get_ad_accounts
List accessible Meta ad accounts for the connected workspace.
LABSCO SUMMARY
Built for you to host, with the tenancy question answered up front.
The design decision that shapes everything here is that the server refuses to guess who is calling: no JWT, no workspace, no Meta token binding. That is more setup than a single-user server — you supply the auth issuer — but it is the reason one deployment can serve several workspaces without their ad accounts leaking into each other. The /app page exists so you do not have to hand-sign a token just to connect the first account.
What it is
A Cloudflare Worker that speaks MCP over Streamable HTTP and calls the Meta Graph API directly, with browser-facing Meta OAuth routes alongside it. It is multi-tenant by design: Meta connections are stored per workspace in D1, access tokens are encrypted at rest, and every MCP request must carry a JWT your own application issued. The README says the server registers 39 tools; one of them, get_ad_accounts, is named in its docs.
What you get
- Registered tools grouped by domain — account and setup, campaign management, ad set management, creatives and ads, audiences and targeting, reporting and insights, and batch helpers
- The accessible ad accounts for a workspace, once its Meta OAuth flow has completed —
get_ad_accounts - OAuth handled in the Worker:
GET /oauth/meta/startandGET /oauth/meta/callbackbind the resulting Meta token to the workspace named in the caller's JWT, so the start link is never a generic public URL - Per-workspace isolation backed by D1 (
meta_connections,meta_ad_accounts_cache) with short-lived OAuth state in KV - A small admin page at
/appthat takes a password, runs the OAuth flow without you minting a bearer JWT by hand, and shows whether a Meta account is connected - Direct Graph API
fetchcalls rather than the Meta SDK, withMETA_GRAPH_VERSIONdefaulting tov25.0
Requirements
Your own Cloudflare Worker deployment, your own Meta developer app with the Marketing API product added, and your own JWT issuer — the repository ships no hosted control plane, no shared Meta app and no auth provider. Required bindings are a D1 database as META_DB and a KV namespace as META_OAUTH_STATE; required secrets are JWT_SECRET or JWT_JWKS_URL, META_APP_ID, META_APP_SECRET, META_TOKEN_ENCRYPTION_KEY, and APP_UI_PASSWORD for the admin page. Every MCP request needs a bearer JWT carrying sub (or userId) and workspaceId. Default OAuth scopes are ads_management,business_management. The Meta app's callback URL must match https://<your-worker-host>/oauth/meta/callback exactly.
Setup effort
Build from source — git clone https://github.com/brijr/meta-mcp.git
USE CASES
01
Connecting a client's Meta ad account to your product
Issue a JWT for that workspace, send the user through the OAuth start route, and the resulting token is bound to the workspace and encrypted before storage.
02
Reviewing campaign performance in conversation
Use the reporting and insights tools against a connected account instead of exporting from Ads Manager.
03
Building or adjusting campaigns and ad sets
Drive the campaign, ad set and creative tool families from the assistant, with the batch helpers for changes that span many objects.
04
Serving several clients from one deployment
One Worker, one Meta app, a JWT per workspace — connections and cached ad accounts stay separated in D1.
39 tools
Listed in project code.
get_custom_conversions
List custom conversions for an ad account or a specific pixel.
get_pages
List Facebook Pages that can be used with the connected Meta identity.
get_pixels
List Meta Pixels available on an ad account.
validate_account
Run a pre-flight validation check for an ad account.
create_ad_set
Create a Meta ad set under a campaign.
delete_ad_set
Delete a Meta ad set.
duplicate_ad_set
Clone an existing ad set with optional overrides.
get_ad_set
Get a Meta ad set by ID.
list_ad_sets
List ad sets under a campaign.
update_ad_set
Update a Meta ad set.
create_custom_audience
Create a Meta custom audience.
create_lookalike_audience
Create a Meta lookalike audience.
get_audience_size
Estimate audience size for a Meta targeting specification.
get_targeting_options
Search Meta targeting options such as interests and demographics.
list_audiences
List custom and saved Meta audiences.
bulk_create_ads
Create multiple Meta ads in a single tool call.
