Instagram Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Instagram Mcp (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that provides seamless integration with Instagram's Graph API, enabling AI applications to interact with Instagram Business accounts programmatically.
Standard Access (available immediately):
instagram_basicinstagram_content_publishinstagram_manage_insightsinstagram_manage_commentspages_show_listpages_read_engagementpages_manage_metadatapages_read_user_contentbusiness_managementAdvanced Access (requires Meta App Review):
instagram_manage_messages - Required for Direct Messaging features⚠️ Instagram DM Features: Reading and sending Instagram direct messages requires Advanced Access approval from Meta. See INSTAGRAM_DM_SETUP.md for the App Review process.
📖 Quick Start: See AUTHENTICATION_GUIDE.md for a 5-minute setup guide!
This section provides a step-by-step guide to obtain the necessary credentials for the Instagram MCP server.
instagram_basicinstagram_content_publishinstagram_manage_insightspages_show_listpages_read_engagement#### Option A: Using Facebook Graph API Explorer (Recommended for Testing)
/me/accountsaccess_token for your page/{page-id}?fields=instagram_business_account#### Option B: Using Facebook Login Flow (Recommended for Production)
# Example OAuth URL
oauth_url = f"https://www.facebook.com/v19.0/dialog/oauth?client_id={app_id}&redirect_uri={redirect_uri}&scope=pages_show_list,instagram_basic,instagram_content_publish,instagram_manage_insights" # Exchange authorization code for access token
token_url = f"https://graph.facebook.com/v19.0/oauth/access_token?client_id={app_id}&redirect_uri={redirect_uri}&client_secret={app_secret}&code={auth_code}"Short-lived tokens expire in 1 hour. Convert to long-lived token (60 days):
curl -X GET "https://graph.facebook.com/v19.0/oauth/access_token?grant_type=fb_exchange_token&client_id={app_id}&client_secret={app_secret}&fb_exchange_token={short_lived_token}"Create a .env file in your project root:
# Facebook App Credentials
FACEBOOK_APP_ID=your_app_id_here
FACEBOOK_APP_SECRET=your_app_secret_here
# Instagram Access Token (long-lived)
INSTAGRAM_ACCESS_TOKEN=your_long_lived_access_token_here
# Instagram Business Account ID
INSTAGRAM_BUSINESS_ACCOUNT_ID=your_instagram_business_account_id_here
# Optional: API Configuration
INSTAGRAM_API_VERSION=v19.0
RATE_LIMIT_REQUESTS_PER_HOUR=200
CACHE_ENABLED=true
LOG_LEVEL=INFORun the validation script to test your credentials:
python scripts/setup.pyOr test manually:
import os
import requests
# Test access token
access_token = os.getenv('INSTAGRAM_ACCESS_TOKEN')
response = requests.get(f'https://graph.facebook.com/v19.0/me?access_token={access_token}')
print(response.json())Long-lived tokens expire after 60 days. Implement automatic refresh:
# Check token validity
def check_token_validity(access_token):
url = f"https://graph.facebook.com/v19.0/me?access_token={access_token}"
response = requests.get(url)
return response.status_code == 200
# Refresh token before expiration
def refresh_long_lived_token(access_token, app_id, app_secret):
url = f"https://graph.facebook.com/v19.0/oauth/access_token"
params = {
'grant_type': 'fb_exchange_token',
'client_id': app_id,
'client_secret': app_secret,
'fb_exchange_token': access_token
}
response = requests.get(url, params=params)
return response.json().get('access_token')Error: "Invalid OAuth access token"
Error: "Instagram account not found"
Error: "Insufficient permissions"
Rate Limiting Issues
git clone <repository-url>
cd ig-mcppip install -r requirements.txtcp .env.example .env
# Edit .env with your Instagram API credentials# Edit config.json with your specific settingsINSTAGRAM_ACCESS_TOKEN=your_long_lived_access_token
FACEBOOK_APP_ID=your_facebook_app_id
FACEBOOK_APP_SECRET=your_facebook_app_secret
INSTAGRAM_BUSINESS_ACCOUNT_ID=your_instagram_business_account_idAdd this to your MCP client configuration (e.g., Claude Desktop):
{
"mcpServers": {
"instagram": {
"command": "python",
"args": ["/path/to/ig-mcp/src/instagram_mcp_server.py"],
"env": {
"INSTAGRAM_ACCESS_TOKEN": "your_access_token"
}
}
}
}Can you get my Instagram profile information?Show me my last 5 Instagram posts and their engagement metricsUpload this image to my Instagram account with the caption "Beautiful sunset! #photography #nature"from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client
