# com.jojapi/instagram Instagram: Instagram public data scraper API for search, users, posts, hashtags, locations and more. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** com.jojapi - **License:** Unknown - **Endpoints:** streamable-http https://mcp.jojapi.com/instagram - **Source:** https://jojapi.com/hub/api/instagram - **Endpoint health:** reachable (last checked 2026-10-02T06:13:57.452Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-10-02T06:13:57.452Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 22 declared. Observed from a live `tools/list` probe. - `get_user_details_by_username` — User Details (by username) Group: User. Billing per call: 1 Credits. - `get_user_posts_by_username` — User Posts (by username) Group: User. Billing per call: 1 Credits. - `get_user_stories_by_username` — User Stories (by username) Group: User. Billing per call: 1 Credits. - `get_v3_user_details_by_username` — User Details By Username Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v3_user_stories` — User Stories Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v3_1_user_details_by_username` — User Details by Username (more detailed) Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v3_user_details_by_id` — User Details by ID Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v4_highlight_stories` — v4 / highlight-stories Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_post_details_by_shortcode` — v2 / Post Details by Shortcode Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_user_following_hashtags` — v2 / User Following Hashtags Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_user_tagged_posts` — v2 / User Tagged Posts Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_user_posts` — v2 / User Posts Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v4_user_highlights` — v4 / user-highlights Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v4_user_stories` — v4 / user-stories Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v4_1_user_posts` — v4.1 / user-posts Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v4_user_posts` — v4 / user-posts Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v4_user_details_by_username` — v4 / user-details-by-username Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_user_details_by_id` — v2 / User Details by ID Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_user_details_by_username` — v2 / User Details by Username Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_search` — v2 / Search Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_location_posts` — v2 / Location Posts Group: Deprecated Endpoints. Billing per call: 1 Credits. - `get_v2_tag_posts` — v2 / Tag Posts Group: Deprecated Endpoints. Billing per call: 1 Credits. ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"instagram\": {\n \"type\": \"http\",\n \"url\": \"https://mcp.jojapi.com/instagram\"\n }\n }\n}" ``` ## Blast radius Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on someone else's infrastructure; read-only tool surface. - Floor 9, ceiling 27 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.jojapi%2Finstagram - Install plan: https://forgeregistry.com/api/v1/packages/com.jojapi%2Finstagram/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.jojapi%2Finstagram - HTML page: https://forgeregistry.com/registry/com.jojapi%2Finstagram - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.