bulk_update_status
Update status for many Meta objects at once.
clone_campaign_structure
Deep-clone a campaign with its ad sets and ads.
create_campaign
Create a Meta campaign on an ad account.
delete_campaign
Delete or archive a Meta campaign.
get_campaign
Get campaign details by campaign ID.
list_campaigns
List campaigns on an ad account.
update_campaign
Update a Meta campaign.
create_ad
Create a Meta ad under an ad set.
create_ad_creative
Create a Meta ad creative.
get_ad
Get a Meta ad by ID.
get_ad_preview
Generate ad previews for a creative and placement format.
get_video_status
Get processing status for a Meta video asset.
list_ads
List ads under an ad set or campaign.
update_ad
Update a Meta ad.
upload_image
Upload an image to a Meta ad account.
upload_video
Upload a video asset to a Meta ad account.
compare_ads
Compare metrics across multiple Meta ads.
get_ad_metrics
Get key metrics for a Meta ad.
get_adset_metrics
Get key metrics for a Meta ad set.
get_campaign_metrics
Get key metrics for a Meta campaign.
get_conversion_data
Get conversion-focused insight rows for a Meta object.
get_insights
Pull Meta performance insights for a campaign, ad set, or ad.
BEFORE YOU INSTALL
What to know first
Tools you get
39 tools registered in the project's code.
Requires
- Node.js 20+ and pnpm
- A Cloudflare account to deploy the Worker, with a D1 database and a KV namespace
- A Meta developer app with the Marketing API product (its App ID and App Secret are set as Worker secrets)
- A JWT issuer of your own: every MCP request needs a bearer JWT with sub or userId and workspaceId, signed with JWT_SECRET or verifiable at JWT_JWKS_URL
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
Clone the repository and install dependencies (Node.js 20+ and pnpm):
TERMINAL
git clone https://github.com/brijr/meta-mcp.git
cd meta-mcp
pnpm installwrangler.jsonc ships with the author's own Cloudflare account_id, a custom-domain route for meta-mcp.gestalt.xyz, and the IDs of the author's KV namespace and D1 database. Remove account_id and the routes entry (or set your own domain), create your own KV namespace and D1 database, and put the IDs these commands print into the META_OAUTH_STATE and META_DB bindings in wrangler.jsonc (database_name must match the D1 database you create).
TERMINAL
pnpm wrangler kv namespace create META_OAUTH_STATE
pnpm wrangler d1 create meta-mcp-dbSet the required Worker secrets. JWT_SECRET is the secret your own app signs its JWTs with (or set JWT_JWKS_URL instead); META_APP_ID and META_APP_SECRET come from your Meta developer app; META_TOKEN_ENCRYPTION_KEY is any long random string; APP_UI_PASSWORD protects the admin page at /app.
TERMINAL
pnpm wrangler secret put JWT_SECRET
pnpm wrangler secret put META_APP_ID
pnpm wrangler secret put META_APP_SECRET
pnpm wrangler secret put META_TOKEN_ENCRYPTION_KEY
pnpm wrangler secret put APP_UI_PASSWORDApply the D1 schema:
TERMINAL
pnpm wrangler d1 execute META_DB --remote --file schema.sql -yDeploy the Worker with the project's deploy script (pnpm run deploy builds with xmcp and runs wrangler deploy; plain pnpm deploy is a different, built-in pnpm command):
TERMINAL
pnpm run deployNote the public Worker URL and set META_REDIRECT_URI to https://<YOUR_WORKER_HOST>/oauth/meta/callback. In your Meta app, add the Marketing API product and a Website platform whose URL is your Worker origin, set App Domains to your Worker domain, and add the same callback URL.
Connect a Meta ad account: open https://<YOUR_WORKER_HOST>/app, enter APP_UI_PASSWORD and start the Meta sign-in there.
Connect your MCP client to https://<YOUR_WORKER_HOST>/mcp over Streamable HTTP, sending a bearer JWT issued by your app (claims sub or userId, and workspaceId) in the Authorization header. The OAuth connection and the MCP calls must use the same workspaceId.
