Local-first TypeScript MCP server for the Meta Graph API that lets an MCP client publish, read and moderate Facebook Pages through your own Meta developer app, with least-privilege tokens, plan-and-apply write safety and no telemetry.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
FB_SYSTEM_TOKENAPI keyoptionalSystem-user access token (Business Manager). Takes precedence over FB_ACCESS_TOKEN and FB_PAGE_TOKEN when several are set.
FB_ACCESS_TOKENAPI keyoptionalPrimary user access token. At least one of FB_SYSTEM_TOKEN, FB_ACCESS_TOKEN or FB_PAGE_TOKEN must be set.
FB_PAGE_TOKENAPI keyoptionalLong-lived Page access token used as a fallback credential when no user or system-user token is configured.
FB_APP_SECRETAPI keyoptionalMeta app secret. When set, appsecret_proof is attached to every call so a stolen bare token cannot be used on its own.
FB_CONFIRM_TOKENAPI keyoptionalOperator confirmation token for out-of-band approval of irreversible or spend actions. The server prompts through MCP elicitation where the client supports it; otherwise the caller passes this value…
FB_HTTP_TOKENAPI keyoptionalBearer token guarding the HTTP transport; required when FB_TRANSPORT=http (the server refuses to start without it).
Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
facebook_list_campaignsList campaigns under one ad account, a cursor page at a time. Each recordList campaigns under one ad account, a cursor page at a time. Each record
No input schema was published for this tool.
facebook_list_adsetsList ad sets under one ad account, a cursor page at a time. Ad sets areList ad sets under one ad account, a cursor page at a time. Ad sets are
No input schema was published for this tool.
facebook_list_adsList individual ads under one ad account, a cursor page at a time. This isList individual ads under one ad account, a cursor page at a time. This is
No input schema was published for this tool.
facebook_get_ad_objectRead one campaign, ad set or ad by id. Pass `level` when you know it — theRead one campaign, ad set or ad by id. Pass `level` when you know it — the
No input schema was published for this tool.
facebook_ads_insightsRead performance numbers (impressions, clicks, spend, reach, cpc, ctr) forRead performance numbers (impressions, clicks, spend, reach, cpc, ctr) for
No input schema was published for this tool.
facebook_ads_report_statusProbe one async insights report run and, with fetch_results:true, read itsProbe one async insights report run and, with fetch_results:true, read its
No input schema was published for this tool.
facebook_update_ad_objectPause or resume an ads object, or change its budget. Plan-first: withoutPause or resume an ads object, or change its budget. Plan-first: without
No input schema was published for this tool.
adsMarketing API access: campaign / ad-set / ad listings with delivery truth,Marketing API access: campaign / ad-set / ad listings with delivery truth,
No input schema was published for this tool.
facebook_whoamiReport the identity behind the configured token (type, validity, grantedReport the identity behind the configured token (type, validity, granted
No input schema was published for this tool.
facebook_list_pagesList the Facebook Pages the operator administers (via /me/accounts): id,List the Facebook Pages the operator administers (via /me/accounts): id,
No input schema was published for this tool.
facebook_get_pageFetch metadata for one Page — name, category, follower/fan counts,Fetch metadata for one Page — name, category, follower/fan counts,
No input schema was published for this tool.
facebook_usageReport the most recent Graph rate-limit signals (X-App-Usage,Report the most recent Graph rate-limit signals (X-App-Usage,
No input schema was published for this tool.
coreAlways-on identity, Page discovery and rate-limit diagnostics (read-only).Always-on identity, Page discovery and rate-limit diagnostics (read-only).
No input schema was published for this tool.
facebook_page_insightsRead Graph insights for one Page in a compact flat shape: one row perRead Graph insights for one Page in a compact flat shape: one row per
No input schema was published for this tool.
facebook_post_insightsRead Graph insights for one published post (post_media_view, post_clicks,Read Graph insights for one published post (post_media_view, post_clicks,
No input schema was published for this tool.
facebook_reel_insightsRead Graph insights for one Reel from /{video-id}/video_insights — theRead Graph insights for one Reel from /{video-id}/video_insights — the
No input schema was published for this tool.
insightsPage, post and Reel insights: compact reshaped metric series, aggregatePage, post and Reel insights: compact reshaped metric series, aggregate
No input schema was published for this tool.
