# io.github.adelaidasofia/instagram-mcp (pypi · adelaidasofia-instagram-mcp)

Official, multi-account Instagram Graph API MCP: read, publish, analytics, comments, DMs.

- Trust score: 36/100 (low)
- Change this week: −8
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-05

## Components

- pypi · `adelaidasofia-instagram-mcp`: 36/100 (this document), [markdown](https://verifymcp.io/servers/adelaidasofia-instagram-mcp/adelaidasofia-instagram-mcp.md), [page](https://verifymcp.io/servers/adelaidasofia-instagram-mcp/adelaidasofia-instagram-mcp)

## Channel facts

- Registry: `pypi`
- Package: `adelaidasofia-instagram-mcp`
- Version: `0.1.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it.
  - 1 of 22 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (MIT License) isn't a recognized OSI-approved license.
  - Actively maintained (last published 48 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 0/100
  - Schema quality not yet verified: our sandbox run of this package did not complete, so we have no schema to assess.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: our sandbox run of this package did not complete, so we have no tool definitions to assess.
- **Capabilities**: 0/100
  - Protocol version not yet verified: our sandbox run of this package did not complete, so we never saw its MCP handshake.

**Unverified: 4 categories.** Categories scored 0 because our sandbox run of this package has not given us the schema these checks need to read. That is a gap on our side rather than a finding about the package, and we only credit what we can confirm, so the score stands at 0 until the capture succeeds. We are working through the fleet, so this normally clears without any action from you.

## Install

### Claude

```bash
claude mcp add adelaidasofia-instagram-mcp -- uvx adelaidasofia-instagram-mcp
```

### Codex

```bash
codex mcp add adelaidasofia-instagram-mcp -- uvx adelaidasofia-instagram-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "adelaidasofia-instagram-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "adelaidasofia-instagram-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add adelaidasofia-instagram-mcp --command uvx --arg adelaidasofia-instagram-mcp
```

