William Gao Instagram MCP

Quick Verdict

William Gao Instagram MCP is a Python community project that exposes Meta’s Instagram Platform API with Instagram Login through a local stdio MCP server. It can connect clients such as Claude Desktop, Claude Code, and Cursor to profile, media, publishing, comments, insights, and messaging operations. It is not made, endorsed, or supported by Meta or Instagram, and it is not a mature managed social-media platform. The repository has no formal GitHub releases and should be treated as early Alpha software for developer evaluation on a dedicated test account.

Its useful architectural choice is an Instagram Login core path using an IGAA... token. A Professional Instagram account can use that path without first linking a Facebook Page. Optional business discovery and hashtag capabilities use a second Facebook Graph path and require an EAA... Page token plus the linked Instagram Business Account ID. The repository currently uses inconsistent count labels such as 28 total with 25 working and a 25-tool catalog, so the number should not become a procurement promise. Inspect tools/list on the exact pinned checkout and verify each tool against the Meta permissions actually granted to the app.

Do not run pip install instagram-mcp expecting this project. The PyPI name belongs to AleemHaider and points to a different repository with a different authentication model; its current releases are also yanked. William Gao’s project must be installed from a source clone into a virtual environment with pip install -e .. Finally, an official API does not create a zero-ban or zero-risk guarantee. Meta can still limit, revoke, review, or disable access under its Platform Terms, permissions, rate limits, content rules, app status, and account enforcement systems.

Best For

• Python developers who understand Meta developer apps, OAuth scopes, long-lived tokens, and App Review.
• Small marketing-technology teams testing official Instagram automation against a low-value Professional account.
• Business or Creator account owners willing to keep publishing and messaging behind human approval.
• Engineers comparing Instagram Login with the optional Facebook Graph path for discovery requirements.
• It is not suitable for personal accounts, password-based consumer automation, unattended control of a critical brand account, or teams requiring a support SLA and established production history.

A Meta app in Development mode can be useful for initial testing with accounts assigned an app role such as administrator, developer, or tester. An application serving other users generally needs the relevant App Review and Advanced Access. That distinction means a successful developer-account demo is not evidence that a customer-facing multi-account product is ready to launch.

Key Features

• Instagram Login core: an IGAA... long-lived token supports Professional-account profile, media, mentions, active stories, publishing, comments, and insights according to granted scopes.
• Publishing operations: the repository implements image, video, Reel, and carousel workflows. Meta generally retrieves media from public HTTPS URLs, so storage and URL access are separate dependencies.
• Comment moderation: read, reply to, delete, or hide comments and toggle comments on media. Each operation should verify the account, media ID, comment ID, and intended action.
• Messaging: conversation reads and DMs require instagram_business_manage_messages Advanced Access, Meta App Review, and compliance with messaging windows and related rules.
• Optional Facebook Graph extras: an EAA... Page token and linked IG account can unlock business discovery and hashtag search that Instagram Login does not expose.
• Token lifecycle support: long-lived IGAA tokens still expire and require refresh monitoring; a fully invalid token or expired data-access authorization normally needs interactive reauthorization.
• Standard local stdio server: a client launches the virtual environment’s Python with -m instagram_mcp and injects required secrets into the process environment.

Use Cases

Start with a dedicated Professional test account and a separate Meta developer app. Grant the minimum scopes and expose only token validation, profile, media, and insight reads to the MCP client. Verify response fields, pagination, Graph API errors, rate behavior, and token refresh before adding comment replies. This sequence establishes whether the account and app configuration work without immediately granting an agent the ability to publish or contact users.

Publishing should begin with test content. Validate that the media URL is publicly reachable by Meta, then inspect container processing, caption limits, tags, publishing quota, and retry behavior. Before the final create call, the client should show the full account, URL, caption, media type, collaborators, and other consequential parameters to a human. Do not let the model treat a successful upload container as proof that the final post was published correctly.

DMs, comment deletion, comment hiding, and all publishing calls have external side effects. Configure a tool allowlist in the MCP host and apply independent authorization to the target account, media, recipient, and body. Captions, profiles, comments, and DMs are untrusted text that can contain prompt injection. They must not be allowed to request token disclosure, invoke unrelated tools, change the approved account, or bypass confirmation. Logs must redact IGAA tokens, EAA tokens, app secrets, recipient identifiers, and user content according to policy.

