Social Connect MCP POC

Node.js 22 POC with no npm dependency to test Facebook + TikTok connection, OAuth, and MCP connection tools.

1. Run immediately with mock

cp .env.example .env
npm test
npm start

Open http://localhost:3000, then click Test Facebook, Test TikTok, or Run test-all.

.env.example defaults to MOCK_SOCIAL=true, so the demo works right away without secrets.

Related MCP server: io.github.anthonyjbolo/mcp-fb-publisher

2. Test access to real endpoints

npm run probe

An HTTP 400/401 when there is no token still means the provider endpoint is reachable.

3. Run Facebook LIVE

Create a Meta Developer App, add Facebook Login, and configure:

MOCK_SOCIAL=false
META_GRAPH_VERSION=v26.0
META_APP_ID=...
META_APP_SECRET=...
META_REDIRECT_URI=http://localhost:3000/api/facebook/callback

OAuth scopes for the POC:

pages_show_list
pages_read_engagement
pages_manage_posts
pages_manage_engagement
pages_messaging

Then open:

http://localhost:3000/api/facebook/login

The callback exchanges the authorization code for a user access token, calls /me and /me/accounts, then keeps the token temporarily in memory.

You can also bypass OAuth to test a token/Page directly:

META_USER_ACCESS_TOKEN=...
# hoặc
META_PAGE_ID=...
META_PAGE_ACCESS_TOKEN=...

4. Run TikTok LIVE

Create a TikTok Developer App + Login Kit and configure:

MOCK_SOCIAL=false
TIKTOK_CLIENT_KEY=...
TIKTOK_CLIENT_SECRET=...
TIKTOK_REDIRECT_URI=http://localhost:3000/api/tiktok/callback
TIKTOK_SCOPES=user.info.basic,video.list

Open:

http://localhost:3000/api/tiktok/login

The callback uses the v2 token endpoint and then tests /v2/user/info/. If the app has video.list, the POC also tests /v2/video/list/.

Or test a token directly:

TIKTOK_ACCESS_TOKEN=...

5. Internal API

GET /api/health
GET /api/facebook/login
GET /api/facebook/callback
GET /api/facebook/test
GET /api/tiktok/login
GET /api/tiktok/callback
GET /api/tiktok/test
GET /api/test-all

6. MCP POC

npm run mcp

Tools:

social_status
facebook_test_connection
tiktok_test_connection

src/mcp-server.js is a minimal stdio MCP server implementation so the POC does not depend on external packages. When upgrading to production, it should be replaced with the official MCP SDK.

7. Production TODO

The POC intentionally keeps OAuth tokens only in memory. Production needs a database/encrypted secret store, refresh-token rotation, Meta/TikTok webhook verification, RBAC, audit log, rate-limit/retry, App Review, and a token revocation flow.

8. Git

The repo is already git init-ed. To push to GitHub after creating the remote repository:

git remote add origin git@github.com:<username>/social-connect-mcp-poc.git
git push -u origin main