Reported issues for facebook-mcp

Pod holds 16 of 23 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to facebook-mcp.

Most discussed

V10 — Ads control: pause/resume + budget changes (spend-tier gated)

Ads control vertical - the only tools in this server that can spend money.

Tools: facebook_update_ad_object

Scope

• Status pause / resume.
• Budget changes in minor currency units, gated at the irreversible/spend tier that env vars can never bypass.
• FB_ADS_BUDGET_CEILING hard ceiling enforced server-side.
• Ads smoke coverage (belt-and-braces given the blast radius).

Owns: src/api/ads-control.ts, src/tools/ads.ts (control half), fixtures Depends on: V09 Refs:

Read the thread · 2026-07-24 · closed · 1 comment

V09 — Ads read: campaigns/adsets/ads + insights (sync + async job)

Ads read vertical (opt-in package, ships after 1.0).

Tools: facebook_list_campaigns, facebook_list_adsets, facebook_list_ads, facebook_get_ad_object, facebook_ads_insights

Scope

• Campaign / ad set / ad listings with effective_status truth (the field that actually reflects delivery, not the configured status).
• get_ad_object generic single-object read.
• Ads insights: synchronous path plus the async report-job tool with terminal-state handling.
• Doctor check for ad-acco

Read the thread · 2026-07-24 · closed · 1 comment

I2 — 1.0 integration + Phase 4 exit gate

1.0 integration and release gate.

Scope

• Final wiring of all R-tasks; resolve contract drift across them.
• Execute the Phase 4 exit gate: npx cold start verified on macOS and Windows; a non-author completes onboarding in <= 20 minutes.
• Tag 1.0.0 — only on explicit user instruction.

Owns: shared wiring files Depends on: R01, R02, R03, R04, R05 Refs: corpus 10 §1 — Size: M

Read the thread · 2026-07-24 · closed · 1 comment

R05 — setup-token subcommand: zero-to-token onboarding

setup-token subcommand: get a new user from zero to a working token.

Scope

• Guided flow: Graph API Explorer -> short-lived token -> long-lived exchange -> Page token derivation.
• Writes the resulting env file with 0600 permissions (Windows honesty note where the mode cannot be enforced).
• Never prints a token to stdout; redaction choke-point applies.
• Onboarding documentation to match.

Owns: src/index.ts subcommand section (coordinate with I2), setup docs Depends on: I1 (do

Read the thread · 2026-07-24 · closed · 1 comment

R03 — Release rail: tag-driven OIDC publish, provenance, .mcpb bundle

Release rail: tag-driven, CI-only publish.

Scope

• .github/workflows/release.yml publishing only from a tag, never from a laptop.
• npm Trusted Publishing via OIDC (no long-lived NPM_TOKEN secret).
• Build provenance attestation.
• .mcpb bundle packed and SHA-256 checksummed as a release asset.
• mcpName present in the first publish so MCP registry validation passes.
• mcp-publisher step using github-oidc auth, SHA-pinned.
• Flip private: true off and set a real version as part

Read the thread · 2026-07-24 · closed · 1 comment

R02 — Generated docs: tool/metric tables, .env.example sync, compat matrix

Generated documentation.

Scope

• README tool table and insights metric table generated from the registry, replacing the hand-maintained block between the GENERATED:TOOLS markers.
• .env.example kept in sync with the settings SSOT, enforced by a test.
• Comparison table vs. adjacent projects + signposting to Meta's own ads MCP.
• Client compatibility matrix (gate G-DOC-5).
• Full scope enumeration: every Graph permission the server can ask for and why (gate G-DOC-6).

Owns: `README.m

Read the thread · 2026-07-24 · closed · 1 comment

R01 — Metadata SSOT: gen-metadata.mjs + CI drift test

Metadata single source of truth.

Scope

• scripts/gen-metadata.mjs generates every metadata target from one source: package.json, server.json, the MCPB manifest, .claude-plugin/*.json, README badge/version lines and .env.example.
• CI drift test: regenerate and fail if the working tree changes.
• Version assertions so a release cannot ship mismatched versions across manifests.

Owns: scripts/gen-metadata.mjs + generated targets Depends on: U2 (npm name decision), I1 (done

Read the thread · 2026-07-24 · closed · 1 comment

R04 — Hygiene + runbooks: SECURITY, templates, rotation/offboarding

Operational hygiene and runbooks.

Scope

• Review and finish CONTRIBUTING, issue/PR templates (require --version output and doctor output on every bug report), SUPPORT statement.
• Explicit no-telemetry statement.
• SECURITY.md: guarantees, disclosure process, supported versions.
• docs/runbooks/: token rotation and kill-switch, uninstall/offboarding, Meta Data Use Checkup + changelog cadence, operator-window procedure.