If business discovery or hashtag research is required, the organization must accept the Facebook Page linkage and additional Page-token permissions. “No Facebook Page for Instagram Login” applies to the core path, not every feature. Teams also remain responsible for Meta Platform Terms, Instagram Community Guidelines, App Review representations, data-use checks, deletion obligations, privacy notices, and content or advertising rules. Official endpoints reduce the specific risk associated with private mobile APIs, but they do not approve an automation strategy.

Pricing

The repository is MIT licensed and its server source has no license fee. Real costs include operating a Meta developer app, model and MCP client usage, public media hosting, secret management, token refresh jobs, logging, App Review, privacy work, and human approvals. Meta’s fields, rate limits, permissions, and review requirements can change, so the target app’s current dashboard and official documentation are authoritative.

There is no William Gao package on PyPI and no GitHub Release for the repository. The main branch is the product surface and may change without a stable release contract. A serious evaluation should pin a commit SHA, record Python dependencies, run the repository tests, inspect tools/list, and compare environment variables and Graph API versions before every upgrade. Similar package names are especially dangerous here because instagram-mcp on PyPI installs someone else’s implementation.

Calling the API may not carry a direct per-call fee, but that does not make the production system free. Review and compliance labor can exceed hosting cost, especially for messaging and multi-tenant access.

Pros

• Uses Meta’s official Instagram APIs rather than passwords, session cookies, or private mobile scraping.
• Core Instagram Login workflows do not require a linked Facebook Page.
• An optional Facebook Graph route can add discovery and hashtag capabilities when a Page is acceptable.
• Profile, media, publishing, comments, insights, and messaging provide a broad experimental surface.
• MIT source can be reviewed and pinned for a local stdio MCP deployment.
• Documentation exposes important prerequisites such as Professional accounts, scopes, review, and token refresh.

Cons

• Early Alpha project with no formal releases or mature adoption evidence; it is not recommended for direct production use.
• Community-maintained and not an official Meta product, so compatibility and support depend on the repository.
• The PyPI name belongs to a different author, making accidental installation of the wrong server likely.
• Professional accounts, a Meta app, long-lived tokens, scopes, and review create a substantial setup burden.
• Messaging, discovery, and hashtag functions introduce additional review, Page-linkage, token, and policy requirements.
• Official API use cannot guarantee zero bans, uninterrupted access, or approval of automated behavior.
• Publish, delete, hide, and DM tools can affect real users and need approval, audit, and prompt-injection controls.
• Access to Meta developer services and Graph APIs may be unreliable or unavailable from some regions and enterprise networks.

Alternatives

FAQ

Is this an official Meta or Instagram MCP server?

No. William Gao maintains a community repository that calls official Meta APIs. Meta does not author, endorse, support, or provide a maintenance commitment for this MCP server.

Why should I not install instagram-mcp from PyPI?

That PyPI name belongs to AleemHaider and installs a different repository and authentication design. Clone William-Gao/instagram-mcp, pin a commit, create a virtual environment, and run pip install -e . from that source tree.

Can it operate a personal Instagram account?

Not directly. The prerequisites require a Professional account, meaning Business or Creator, plus a Meta developer app, the Instagram product, appropriate scopes, and a long-lived token.

Does every feature work without a Facebook Page?

No. Instagram Login covers the core path without a Page. Business discovery and hashtag tools use the Facebook Graph API and require Page linkage, a Page token, and the linked Instagram Business Account ID.

Does using an official API guarantee that the account cannot be banned?

No. It avoids one category of private-API risk, but Meta still enforces its Platform Terms, permissions, rate limits, content policies, app status, and account rules. A zero-ban claim is unsupported.

Can messaging and a customer-facing multi-account app launch immediately?

Usually not. Messaging needs Advanced Access and App Review and remains subject to messaging-window rules. Authorization by users outside the app’s assigned roles also brings review, privacy, and data-handling requirements.

Bottom Line

William Gao Instagram MCP is an interesting community implementation of Instagram Login with optional Facebook Graph extras, but it remains early Alpha rather than an official Meta integration or mature SaaS. Install it only from a pinned source clone because the PyPI name is occupied by another project. Use a dedicated Professional test account, a separate Meta app, minimum scopes, protected tokens, and human confirmation for every publishing, moderation, or messaging action. App Review, token lifecycle, Page linkage, messaging windows, Platform Terms, and content policy remain in force, and official APIs cannot provide a zero-ban promise. Its recommended: false status reflects that gap between useful developer experimentation and a production social-account control plane.