### Hermes

```yaml
mcp_servers:
  adelaidasofia-instagram-mcp:
    command: "uvx"
    args: ["adelaidasofia-instagram-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "adelaidasofia-instagram-mcp": {
      "command": "uvx",
      "args": [
        "adelaidasofia-instagram-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 36, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 21, −5)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 26, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-29 (score 44, +20)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] The scripts that run when this package is installed changed: build_backend
- [functional regression] License: unverified → fail
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → 0.99
- [functional] Licence: MIT License

### 2026-07-27 (score 24)

First indexed and scored.

## MCP tools (29)

### `healthcheck` (~63 tokens)

Verify the MCP is configured + ready: accounts present, token backend, Graph reachability.

Does a live GET on the default account's profile if one is configured. Safe to
call anytime; never mutates. Returns ok=false with a hint when no account is set.

### `list_accounts` (~26 tokens)

List configured Instagram accounts (labels + ig_user_id + default flag). Never returns tokens.

### `add_account` (~174 tokens)

Store an Instagram Business/Creator account for use by every tool.

label        a short key you choose (e.g. "onde", "mycelium", "client-acme")
access_token a long-lived Instagram Graph API token (stored in the OS keychain)
ig_user_id   the Instagram Business Account id (numeric)
app_secret   optional Meta app secret — enables appsecret_proof call hardening
make_default set true to make this the account used when `account` is omitted

The token is written to the macOS keychain (or a chmod-600 file fallback) and
is NEVER echoed back or logged.

Input parameters:

- `access_token` (string, required)
- `app_secret`
- `ig_user_id` (string, required)
- `label` (string, required)
- `make_default` (boolean)

### `set_default_account` (~33 tokens)

Set which configured account is used when a tool's `account` arg is omitted.

Input parameters:

- `label` (string, required)

### `remove_account` (~29 tokens)

Remove a configured account + delete its stored token from the keychain.

Input parameters:

- `label` (string, required)

### `account_info` (~31 tokens)

Live profile snapshot for one account: username, name, followers, media count, etc.

Input parameters:

- `account`

### `get_profile` (~32 tokens)

Return the account's public profile fields (followers, follows, media count, bio, website).

Input parameters:

- `account`

### `list_media` (~45 tokens)

List recent media (posts/reels) for the account, newest first. limit 1-100 (default 25).

Input parameters:

- `account`
- `limit` (integer)

### `get_media` (~41 tokens)

Return full fields for one media object by id (caption, type, permalink, like/comment counts).

Input parameters:

- `account`
- `media_id` (string, required)

### `get_account_insights` (~96 tokens)

Account-level analytics (reach, impressions, profile views, follower count).

metrics: comma-separated Graph metric names (default reach,impressions,profile_views,
follower_count). period: day|week|days_28|lifetime. Exact available metrics vary by
Graph API version; on a mismatch the Meta error names the correct metric.

Input parameters:

- `account`
- `metrics`
- `period` (string)

### `get_media_insights` (~79 tokens)

Per-post analytics (reach, saves, likes, comments, shares, total interactions).

metrics override is comma-separated; defaults suit feed posts. Reels/stories expose
different metrics (e.g. plays, navigation) — pass them explicitly if needed.

Input parameters:

- `account`
- `media_id` (string, required)
- `metrics`

### `get_audience_insights` (~147 tokens)

Follower demographics (age, gender, country, city).

Requires the account to have >=100 followers (Meta privacy floor) — below that the
Graph returns an error, surfaced cleanly. Newer Graph versions use metric=
follower_demographics with metric_type=total_value + breakdown=age|gender|country|city
and a timeframe (last_14_days|last_30_days|last_90_days|prev_month) for engaged-audience
metrics. All are override-able.

Input parameters:

- `account`
- `breakdown`
- `metric`
- `metric_type` (string)
- `period` (string)
- `timeframe`

### `publishing_limit` (~30 tokens)

Remaining posts in the rolling 24h publishing quota (Instagram caps API posts/day).

Input parameters:

- `account`

### `publish_image` (~71 tokens)

Publish a single image to the feed.

image_url must be a PUBLIC https URL (Instagram fetches the bytes itself). caption
\<= 2200 chars. Two-step Graph flow (create container -> publish) handled internally.

Input parameters:

- `account`
- `caption`
- `image_url` (string, required)

### `publish_video` (~58 tokens)

Publish a video to the feed. video_url must be a PUBLIC https URL.

Video containers process asynchronously; this polls status up to 90s before publishing.

Input parameters:

- `account`
- `caption`
- `video_url` (string, required)

### `publish_reel` (~90 tokens)

Publish a Reel. video_url must be a PUBLIC https URL.

share_to_feed also surfaces the reel in the main grid. cover_url (optional) sets the
thumbnail. Reel containers process asynchronously (polled up to 90s).

Input parameters:

- `account`
- `caption`
- `cover_url`
- `share_to_feed` (boolean)
- `video_url` (string, required)

### `publish_carousel` (~70 tokens)

Publish a multi-image carousel (2-10 images). Each image_url must be a PUBLIC https URL.

Creates one child container per image (is_carousel_item) then a CAROUSEL parent, then publishes.

Input parameters:

- `account`
- `caption`
- `image_urls` (array, required)

### `publish_story` (~45 tokens)

Publish a Story (image OR video). Exactly one of image_url / video_url, PUBLIC https.

Input parameters:

- `account`
- `image_url`
- `video_url`

### `get_comments` (~46 tokens)

List comments on a media object (text, username, timestamp, like_count, hidden).

Input parameters:

- `account`
- `limit` (integer)
- `media_id` (string, required)

### `reply_to_comment` (~47 tokens)

Reply to a comment. message <= 2200 chars. Returns the new comment id.

Input parameters:

- `account`
- `comment_id` (string, required)
- `message` (string, required)

### `hide_comment` (~45 tokens)

Hide (or unhide) a comment from public view. hide=false unhides.

Input parameters:

- `account`
- `comment_id` (string, required)
- `hide` (boolean)

### `delete_comment` (~40 tokens)

Permanently delete a comment you own (or a comment on your media). Irreversible.

Input parameters:

- `account`
- `comment_id` (string, required)

### `search_hashtag` (~37 tokens)

Resolve a hashtag name to its Graph id (needed before get_hashtag_media).

Input parameters:

- `account`
- `hashtag` (string, required)

### `get_hashtag_media` (~91 tokens)

Recent or top media for a hashtag id. edge=top_media|recent_media. limit 1-100.

Get the hashtag_id from search_hashtag first. Subject to Meta's 30-unique-hashtags
per-7-days query limit per account.

Input parameters:

- `account`
- `edge` (string)
- `hashtag_id` (string, required)
- `limit` (integer)

### `get_mentions` (~34 tokens)

List recent media where the account is @-mentioned (tags edge).

Input parameters:

- `account`
- `limit` (integer)

### `business_discovery` (~88 tokens)

Public profile + (optionally) recent media for ANY business/creator account by username.

Read-only competitor/prospect research via the business_discovery edge. Only works for
Professional accounts (not personal). with_media pulls up to media_limit recent posts.

Input parameters:

- `account`
- `media_limit` (integer)
- `username` (string, required)
- `with_media` (boolean)

### `list_conversations` (~37 tokens)

List Instagram DM conversations. REQUIRES Meta App Review (instagram_manage_messages).

Input parameters:

- `account`
- `limit` (integer)

### `get_messages` (~46 tokens)

Read messages in a DM conversation. REQUIRES Meta App Review (instagram_manage_messages).

Input parameters:

- `account`
- `conversation_id` (string, required)
- `limit` (integer)

### `send_message` (~85 tokens)

Send a DM. REQUIRES Meta App Review + the 24-hour standard-messaging window.

recipient_id is the IGSID (Instagram-scoped user id) of the recipient. Outside the
24h customer-service window a paid message tag is required (not handled here).

Input parameters:

- `account`
- `recipient_id` (string, required)
- `text` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/adelaidasofia-instagram-mcp/adelaidasofia-instagram-mcp#diagnostics

## Score history

- 2026-08-05: 36
- 2026-08-04: 36
- 2026-08-03: 36
- 2026-08-02: 36
- 2026-08-01: 21
- 2026-07-31: 21
- 2026-07-30: 26
- 2026-07-29: 44
- 2026-07-28: 24
- 2026-07-27: 24

## Links

- PyPI project: https://pypi.org/project/adelaidasofia-instagram-mcp/
- Socket report: https://socket.dev/pypi/package/adelaidasofia-instagram-mcp
- Repository: https://github.com/adelaidasofia/instagram-mcp
- Website: https://diazroa.com/
- Changelog RSS feed: https://verifymcp.io/servers/adelaidasofia-instagram-mcp/adelaidasofia-instagram-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/adelaidasofia-instagram-mcp/adelaidasofia-instagram-mcp.json
- HTML version of this page: https://verifymcp.io/servers/adelaidasofia-instagram-mcp/adelaidasofia-instagram-mcp