messagesMessenger conversations for a Page: poll the inbox, read a thread (untrustedMessenger conversations for a Page: poll the inbox, read a thread (untrusted
No input schema was published for this tool.
facebook_list_commentsList the comments on a post, photo, video or another comment, newest-firstList the comments on a post, photo, video or another comment, newest-first
No input schema was published for this tool.
facebook_get_commentRead one comment by ID, optionally with its replies, and report whether aRead one comment by ID, optionally with its replies, and report whether a
No input schema was published for this tool.
facebook_reply_to_commentPost a PUBLIC reply under a comment — visible to everyone who can see thePost a PUBLIC reply under a comment — visible to everyone who can see the
No input schema was published for this tool.
facebook_hide_commentHide or unhide up to 50 comments in one call (`hidden:true` hides,Hide or unhide up to 50 comments in one call (`hidden:true` hides,
No input schema was published for this tool.
facebook_delete_commentprivilegedPERMANENTLY delete up to 50 comments. This cannot be undone — preferPERMANENTLY delete up to 50 comments. This cannot be undone — prefer
No input schema was published for this tool.
facebook_private_replySend a private message to the author of a comment. TWO hard limits, bothSend a private message to the author of a comment. TWO hard limits, both
No input schema was published for this tool.
moderationRead and moderate comments on Page content (list, reply, hide, delete,Read and moderate comments on Page content (list, reply, hide, delete,
No input schema was published for this tool.
facebook_create_postCreate a Page post: plain text, a link, a multi-link card carousel, or aCreate a Page post: plain text, a link, a multi-link card carousel, or a
No input schema was published for this tool.
facebook_create_photo_postPublish ONE photo to a Page, optionally with a caption, as a draft, orPublish ONE photo to a Page, optionally with a caption, as a draft, or
No input schema was published for this tool.
facebook_create_video_postUpload a video to a Page. A local path inside FB_MEDIA_DIR is streamedUpload a video to a Page. A local path inside FB_MEDIA_DIR is streamed
No input schema was published for this tool.
facebook_create_reelPublish a Facebook Reel through the three-phase upload (start → transferPublish a Facebook Reel through the three-phase upload (start → transfer
No input schema was published for this tool.
facebook_update_postEdit a Page post the app itself created, or move it through the scheduled-postEdit a Page post the app itself created, or move it through the scheduled-post
No input schema was published for this tool.
facebook_delete_postprivilegedPermanently delete a Page post the app itself created — including aPermanently delete a Page post the app itself created — including a
No input schema was published for this tool.
facebook_list_scheduled_postsList the Page posts that are queued to publish later, each with its publishList the Page posts that are queued to publish later, each with its publish
No input schema was published for this tool.
facebook_get_video_statusPoll where one video stands in Meta's pipeline: uploading, processing,Poll where one video stands in Meta's pipeline: uploading, processing,
No input schema was published for this tool.
postsPublish, schedule, edit and delete Page posts, photos, videos and ReelsPublish, schedule, edit and delete Page posts, photos, videos and Reels
No input schema was published for this tool.
facebook_list_postsList a Page's posts, one cursor page at a time. `edge` selects WHICH posts:List a Page's posts, one cursor page at a time. `edge` selects WHICH posts:
No input schema was published for this tool.
facebook_get_postFetch ONE post by its composite id ("{page-id}_{post-id}" as returned byFetch ONE post by its composite id ("{page-id}_{post-id}" as returned by
No input schema was published for this tool.
facebook_list_reelsList a Page's Reels via the /video_reels edge — the ONLY place Reels areList a Page's Reels via the /video_reels edge — the ONLY place Reels are
No input schema was published for this tool.
facebook_get_reactionsRead the reactions on one post: a `totals` map per reaction typeRead the reactions on one post: a `totals` map per reaction type
No input schema was published for this tool.
readerRead-only access to a Page's own content: posts (four edges), single posts,Read-only access to a Page's own content: posts (four edges), single posts,
No input schema was published for this tool.
39 of 39 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Local-first TypeScript MCP server for the Meta Graph API that lets an MCP client publish, read and moderate Facebook Pages through your own Meta developer app, with least-privilege tokens, plan-and-apply write safety and no telemetry.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
55 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+43 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.