fetch, and a secondary-market mark is not an audited valuation. TikTok publishes no daily post quota or rate limit in its Content Posting API getting-started guide, so the practical throughput ceiling is unknown. I could not determine how much of the 168-commit contribution history is human-written versus agent-generated, since bot accounts (usehoplite, tembo, devin-ai-integration) also appear in the contributor list alongside the Claude co-author trailers. I could not test whether commenting "Social" actually returns the repository link, since that requires interacting with the creator's account.

Resources

Published September 25, 2026. Writeup generated from a favorited TikTok.