Facebook MCP Server

What the code does

We read the source, 2 d ago · rules 995398eba69f

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

    const candidate = path.join(dir, n === 0 ? fileName : suffixed(fileName, n));

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add facebook-mcp -- npx -y @ivanbaev/facebook-mcp

{
  "mcpServers": {
    "facebook-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@ivanbaev/facebook-mcp"
      ]
    }
  }
}

[mcp_servers.facebook-mcp]
command = "npx"
args = ["-y", "@ivanbaev/facebook-mcp"]

{
  "mcpServers": {
    "facebook-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@ivanbaev/facebook-mcp"
      ]
    }
  }
}

{
  "servers": {
    "facebook-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@ivanbaev/facebook-mcp"
      ]
    }
  }
}

Optional settings from the registry entry, left out of the block above: FB_SYSTEM_TOKEN (System-user access token (Business Manager). Takes precedence over FB_ACCESS_TOKEN and FB_PAGE_TOKEN when several are set), FB_ACCESS_TOKEN (Primary user access token. At least one of FB_SYSTEM_TOKEN, FB_ACCESS_TOKEN or FB_PAGE_TOKEN must be set), FB_PAGE_TOKEN (Long-lived Page access token used as a fallback credential when no user or system-user token is configured. It belongs to exactly one Page, so set FB_PAGE_ID to that Page ID alongside it (the doctor / facebook_whoami reports it as the acting Page); a Page token without its Page ID is bound to nothing), FB_APP_ID (Meta app ID; combined with FB_APP_SECRET it forms the app access token used to authorize /debug_token inspection), FB_APP_SECRET (Meta app secret. When set, appsecret_proof is attached to every call so a stolen bare token cannot be used on its own), FB_PAGE_ID (Default Facebook Page ID, used when a tool call omits an explicit profile argument. Required when FB_PAGE_TOKEN is the only credential: it names the Page that token belongs to), FB_API_VERSION (Graph API version to target. Defaults to the tested pinned version; other values are accepted verbatim as an escape hatch but are not tested), FB_ADS_API_VERSION (Marketing API version the ads tools target (ad accounts, campaigns, ad sets, ads, insights, async reports). The Marketing API retires versions on its own, shorter schedule, so it is pinned separately from FB_API_VERSION. Other values are accepted verbatim as an escape hatch but are not tested), FB_REQUEST_TIMEOUT_MS (Per-request timeout in milliseconds; integer in [1, 600000]), FB_HOST_CONCURRENCY (Maximum number of in-flight requests per Graph host; integer in [1, 64]), FB_MAX_RESULT_CHARS (Character budget applied by the result shaper before a tool result is truncated; integer in [500, 10000000]), FB_WRITE_MODE (Write gating mode: plan (validating dry-run preview, the default) or apply. It never covers the irreversible and spend tiers, which always need a per-call apply plus a plan_id), FB_CONFIRM_TOKEN (Operator confirmation token for out-of-band approval of irreversible or spend actions. The server prompts through MCP elicitation where the client supports it; otherwise the caller passes this value as the confirm_token tool argument. At least 16 characters — a shorter value fails startup; mint one with openssl rand -hex 32), FB_MEDIA_DIR (Directory permitted for local media uploads. Unset means URL-only uploads and no local file access at all), FB_JOURNAL_PATH (Path to the append-only write journal. Defaults to the XDG/%APPDATA% state path; the file is created owner-only (0600) and rotates by size), FB_ACTIVITY_STATE_PATH (Path to the small JSON file where facebook_get_activity_since keeps, per Page, the horizon of the last complete read. Defaults to the XDG/%APPDATA% state path next to the journal; the file holds Page ids and timestamps only and is written atomically, owner-only (0600)), FB_EXPORT_DIR (Directory where the insights tools write a CSV or JSON file when called with `output`. Defaults to `exports/` under the XDG/%APPDATA% state path. Files are written atomically and owner-only (0600) and are never overwritten; a name collision gets a numeric suffix), FB_TOOL_PACKAGES (Comma-separated tool packages or profiles to expose (e.g. core,posts,reader, or the profiles core|all|reader|publisher|moderator|ads). Omit for the default profile, which excludes ads), FB_PACKAGES_DENY (Comma-separated packages OR profiles to exclude even when FB_TOOL_PACKAGES enables them; deny wins over allow. Profile names expand here exactly as they do in FB_TOOL_PACKAGES, and a profile beats a same-spelled package, so FB_PACKAGES_DENY=core denies the whole six-package core profile rather than the single core package. The core package is then forced back on regardless, because its identity and diagnostic tools are what you need to debug the surface you just narrowed. An unrecognized name is a startup error, not a silently ignored token), FB_PACKAGES_READONLY (Comma-separated packages OR profiles whose write tools are not registered at all; the read tools of those packages stay available. Profile names expand as they do in FB_TOOL_PACKAGES, so FB_PACKAGES_READONLY=core makes every default package read-only in one token. An unrecognized name is a startup error), FB_TRANSPORT (Transport protocol: stdio (default) or http. The http transport binds 127.0.0.1 only and fails closed without FB_HTTP_TOKEN), FB_HTTP_TOKEN (Bearer token guarding the HTTP transport; required when FB_TRANSPORT=http (the server refuses to start without it). At least 16 characters — a shorter value is refused (under stdio it is dropped with a warning); mint one with openssl rand -hex 32), FB_HTTP_PORT (Port for the HTTP transport (loopback only); used when FB_TRANSPORT=http. Integer in [1, 65535]), FB_AD_ACCOUNT_ID (Default ad account ID (act_… or the bare numeric id) for the opt-in ads package), FB_ADS_BUDGET_CEILING (Hard ceiling for any ads budget write, in minor units of the ad account's own currency (e.g. cents for USD). Non-negative integer; a write above it is refused. No currency conversion: size it for the account's currency (1000 is $10 but only 1000 JPY)), FB_ADS_CAMPAIGN_SPEND_CAP_MAX (Largest campaign spend_cap (the lifetime total a campaign may spend) that an ads write may set, in minor units of the ad account's own currency. Non-negative integer; a cap above it is refused, never clamped. Unset: every write that sets a campaign spend cap is refused. No currency conversion, same as FB_ADS_BUDGET_CEILING), FB_LOG_LEVEL (Stderr log verbosity: debug, info, warn or error. Logs never go to stdout — that is the stdio protocol channel).