# Reported issues for facebook-mcp Pod holds 16 of 23 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [facebook-mcp](/mcp/facebook-mcp). ## Most discussed ### V10 — Ads control: pause/resume + budget changes (spend-tier gated) Ads control vertical - the only tools in this server that can spend money. **Tools:** `facebook_update_ad_object` **Scope** - Status pause / resume. - Budget changes in minor currency units, gated at the **irreversible/spend tier** that env vars can never bypass. - `FB_ADS_BUDGET_CEILING` hard ceiling enforced server-side. - Ads smoke coverage (belt-and-braces given the blast radius). **Owns:** `src/api/ads-control.ts`, `src/tools/ads.ts` (control half), fixtures **Depends on:** V09 **Refs:** [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/30) · 2026-07-24 · closed · 1 comment ### V09 — Ads read: campaigns/adsets/ads + insights (sync + async job) Ads read vertical (opt-in package, ships after 1.0). **Tools:** `facebook_list_campaigns`, `facebook_list_adsets`, `facebook_list_ads`, `facebook_get_ad_object`, `facebook_ads_insights` **Scope** - Campaign / ad set / ad listings with `effective_status` truth (the field that actually reflects delivery, not the configured status). - `get_ad_object` generic single-object read. - Ads insights: synchronous path plus the async report-job tool with terminal-state handling. - Doctor check for ad-acco [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/29) · 2026-07-24 · closed · 1 comment ### I2 — 1.0 integration + Phase 4 exit gate 1.0 integration and release gate. **Scope** - Final wiring of all R-tasks; resolve contract drift across them. - Execute the Phase 4 exit gate: `npx` cold start verified on macOS **and** Windows; a non-author completes onboarding in <= 20 minutes. - Tag `1.0.0` — only on explicit user instruction. **Owns:** shared wiring files **Depends on:** R01, R02, R03, R04, R05 **Refs:** corpus 10 §1 — Size: M [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/28) · 2026-07-24 · closed · 1 comment ### R05 — setup-token subcommand: zero-to-token onboarding `setup-token` subcommand: get a new user from zero to a working token. **Scope** - Guided flow: Graph API Explorer -> short-lived token -> long-lived exchange -> Page token derivation. - Writes the resulting env file with 0600 permissions (Windows honesty note where the mode cannot be enforced). - Never prints a token to stdout; redaction choke-point applies. - Onboarding documentation to match. **Owns:** `src/index.ts` subcommand section (coordinate with I2), setup docs **Depends on:** I1 (do [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/27) · 2026-07-24 · closed · 1 comment ### R03 — Release rail: tag-driven OIDC publish, provenance, .mcpb bundle Release rail: tag-driven, CI-only publish. **Scope** - `.github/workflows/release.yml` publishing only from a tag, never from a laptop. - npm Trusted Publishing via OIDC (no long-lived `NPM_TOKEN` secret). - Build provenance attestation. - `.mcpb` bundle packed and SHA-256 checksummed as a release asset. - `mcpName` present in the first publish so MCP registry validation passes. - `mcp-publisher` step using github-oidc auth, SHA-pinned. - Flip `private: true` off and set a real version as part [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/25) · 2026-07-24 · closed · 1 comment ### R02 — Generated docs: tool/metric tables, .env.example sync, compat matrix Generated documentation. **Scope** - README tool table and insights metric table generated from the registry, replacing the hand-maintained block between the `GENERATED:TOOLS` markers. - `.env.example` kept in sync with the settings SSOT, enforced by a test. - Comparison table vs. adjacent projects + signposting to Meta's own ads MCP. - Client compatibility matrix (gate G-DOC-5). - Full scope enumeration: every Graph permission the server can ask for and why (gate G-DOC-6). **Owns:** `README.m [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/24) · 2026-07-24 · closed · 1 comment ### R01 — Metadata SSOT: gen-metadata.mjs + CI drift test Metadata single source of truth. **Scope** - `scripts/gen-metadata.mjs` generates every metadata target from one source: `package.json`, `server.json`, the MCPB manifest, `.claude-plugin/*.json`, README badge/version lines and `.env.example`. - CI drift test: regenerate and fail if the working tree changes. - Version assertions so a release cannot ship mismatched versions across manifests. **Owns:** `scripts/gen-metadata.mjs` + generated targets **Depends on:** U2 (npm name decision), I1 (done [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/23) · 2026-07-24 · closed · 1 comment ### R04 — Hygiene + runbooks: SECURITY, templates, rotation/offboarding Operational hygiene and runbooks. **Scope** - Review and finish CONTRIBUTING, issue/PR templates (require `--version` output and doctor output on every bug report), SUPPORT statement. - Explicit no-telemetry statement. - SECURITY.md: guarantees, disclosure process, supported versions. - `docs/runbooks/`: token rotation and kill-switch, uninstall/offboarding, Meta Data Use Checkup + changelog cadence, operator-window procedure. **Owns:** those files **Depends on:** none (docs-only; runs paralle [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/26) · 2026-07-24 · open · 0 comments ## Most recent ### V10 — Ads control: status + budget changes behind the spend ceiling Control half of the opt-in `ads` package: the only writes that can move money, and the guardrails around them. **Scope** - `src/api/ads-control.ts`: status changes (pause and resume) and budget changes on campaigns and ad sets. - Budget values handled in minor currency units throughout, with the currency echoed back in every preview. - Both operations gated at the irreversible write tier, which is never bypassable by an environment variable, and capped by `FB_ADS_BUDGET_CEILING` — a request abo [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/21) · 2026-07-24 · open · 0 comments ### V09 — Ads read: campaign/adset/ad listings + insights Read half of the opt-in `ads` package. No spend can be moved by anything in this issue. **Scope** - `src/api/ads-read.ts`: campaign, ad set and ad listings plus `get_ad_object` single reads. - `effective_status` reported as the truth, alongside the configured `status`, so a paused parent is never presented as an active child. - Ads insights: synchronous call with an asynchronous job fallback, including the job tool and its terminal states. - Doctor check for ad-account status (disabled, unsettl [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/20) · 2026-07-24 · open · 0 comments ### I2 — Ship v1.0.0: distribution gate and first publish The 1.0 integration task: final wiring, the distribution gate, and the first public release. **Checklist** - [ ] Dogfood period completed — the Pages surface used weekly on a real Page for 2 to 4 weeks, with findings folded back in. - [ ] Final wiring of all tool packages and subcommands; manifest snapshot updated and reviewed as the post-1.0 breaking-change anchor. - [ ] Cold-start gate: `npx -y ` works in Claude Desktop and Claude Code on both macOS and Windows. - [ ] Onboarding gate: a [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/19) · 2026-07-24 · open · 0 comments ### R05 — setup-token subcommand (guided onboarding) Onboarding is the hardest part of this server: Meta tokens are not obvious to obtain. A guided subcommand removes that wall. **Scope** - `setup-token` subcommand walking the Graph API Explorer to long-lived-token exchange to Page-token quickstart, step by step. - Writes the resulting credentials to the config file atomically with 0600 permissions, reusing the existing config layer (no new storage path). - Prints exactly what each step does and which permission it grants, so an operator can audi [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/18) · 2026-07-24 · open · 0 comments ### R02 — Docs: generated README tables, .env.example + sync test Bring the user-facing documentation to 1.0 quality, generated from the metadata SSOT rather than maintained by hand. **Scope** - Generated README tool table (one row per tool, per package) and the live-verified insights metric table produced by the doctor metric probe. - `.env.example` covering every `FB_*` variable, plus a sync test that fails when the file, the README env table and the settings module disagree. - Comparison table against the alternatives, with honest signposting to Meta's own [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/17) · 2026-07-24 · open · 0 comments ### R01 — Metadata SSOT: gen-metadata.mjs + drift test Single source of truth for project metadata, so the five distribution surfaces can never drift apart. **Scope** - `scripts/gen-metadata.mjs` generating from one settings module: `package.json` fields, `server.json`, the MCPB manifest, `.claude-plugin/` manifests, and the README + `.env.example` env tables. - Version assertions: the version in every generated surface must match `package.json`. - A CI drift test that regenerates and fails if any tracked output differs from the committed one. - Co [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/16) · 2026-07-24 · open · 0 comments ### R03 — Release rail: tag-driven CI-only publish Automated release rail so every published artifact is built and signed by CI, never from a workstation. **Scope** - Tag-driven, CI-only publish workflow (`.github/workflows/release.yml`); no publish path from a local machine. - npm Trusted Publishing via OIDC with provenance attestation (requires the repository to be public, which it is). - `.mcpb` bundle packed as a release asset with a SHA-256 checksum. - `mcpName` present in the very first publish so the MCP registry can verify ownership. - [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/15) · 2026-07-24 · open · 0 comments ### V08 — Messages: conversations + send_message Messaging vertical: Page inbox over Messenger. **Tools:** `facebook_list_conversations`, `facebook_get_conversation`, `facebook_send_message` **Scope** - `list_conversations` with `platform=messenger` pinned (gate G-RUN-2). - `get_conversation` (+ optional `mark_seen` parameter if gate G-TOOL-4 is approved). - `send_message` with 24-hour messaging-window mapping, explicit unknown-outcome error, optional dedupe key. - Attachment placeholders (metadata only, no blob fetch). - Taint envelope (F15 [Read the thread](https://github.com/IvanBBaev/facebook-mcp/issues/13) · 2026-07-24 · open · 0 comments The remaining reports are on [the project's issue tracker](https://github.com/IvanBBaev/facebook-mcp/issues).