> **Community source release (MIT).** Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

# Threads MCP by Nabux

Multi-user, multi-account MCP gateway powered by Meta's official Threads API.

- Production target: `https://threads.nabuxai.com`
- MCP: `https://threads.nabuxai.com/mcp`
- OAuth callback: `https://threads.nabuxai.com/threads/callback`

## Capabilities

- Connect multiple Threads accounts with Meta OAuth.
- Encrypt long-lived Threads tokens at rest and refresh them automatically.
- OAuth 2.1 + PKCE for ChatGPT, Claude, Cursor and MCP clients.
- Publish text, image and video Threads posts.
- Read a user's Threads posts.
- Read/respond to replies, hide/unhide replies and approve/ignore pending replies.
- Read mentions and perform official keyword/topic search.
- Read account and post insights.
- Opaque `th_...` Account Keys for trusted Nabux integrations.

## MCP tools

`threads_accounts`, `threads_profile`, `threads_list_posts`, `threads_publish_text`, `threads_publish_image`, `threads_publish_video`, `threads_get_replies`, `threads_reply`, `threads_hide_reply`, `threads_manage_pending_reply`, `threads_mentions`, `threads_keyword_search`, `threads_account_insights`, `threads_post_insights`.

## Meta setup

Create a Meta app with the Threads use case and configure the exact redirect:

```text
https://threads.nabuxai.com/threads/callback
```

Default scopes:

```text
threads_basic
threads_content_publish
threads_read_replies
threads_manage_replies
threads_manage_insights
threads_keyword_search
threads_manage_mentions
```

The gateway uses `https://graph.threads.net`. Short-lived tokens are exchanged for long-lived Threads tokens and refreshed before expiry.

## Coolify

Deploy this branch with `docker-compose.coolify.yml`, domain `threads.nabuxai.com`, container port `8000`, persistent `/data` volume, and set:

```text
PUBLIC_BASE_URL=https://threads.nabuxai.com
APP_SECRET_KEY=<random 32+ chars>
TH_APP_ID=<Threads App ID>
TH_APP_SECRET=<Threads App Secret>
TH_REDIRECT_URI=https://threads.nabuxai.com/threads/callback
INTERNAL_SERVICE_TOKEN=<random server-to-server secret>
```

Do not commit secrets. Rotating `APP_SECRET_KEY` invalidates the ability to decrypt existing stored platform tokens.

## NabuGen/internal API

```text
GET  /internal/v1/accounts/{account_key}
POST /internal/v1/accounts/{account_key}/publish/text
POST /internal/v1/accounts/{account_key}/publish/image
```

Requests require `Authorization: Bearer <INTERNAL_SERVICE_TOKEN>`.

## Security

- No password/session/cookie automation.
- Platform access uses Meta's supported Threads API.
- Platform tokens encrypted at rest.
- MCP bearer/refresh tokens stored as hashes.
- Account resolution is owner-scoped.
- AI clients never receive the Meta token.

## Status

Code is production-shaped and CI-tested. Real end-to-end authorization/publishing still requires a configured Meta app, the required permissions/access levels, HTTPS/DNS, and a real Threads account.