# @mikusnuz/meta-mcp MCP server for Instagram Graph API, Threads API & Meta platform management - **Type:** MCP server - **Trust:** 60/100 (B), scored on the package rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 2.2.0 - **Author:** mikusnuz - **License:** MIT - **npm:** @mikusnuz/meta-mcp - **Source:** https://github.com/mikusnuz/meta-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 60/100 (B), scored on the package rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-13T23:16:20.947Z - **Version scanned:** 2.2.0 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `meta_exchange_token` — Exchange a short-lived token for a long-lived token (valid ~60 days). Requires META_APP_ID and META_APP_SECRET. - `meta_refresh_token` — Extend an Instagram/Facebook user token through the token-exchange flow, or refresh a Threads long-lived token through the Threads refresh endpoint. - `meta_debug_token` — Debug/inspect an access token to check validity, expiration, scopes and associated user. - `meta_get_app_info` — Get Meta App basic information (name, category, namespace, etc.). - `meta_subscribe_webhook` — Subscribe to webhook notifications for an object (e.g., 'instagram', 'page'). Requires META_APP_ID and META_APP_SECRET. - `meta_get_webhook_subscriptions` — List current webhook subscriptions for the Meta App. - `ig_get_comments` — Get comments on a specific Instagram media post. - `ig_get_comment` — Get details of a specific comment. - `ig_post_comment` — Post a top-level comment on a media post. - `ig_get_replies` — Get replies to a specific comment. - `ig_reply_to_comment` — Reply to a specific comment. - `ig_hide_comment` — Hide or unhide a comment on your post. - `ig_delete_comment` — Delete a comment from your media post. This action is irreversible. - `ig_search_hashtag` — Search for a hashtag ID by name. Required before querying hashtag media. Limited to 30 unique hashtags per 7-day rolling window. - `ig_get_hashtag` — Get hashtag information by ID. - `ig_get_hashtag_recent` — Get recent media tagged with a specific hashtag. - `ig_get_hashtag_top` — Get top (most popular) media tagged with a specific hashtag. - `threads_get_post_insights` — Get insights/analytics for a specific Threads post (views, likes, replies, reposts, quotes, clicks). - `threads_get_user_insights` — Get account-level Threads insights (views, likes, replies, reposts, quotes, clicks, followers, follower demographics). - `threads_search_locations` — Search for locations to tag in a Threads post, by query text or by coordinates. Provide q, or latitude+longitude, or both. - `threads_get_location` — Get a Threads location object by ID (from threads_search_locations or a post's location_id field). - `ig_get_media_list` — Get list of media published on the Instagram account. - `ig_get_media` — Get details of a specific Instagram media post. - `ig_delete_media` — Delete an Instagram media post (posts, carousels, reels, stories). This action is irreversible. Requires instagram_manage_contents permission. - `ig_get_media_insights` — Get insights/analytics for a specific media post. Note: 'impressions' and 'video_views' were deprecated in v22.0 — use 'views' instead. Available metrics: views - `ig_toggle_comments` — Enable or disable comments on an Instagram media post. - `threads_get_posts` — Get a list of published Threads posts. - `threads_get_post` — Get details of a specific Threads post. - `threads_get_profile_posts` — Get a public profile's posts by username (Profile Discovery). Requires threads_profile_discovery permission; with standard access, only @meta, @threads, @instag - `threads_search_posts` — Search for public Threads posts by keyword or topic tag via the /keyword_search endpoint. Results can be filtered by media type and author. - `ig_get_mentioned_comments` — Get comments where the account was @mentioned. Returns the media and comment details. - `ig_get_tagged_media` — Get media where the account is tagged (photo tags, not @mentions). - `threads_get_mentions` — Get public Threads posts where the authenticated user has been @mentioned by another profile. Requires threads_manage_mentions permission (without advanced acce - `ig_get_conversations` — Get Instagram DM conversations using Instagram Messaging with Facebook Login. Requires a Page access token, the linked Facebook Page ID, instagram_manage_messag - `ig_get_messages` — Get messages in a specific DM conversation. - `ig_send_message` — Send an Instagram DM using Instagram Messaging with Facebook Login. Requires a Page access token, instagram_manage_messages, and pages_manage_metadata. The reci - `ig_get_message` — Get details of a specific DM message. - `threads_get_oembed` — Get the embed HTML and metadata for a public Threads post, for rendering a rich preview on an external site. No access token required. - `ig_get_profile` — Get Instagram Business/Creator account profile information. - `ig_get_account_insights` — Get Instagram account insights. Note: 'impressions', 'email_contacts', 'phone_call_clicks', 'text_message_clicks', 'get_directions_clicks', 'website_clicks', 'p ## Install **Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for. **Cautions** (coverage gaps and advisories — never blocking) - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"meta\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@mikusnuz/meta-mcp\"\n ],\n \"env\": {\n \"INSTAGRAM_ACCESS_TOKEN\": \"\",\n \"INSTAGRAM_MESSAGING_ACCESS_TOKEN\": \"\",\n \"THREADS_ACCESS_TOKEN\": \"\",\n \"META_APP_SECRET\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `INSTAGRAM_ACCESS_TOKEN` — Instagram Access Token (optional) - `INSTAGRAM_MESSAGING_ACCESS_TOKEN` — Instagram Messaging Access Token (optional) - `THREADS_ACCESS_TOKEN` — Threads Access Token (optional) - `META_APP_SECRET` — Meta App Secret (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 4 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 56, ceiling 56 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40mikusnuz%2Fmeta-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40mikusnuz%2Fmeta-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40mikusnuz%2Fmeta-mcp - HTML page: https://forgeregistry.com/registry/%40mikusnuz%2Fmeta-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.