meta-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| FB_APP_ID | No | Your Facebook app ID. Recommended for appsecret_proof and debug_token. | |
| ACME_EMAIL | No | Email for Let's Encrypt certificate registration. | |
| FB_APP_SECRET | No | Your Facebook app secret. Recommended for appsecret_proof and debug_token. | |
| MCP_HTTP_PORT | No | Port for HTTP transport. | 8765 |
| MCP_TRANSPORT | No | Transport mode: 'stdio' or 'http'. | stdio |
| META_RPS_LIMIT | No | Client-side requests per second limit. | 25 |
| FB_ACCESS_TOKEN | Yes | Meta (Facebook) Graph API access token. Required for all requests. | |
| META_MCP_DOMAIN | No | Domain name for Docker deployment (Caddy TLS). | |
| MCP_HTTP_AUTH_TOKEN | No | Bearer token required for HTTP transport. | |
| MCP_HTTP_ALLOWED_HOSTS | No | Comma-separated allowed hosts for HTTP transport (DNS rebinding protection). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| graph_getA | Escape-hatch: raw GET to any Graph API endpoint. Path must start with '/' and contain only safe characters. If the path starts with /v{X.Y}/ the version is stripped (server uses FB_GRAPH_VERSION). Always GET (read-only). Use only when no specialized tool fits. |
| debug_tokenA | GET /debug_token — returns token type (USER / PAGE / APP / SYSTEM_USER), app_id, expires_at, scopes, is_valid. If input_token is omitted, inspects the server's configured FB_ACCESS_TOKEN. Requires FB_APP_ID and FB_APP_SECRET to be configured (Meta requires APPID|APPSECRET as the access_token for this endpoint). |
| pages_listA | GET /me/accounts — returns pages with id, name and (importantly) access_token for each. Run this first to discover page_id values for other Page tools. |
| page_getC | GET /{page_id} — page metadata. |
| page_postsA | Default edge is |
| post_getA | GET /{post_id}. Post id format is usually |
| post_commentsD | GET /{post_id}/comments. |
| page_insightsA | GET /{page_id}/insights. Requires a Page Access Token (resolved automatically). Pass an array of metric names (e.g. [page_impressions, page_fans, page_post_engagements]). Period default is |
| ad_accounts_listD | GET /me/adaccounts. |
| ad_account_getD | GET /act_{id}. |
| campaigns_listD | GET /act_{id}/campaigns. |
| campaign_getD | GET /{campaign_id}. |
| adsets_listC | GET /{parent}/adsets. |
| ads_listC | GET /{parent}/ads. |
| adcreatives_listD | GET /act_{id}/adcreatives. |
| adcreative_getD | GET /{creative_id}. |
| insightsA | GET /{object_id}/insights. Sync only — for huge date ranges Meta recommends async jobs (POST /insights → polling), which this read-only server does not support. object_id can be account (use 'act_{id}' or numeric and we'll prefix), campaign, adset or ad — level must match. Common fields: spend, impressions, clicks, ctr, cpc, cpm, reach, frequency, actions, action_values. |
| ig_business_account_getB | GET /{ig_user_id}. Note: ig_user_id is NOT the @username — it's the IG Business Account id obtained via /{page_id}?fields=instagram_business_account. Requires the Page Access Token of the linked Facebook Page (resolved automatically via via_page_id). |
| ig_media_listD | GET /{ig_user_id}/media. |
| ig_media_getC | GET /{media_id}. |
| ig_media_insightsB | GET /{media_id}/insights. Metric set depends on media_type: IMAGE/CAROUSEL_ALBUM: impressions, reach, engagement, saved. VIDEO/REELS: plays, reach, engagement, video_views, saved. STORY: impressions, reach, replies, exits, taps_forward, taps_back. |
| ig_user_insightsB | GET /{ig_user_id}/insights. Period is required. Common metrics: impressions, reach, profile_views, follower_count (day); audience_country, audience_gender_age (lifetime). |
| ig_hashtag_searchA | GET /ig_hashtag_search?q=...&user_id=... — returns the hashtag id used by ig_hashtag_media. user_id is your IG Business Account id (not the FB user id). |
| ig_hashtag_mediaC | GET /{hashtag_id}/top_media or /{hashtag_id}/recent_media. user_id is required by Meta. |
| wa_business_owned_wabasB | GET /{business_id}/owned_whatsapp_business_accounts — returns WABAs owned by the parent Business. Find business_id via Business Manager or /me/businesses. |
| wa_phone_numbersC | GET /{waba_id}/phone_numbers. |
| wa_phone_number_getA | GET /{phone_number_id} — includes quality_rating, messaging_limit_tier, name_status, verified_name. |
| wa_message_templatesD | GET /{waba_id}/message_templates. |
| wa_template_getC | GET /{template_id}. |
| wa_analyticsC | GET /{waba_id}?fields=analytics.start({start}).end({end}).granularity({granularity}) — messages sent/delivered/read by phone number, by country, etc. start/end are unix timestamps in seconds. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 30 tools
Every tool has a clearly distinct purpose targeting a specific resource (ad account, campaign, Instagram media, WhatsApp phone number, etc.). Even similar tools like ads_list and adsets_list are distinguished by the parent entity (account, campaign, adset). No ambiguity.
Naming follows a consistent snake_case pattern (resource_verb) for most tools (e.g., ad_account_get, ads_list, campaign_get). A few tools like graph_get and debug_token deviate slightly but are still readable and serve special purposes.
30 tools is on the higher side but justified by the broad scope covering Facebook Ads, Instagram, WhatsApp Business, and Page insights. Each tool addresses a specific read operation, and the count is manageable for such a large API surface.
The tool set is comprehensive for read operations on Meta's Graph API, covering ads, Instagram, WhatsApp, and Pages. However, it lacks write operations (create/update/delete) which are available via graph_get escape hatch only. This is acceptable for a read-only server, but some common workflows (e.g., posting content) are absent.