# @ivanbaev/facebook-mcp Local-first TypeScript MCP server for the Meta Graph API that lets an MCP client publish, read and moderate Facebook Pages through your own Meta developer app, with least-privilege tokens, plan-and-apply write safety and no telemetry. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.7.0 - **Author:** Ivan Baev - **License:** MIT - **npm:** @ivanbaev/facebook-mcp - **Source:** https://github.com/IvanBBaev/facebook-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 3 days ## Security scan - **Status:** clean - **Scanned:** 2026-08-30T12:50:44.182Z - **Version scanned:** 0.7.0 - **CVEs:** none found by OSV at scan time ## Tools 39 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `facebook_list_campaigns` — List campaigns under one ad account, a cursor page at a time. Each record - `facebook_list_adsets` — List ad sets under one ad account, a cursor page at a time. Ad sets are - `facebook_list_ads` — List individual ads under one ad account, a cursor page at a time. This is - `facebook_get_ad_object` — Read one campaign, ad set or ad by id. Pass `level` when you know it — the - `facebook_ads_insights` — Read performance numbers (impressions, clicks, spend, reach, cpc, ctr) for - `facebook_ads_report_status` — Probe one async insights report run and, with fetch_results:true, read its - `facebook_update_ad_object` — Pause or resume an ads object, or change its budget. Plan-first: without - `ads` — Marketing API access: campaign / ad-set / ad listings with delivery truth, - `facebook_whoami` — Report the identity behind the configured token (type, validity, granted - `facebook_list_pages` — List the Facebook Pages the operator administers (via /me/accounts): id, - `facebook_get_page` — Fetch metadata for one Page — name, category, follower/fan counts, - `facebook_usage` — Report the most recent Graph rate-limit signals (X-App-Usage, - `core` — Always-on identity, Page discovery and rate-limit diagnostics (read-only). - `facebook_page_insights` — Read Graph insights for one Page in a compact flat shape: one row per - `facebook_post_insights` — Read Graph insights for one published post (post_media_view, post_clicks, - `facebook_reel_insights` — Read Graph insights for one Reel from /{video-id}/video_insights — the - `insights` — Page, post and Reel insights: compact reshaped metric series, aggregate - `messages` — Messenger conversations for a Page: poll the inbox, read a thread (untrusted - `facebook_list_comments` — List the comments on a post, photo, video or another comment, newest-first - `facebook_get_comment` — Read one comment by ID, optionally with its replies, and report whether a - `facebook_reply_to_comment` — Post a PUBLIC reply under a comment — visible to everyone who can see the - `facebook_hide_comment` — Hide or unhide up to 50 comments in one call (`hidden:true` hides, - `facebook_delete_comment` — PERMANENTLY delete up to 50 comments. This cannot be undone — prefer - `facebook_private_reply` — Send a private message to the author of a comment. TWO hard limits, both - `moderation` — Read and moderate comments on Page content (list, reply, hide, delete, - `facebook_create_post` — Create a Page post: plain text, a link, a multi-link card carousel, or a - `facebook_create_photo_post` — Publish ONE photo to a Page, optionally with a caption, as a draft, or - `facebook_create_video_post` — Upload a video to a Page. A local path inside FB_MEDIA_DIR is streamed - `facebook_create_reel` — Publish a Facebook Reel through the three-phase upload (start → transfer - `facebook_update_post` — Edit a Page post the app itself created, or move it through the scheduled-post - `facebook_delete_post` — Permanently delete a Page post the app itself created — including a - `facebook_list_scheduled_posts` — List the Page posts that are queued to publish later, each with its publish - `facebook_get_video_status` — Poll where one video stands in Meta's pipeline: uploading, processing, - `posts` — Publish, schedule, edit and delete Page posts, photos, videos and Reels - `facebook_list_posts` — List a Page's posts, one cursor page at a time. `edge` selects WHICH posts: - `facebook_get_post` — Fetch ONE post by its composite id ("{page-id}_{post-id}" as returned by - `facebook_list_reels` — List a Page's Reels via the /video_reels edge — the ONLY place Reels are - `facebook_get_reactions` — Read the reactions on one post: a `totals` map per reaction type - `reader` — Read-only access to a Page's own content: posts (four edges), single posts, ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"facebook\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@ivanbaev/facebook-mcp\"\n ],\n \"env\": {\n \"FB_SYSTEM_TOKEN\": \"\",\n \"FB_ACCESS_TOKEN\": \"\",\n \"FB_PAGE_TOKEN\": \"\",\n \"FB_APP_SECRET\": \"\",\n \"FB_CONFIRM_TOKEN\": \"\",\n \"FB_HTTP_TOKEN\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `FB_SYSTEM_TOKEN` — Fb System Token (optional) - `FB_ACCESS_TOKEN` — Fb Access Token (optional) - `FB_PAGE_TOKEN` — Fb Page Token (optional) - `FB_APP_SECRET` — Fb App Secret (optional) - `FB_CONFIRM_TOKEN` — Fb Confirm Token (optional) - `FB_HTTP_TOKEN` — Fb Http Token (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 6 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 56, ceiling 56 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40ivanbaev%2Ffacebook-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40ivanbaev%2Ffacebook-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40ivanbaev%2Ffacebook-mcp - HTML page: https://forgeregistry.com/registry/%40ivanbaev%2Ffacebook-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.