# Connect to the Instagram MCP server
server_params = StdioServerParameters(
command="python",
args=["src/instagram_mcp_server.py"]
)
async with stdio_client(server_params) as (read, write):
async with ClientSession(read, write) as session:
await session.initialize()
# Get profile information
result = await session.call_tool("get_profile_info", {})
print(result)The server implements intelligent rate limiting to comply with Instagram's API limits:
The server provides comprehensive error handling for common scenarios:
ig-mcp/
├── src/
│ ├── instagram_mcp_server.py # Main MCP server
│ ├── instagram_client.py # Instagram API client
│ ├── models/ # Data models
│ ├── tools/ # MCP tools implementation
│ ├── resources/ # MCP resources implementation
│ └── prompts/ # MCP prompts implementation
├── tests/ # Unit and integration tests
├── config/ # Configuration files
├── requirements.txt # Python dependencies
├── .env.example # Environment variables template
└── README.md # This file# Run all tests
python -m pytest tests/
# Run with coverage
python -m pytest tests/ --cov=src/
# Run specific test file
python -m pytest tests/test_instagram_client.pygit checkout -b feature/amazing-feature)git commit -m 'Add amazing feature')git push origin feature/amazing-feature)Enable debug logging by setting:
LOG_LEVEL=DEBUG| Problem | Cause | Fix |
|---|---|---|
me/accounts returns empty [] | IG not connected to a Facebook Page, or you're not Page admin | Do Step 1 |
| Graph API Explorer says "No configuration available" | Permissions not added to app | Do Step 3 |
| "Generate Access Token" is disabled | Need to select "Get User Access Token" first | Click "Get Token" dropdown |
| App name rejected (contains "IG", "Insta", etc.) | Meta blocks trademarked words | Use a generic name |
| Token expired | Short-lived tokens last 1 hour | Do Step 6 for 60-day token |
(#10) To use Instagram Graph API... | IG account is Personal, not Business | Switch to Business/Creator in IG settings |
| Variable | Required | Default | Description |
|---|---|---|---|
INSTAGRAM_ACCESS_TOKEN | Yes | — | Meta long-lived access token |
INSTAGRAM_ACCOUNT_ID | Yes | — | Instagram business account ID |
INSTAGRAM_API_VERSION | No | v19.0 | Graph API version |
| Tool | Description |
|---|---|
get_profile_info | Get profile info (bio, followers, media count) |
get_account_pages | List connected Facebook pages |
get_account_insights | Account-level analytics (reach, profile views) |
validate_access_token | Check if token is valid |
| Tool | Description |
|---|---|
get_media_posts | Get recent posts with engagement metrics |
get_media_insights | Detailed analytics for a specific post |
publish_media | Publish image or video |
publish_carousel | Publish carousel (2-10 images/videos) |
publish_reel | Publish a Reel |
get_content_publishing_limit | Check daily publishing quota |
| Tool | Description |
|---|---|
get_comments | Get comments on a post |
post_comment | Post a comment |
reply_to_comment | Reply to a comment |
delete_comment | Delete a comment |
hide_comment | Hide/unhide a comment |
| Tool | Description |
|---|---|
get_conversations | List DM conversations |
get_conversation_messages | Read messages in a conversation |
send_dm | Send a direct message |
| Tool | Description |
|---|---|
search_hashtag | Search for a hashtag ID |
get_hashtag_media | Get top/recent media for a hashtag |
get_stories | Get current active stories |
get_mentions | Get posts you're tagged in |
business_discovery | Look up another business account |
These are Instagram Graph API limitations, not this tool's:
TypeScript rewrite of jlbadano/ig-mcp (Python).
| Project | What it does | Install |
|---|---|---|
| [Claude Code Organizer](https://github.com/mcpware/claude-code-organizer) | Visual dashboard for Claude Code memories, skills, MCP servers, hooks | npx @mcpware/claude-code-organizer |
| [UI Annotator](https://github.com/mcpware/ui-annotator-mcp) | Hover labels on any web page — AI references elements by name | npx @mcpware/ui-annotator |
| [Pagecast](https://github.com/mcpware/pagecast) | Record browser sessions as GIF or video via MCP | npx @mcpware/pagecast |
| [LogoLoom](https://github.com/mcpware/logoloom) | AI logo design → SVG → full brand kit export | npx @mcpware/logoloom |
This project is licensed under the MIT License - see the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.