Owns: those files Depends on: none (docs-only; runs paralle

Read the thread · 2026-07-24 · open · 0 comments

Most recent

V10 — Ads control: status + budget changes behind the spend ceiling

Control half of the opt-in ads package: the only writes that can move money, and the guardrails around them.

Scope

• src/api/ads-control.ts: status changes (pause and resume) and budget changes on campaigns and ad sets.
• Budget values handled in minor currency units throughout, with the currency echoed back in every preview.
• Both operations gated at the irreversible write tier, which is never bypassable by an environment variable, and capped by FB_ADS_BUDGET_CEILING — a request abo

Read the thread · 2026-07-24 · open · 0 comments

V09 — Ads read: campaign/adset/ad listings + insights

Read half of the opt-in ads package. No spend can be moved by anything in this issue.

Scope

• src/api/ads-read.ts: campaign, ad set and ad listings plus get_ad_object single reads.
• effective_status reported as the truth, alongside the configured status, so a paused parent is never presented as an active child.
• Ads insights: synchronous call with an asynchronous job fallback, including the job tool and its terminal states.
• Doctor check for ad-account status (disabled, unsettl

Read the thread · 2026-07-24 · open · 0 comments

I2 — Ship v1.0.0: distribution gate and first publish

The 1.0 integration task: final wiring, the distribution gate, and the first public release.

Checklist

• Dogfood period completed — the Pages surface used weekly on a real Page for 2 to 4 weeks, with findings folded back in.
• Final wiring of all tool packages and subcommands; manifest snapshot updated and reviewed as the post-1.0 breaking-change anchor.
• Cold-start gate: npx -y <pkg> works in Claude Desktop and Claude Code on both macOS and Windows.
• Onboarding gate: a

Read the thread · 2026-07-24 · open · 0 comments

R05 — setup-token subcommand (guided onboarding)

Onboarding is the hardest part of this server: Meta tokens are not obvious to obtain. A guided subcommand removes that wall.

Scope

• setup-token subcommand walking the Graph API Explorer to long-lived-token exchange to Page-token quickstart, step by step.
• Writes the resulting credentials to the config file atomically with 0600 permissions, reusing the existing config layer (no new storage path).
• Prints exactly what each step does and which permission it grants, so an operator can audi

Read the thread · 2026-07-24 · open · 0 comments

R02 — Docs: generated README tables, .env.example + sync test

Bring the user-facing documentation to 1.0 quality, generated from the metadata SSOT rather than maintained by hand.

Scope

• Generated README tool table (one row per tool, per package) and the live-verified insights metric table produced by the doctor metric probe.
• .env.example covering every FB_* variable, plus a sync test that fails when the file, the README env table and the settings module disagree.
• Comparison table against the alternatives, with honest signposting to Meta's own

Read the thread · 2026-07-24 · open · 0 comments

R01 — Metadata SSOT: gen-metadata.mjs + drift test

Single source of truth for project metadata, so the five distribution surfaces can never drift apart.

Scope

• scripts/gen-metadata.mjs generating from one settings module: package.json fields, server.json, the MCPB manifest, .claude-plugin/ manifests, and the README + .env.example env tables.
• Version assertions: the version in every generated surface must match package.json.
• A CI drift test that regenerates and fails if any tracked output differs from the committed one.
• Co

Read the thread · 2026-07-24 · open · 0 comments

R03 — Release rail: tag-driven CI-only publish

Automated release rail so every published artifact is built and signed by CI, never from a workstation.

Scope

• Tag-driven, CI-only publish workflow (.github/workflows/release.yml); no publish path from a local machine.
• npm Trusted Publishing via OIDC with provenance attestation (requires the repository to be public, which it is).
• .mcpb bundle packed as a release asset with a SHA-256 checksum.
• mcpName present in the very first publish so the MCP registry can verify ownership.

Read the thread · 2026-07-24 · open · 0 comments

V08 — Messages: conversations + send_message

Messaging vertical: Page inbox over Messenger.

Tools: facebook_list_conversations, facebook_get_conversation, facebook_send_message

Scope

• list_conversations with platform=messenger pinned (gate G-RUN-2).
• get_conversation (+ optional mark_seen parameter if gate G-TOOL-4 is approved).
• send_message with 24-hour messaging-window mapping, explicit unknown-outcome error, optional dedupe key.
• Attachment placeholders (metadata only, no blob fetch).
• Taint envelope (F15

Read the thread · 2026-07-24 · open · 0 comments

The remaining reports are on the project's issue tracker.