ToolTrust
C40/100
Smithery

node2flow-facebook-pages

mcpsmithery

@Smithery

MCP server for Facebook Pages API — manage posts, comments, photos, videos, insights, and Messenger conversations through 28 tools. ## Features - Create, update, delete, and schedule posts - Upload photos and videos from URL - Comment management and moderation (reply, hide, delete) - Page insights and post analytics - Messenger conversations (list, read, send messages, typing indicator) - Multi-page support with per-page access tokens ## 28 Tools **Pages (3)**: List managed pages, get page info, get page access token **Posts (6)**: List, get, create, update, delete, schedule posts **Comments (5)**: List, create, reply, delete, hide/unhide comments **Photos (3)**: Upload from URL, list, delete **Videos (3)**: Upload from URL, list, delete **Insights (4)**: Page insights, post insights, fan demographics, page views **Conversations (4)**: List conversations, get messages, send message, typing indicator ## Configuration - `FACEBOOK_PAGE_ACCESS_TOKEN` (required) — Page Access Token with pages_manage_posts, pages_manage_engagement, read_insights, pages_messaging permissions - `FACEBOOK_PAGE_ID` (optional) — Page ID, auto-detected from token if not set

By Smithery | 47 findings | Scanned 4/19/2026 | tooltrust-scanner/v0.3.8

5 High10 Medium4 Low28 Info

Risk Summary

Needs Approval

Dep Visibility plus Excessive Permissions raises enough risk that this tool should not be auto-trusted.

Potential impact: This finding indicates the tool should be reviewed before it is trusted.

Recommended action: Keep this tool behind manual approval and avoid unattended runs until the risky capabilities are narrowed or removed.

Suggested policy: keep this tool behind manual approval, do not allow unattended runs, and re-scan after narrowing risky permissions.

Security Findings (47)

  • HighAS-002

    ⚠️Excessive Permissions ×5

    tool declares network permission

    fb_upload_photofb_list_photosfb_upload_videofb_list_videos

    tool declares exec permission

    fb_upload_video

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • MediumAS-002

    ⚠️Excessive Permissions ×10

    tool declares fs permission

    fb_create_postfb_update_postfb_delete_postfb_create_commentfb_delete_commentfb_upload_photofb_delete_photofb_upload_videofb_delete_videofb_get_page_views

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • LowAS-011

    ℹ️Missing Rate-Limit / Timeout ×4

    tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

    fb_upload_photofb_list_photosfb_upload_videofb_list_videos

    Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

  • InfoAS-014

    ℹ️Dependency Inventory Unavailable ×28

    Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

    fb_list_pagesfb_get_pagefb_get_page_tokenfb_list_postsfb_get_postfb_create_postfb_update_postfb_delete_postfb_schedule_postfb_list_commentsfb_create_commentfb_reply_commentfb_delete_commentfb_hide_commentfb_upload_photofb_list_photosfb_delete_photofb_upload_videofb_list_videosfb_delete_videofb_get_page_insightsfb_get_post_insightsfb_get_page_fansfb_get_page_viewsfb_list_conversationsfb_get_messagesfb_send_messagefb_send_typing

    Fix: Review and remediate the identified issue.

Scan this tool yourself

Reproduce this audit locally, integrate into CI, or let your agent audit its own tools.

Install once, then scan any MCP server:

$ curl -sfL https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-scanner/main/install.sh | bash
$ tooltrust-scanner scan --server "npx -y node2flow-facebook-pages"

Adjust the package name if your npm registry name differs from the tool ID. View source

Add badge to your README

Copy this Markdown to show your ToolTrust grade on GitHub.

[![ToolTrust Grade C](https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-directory/main/docs/badges/grade-c.svg)](https://github.com/AgentSafe-AI/tooltrust-directory)