Social Mcp Connector — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Social Mcp Connector (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A remote [Model Context Protocol](https://modelcontextprotocol.io) server that exposes your Meta (Facebook + Instagram) and TikTok organic social data as MCP tools, so you can ask Claude Desktop or ChatGPT things like "how did my Instagram account grow this week?" or "list my latest TikToks with their view counts."
It hits the live Meta Graph API and TikTok Display API using access tokens you provide as environment variables — there is no mock data.
mcp-handler adapter (@vercel/mcp-adapter).app/api/[transport]/route.ts.Once deployed to https://<your-app>.vercel.app:
| Transport | URL |
|---|---|
| Streamable HTTP (recommended) | https://<your-app>.vercel.app/api/mcp |
| SSE (legacy clients) | https://<your-app>.vercel.app/api/sse |
SSE resumability across serverless invocations needs Redis. It is optional — leaveREDIS_URLunset and the Streamable HTTP path (/api/mcp) works fully without it.
| Endpoint | Purpose |
|---|---|
GET /api/tiktok/auth | Redirects to TikTok to authorize and generate a token. |
GET /api/tiktok/callback | Shows the resulting TIKTOK_ACCESS_TOKEN to copy into Vercel. |
Start here to get your token: https://<your-app>.vercel.app/api/tiktok/auth
See tools.md for full parameter and return details.
| Tool | What it does |
|---|---|
instagram_account_overview | IG followers, media count, name, bio, profile picture |
instagram_account_insights | IG reach, profile views, follower growth over a period |
instagram_recent_media | Recent IG posts with per-post likes / comments / reach |
facebook_page_insights | FB Page impressions, post engagements, fan count |
tiktok_user_info | TikTok followers, following, likes, video count |
tiktok_recent_videos | Recent TikTok videos with views / likes / comments / shares |
social_overview | Aggregated headline numbers across IG + FB + TikTok |
Copy .env.example to .env.local for local dev, or set these in Vercel → Project → Settings → Environment Variables.
| Variable | Required? | Description |
|---|---|---|
META_ACCESS_TOKEN | for Meta/IG tools | Long-lived Meta access token with the permissions below. |
META_IG_USER_ID | for IG tools | Instagram Business/Creator account id (numeric, not the @handle). |
META_PAGE_ID | for FB tool | Facebook Page id linked to the IG account. |
META_APP_ID | optional | App id — only for token debugging / appsecret_proof. |
META_APP_SECRET | optional | App secret — only for token debugging / appsecret_proof. |
TIKTOK_ACCESS_TOKEN | for TikTok tools | User access token from TikTok Login Kit OAuth. |
TIKTOK_CLIENT_KEY | for OAuth helper | TikTok app client key. Used by /api/tiktok/auth to mint the access token. |
TIKTOK_CLIENT_SECRET | for OAuth helper | TikTok app client secret. Used by /api/tiktok/callback for the token exchange. |
TIKTOK_REDIRECT_URI | optional | Override the OAuth redirect URI. Defaults to ${origin}/api/tiktok/callback. Must match the URI registered in the TikTok app. |
MCP_AUTH_TOKEN | optional | If set, the MCP endpoint requires Authorization: Bearer <value>. If unset, the endpoint is open. |
REDIS_URL | optional | Enables SSE resumability. Not needed for Streamable HTTP. |
The build never reads tokens. npm run build makes no API calls and passes with no env vars set; tokens are only used at request time.instagram_basic, instagram_manage_insights, pages_read_engagement, pages_show_list, read_insights (and business_management if using a Business portfolio).
GET https://graph.facebook.com/v21.0/oauth/access_token?grant_type=fb_exchange_token&client_id=<APP_ID>&client_secret=<APP_SECRET>&fb_exchange_token=<SHORT_LIVED_TOKEN>
rest: it calls GET /me/accounts to find the Page you manage (and its Page access token, which Page insights require) and the linked Instagram Business account id. META_PAGE_ID / META_IG_USER_ID are optional overrides — if set and valid they win; if missing or wrong they are auto-resolved. Each tool's output reports which id was used and its source (env vs discovered). To set them explicitly: GET https://graph.facebook.com/v21.0/me/accounts?access_token=<TOKEN> (Page id), then GET https://graph.facebook.com/v21.0/<PAGE_ID>?fields=instagram_business_account&access_token=<TOKEN> (IG user id).
The TikTok portal only gives you a Client Key + Client Secret — the access token must come from the Login Kit OAuth flow. This app includes a helper to do that for you:
TIKTOK_CLIENT_KEY and TIKTOK_CLIENT_SECRET in Vercel (+ optionallyTIKTOK_REDIRECT_URI) and deploy.
https://social-mcp-connector.vercel.app/api/tiktok/callback (it must match exactly — including https and no trailing slash differences).
user.info.basic, user.info.profile, user.info.stats,video.list.
sandbox, otherwise authorization fails with a scope/permission error.
browser. It redirects you to TikTok to authorize, then the callback page displays your access_token, refresh_token, expires_in, and open_id.
access_token into Vercel as TIKTOK_ACCESS_TOKEN and redeploy.The OAuth helper never logs or stores tokens — it only renders them once on the callback page for you to copy.
davolu).Next.js (auto-detected). No build settings to change.
(Production + Preview).
https://<your-app>.vercel.app/api/mcphttps://<your-app>.vercel.app/api/sseLocal dev (optional): npm install then npm run dev (do not commit .env.local).
Social MCP (anything).https://<your-app>.vercel.app/api/mcp
MCP_AUTH_TOKEN, add an Authorization header with the valueBearer <your-MCP_AUTH_TOKEN> (in Claude Desktop's connector auth field, or the OAuth/headers section). If MCP_AUTH_TOKEN is unset, leave auth empty.
questions like "Give me a social_overview" or "Show my recent Instagram media."
ChatGPT: use Settings → Connectors → Create / Add custom connector and paste the same /api/mcp URL (plus the bearer token if configured).(e.g. ❌ TIKTOK_ACCESS_TOKEN is not set...) rather than throwing.
lib/fetcher.ts) adds a 20s timeout and normalises Metaand TikTok API error shapes (expired token, missing permission, rate limit) into readable messages.
social_overview returnspartial results with per-platform errors inline.
browser or included in responses.
.env* is git-ignored (except .env.example); no secrets are committed.MCP_AUTH_TOKEN to require a shared-secret bearer token on the endpoint.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.