Community source release (MIT). Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

Threads MCP by Nabux

Multi-user, multi-account MCP gateway powered by Meta's official Threads API.

• Production target: https://threads.nabuxai.com

• MCP: https://threads.nabuxai.com/mcp

• OAuth callback: https://threads.nabuxai.com/threads/callback

Capabilities

• Connect multiple Threads accounts with Meta OAuth.

• Encrypt long-lived Threads tokens at rest and refresh them automatically.

• OAuth 2.1 + PKCE for ChatGPT, Claude, Cursor and MCP clients.

• Publish text, image and video Threads posts.

• Read a user's Threads posts.

• Read/respond to replies, hide/unhide replies and approve/ignore pending replies.

• Read mentions and perform official keyword/topic search.

• Read account and post insights.

• Opaque th_... Account Keys for trusted Nabux integrations.

Related MCP server: instagram-mcp

MCP tools

threads_accounts, threads_profile, threads_list_posts, threads_publish_text, threads_publish_image, threads_publish_video, threads_get_replies, threads_reply, threads_hide_reply, threads_manage_pending_reply, threads_mentions, threads_keyword_search, threads_account_insights, threads_post_insights.

Meta setup

Create a Meta app with the Threads use case and configure the exact redirect:

https://threads.nabuxai.com/threads/callback

Default scopes:

threads_basic
threads_content_publish
threads_read_replies
threads_manage_replies
threads_manage_insights
threads_keyword_search
threads_manage_mentions

The gateway uses https://graph.threads.net. Short-lived tokens are exchanged for long-lived Threads tokens and refreshed before expiry.

Coolify

Deploy this branch with docker-compose.coolify.yml, domain threads.nabuxai.com, container port 8000, persistent /data volume, and set:

PUBLIC_BASE_URL=https://threads.nabuxai.com
APP_SECRET_KEY=<random 32+ chars>
TH_APP_ID=<Threads App ID>
TH_APP_SECRET=<Threads App Secret>
TH_REDIRECT_URI=https://threads.nabuxai.com/threads/callback
INTERNAL_SERVICE_TOKEN=<random server-to-server secret>

Do not commit secrets. Rotating APP_SECRET_KEY invalidates the ability to decrypt existing stored platform tokens.

NabuGen/internal API

GET  /internal/v1/accounts/{account_key}
POST /internal/v1/accounts/{account_key}/publish/text
POST /internal/v1/accounts/{account_key}/publish/image

Requests require Authorization: Bearer <INTERNAL_SERVICE_TOKEN>.

Security

• No password/session/cookie automation.

• Platform access uses Meta's supported Threads API.

• Platform tokens encrypted at rest.

• MCP bearer/refresh tokens stored as hashes.

• Account resolution is owner-scoped.

• AI clients never receive the Meta token.

Status

Code is production-shaped and CI-tested. Real end-to-end authorization/publishing still requires a configured Meta app, the required permissions/access levels, HTTPS/DNS, and a real Threads account.