
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@cesteral/meta-mcp
Advanced tools
Meta Ads MCP Server - Campaign entity management and reporting via the configured Meta Graph API (default: v25.0)
Meta Ads MCP Server - Campaign management via the configured Meta Graph API (default: v25.0).
Management server for Meta Ads. Provides full CRUD operations, performance insights, targeting discovery, bulk operations, and specialized features like entity duplication and delivery estimates. Designed for AI agents to manage Meta Ads campaigns programmatically through the Model Context Protocol with per-session Bearer token authentication.
Self-host quickstart | Compare OSS vs Cesteral Intelligence | Book a workflow demo
MetaBearerAuthStrategy (validates tokens against GET /me)@hono/mcpRateLimiter class (200/min default, writes cost 3x)meta_list_entitiesList Meta Ads entities with optional filtering and cursor-based pagination.
Parameters:
entityType (string, required): Type of entity to listadAccountId (string, required): Ad Account ID (with or without act_ prefix)fields (string[], optional): Field names to returnfiltering (array, optional): Filter objects in Meta filtering formatlimit (number, optional): Results per page (1-100, default 25)after (string, optional): Cursor for next pagemeta_get_entityGet a single Meta Ads entity by ID.
Parameters:
entityType (string, required): Type of entity to retrieveentityId (string, required): The entity IDfields (string[], optional): Field names to returnmeta_create_entityCreate a new Meta Ads entity.
Parameters:
entityType (string, required): Type of entity to createadAccountId (string, required): Ad Account IDdata (object, required): Entity fields as key-value pairsmeta_update_entityUpdate an existing Meta Ads entity (POST with PATCH semantics).
Parameters:
entityType (string, optional): Type of entity to update (informational only, not used in API call)entityId (string, required): The entity ID to updatedata (object, required): Fields to update as key-value pairsmeta_delete_entityDelete a Meta Ads entity.
Parameters:
entityType (string, required): Type of entity to deleteentityId (string, required): The entity ID to deletemeta_list_ad_accountsList ad accounts accessible to the authenticated user.
Parameters:
fields (string[], optional): Field names to return (defaults to id, name, account_status, currency, timezone_name, amount_spent, balance)limit (number, optional): Number of accounts to return (1-100)after (string, optional): Pagination cursor from previous responseAll Meta reporting tools (
meta_get_insights,meta_get_insights_breakdowns, and themeta_download_reporttool used in async report flows) return data using the shared bounded report-view contract:mode("summary"default — headers + counts + 10-row preview, or"rows"for a paginated rows page),columns(project to selected columns),offset(zero-based pagination), andmaxRows(page size; default 10 for summary, 50 for rows; hard cap 200).limitandafterremain available for cursoring across upstream Meta pages.
meta_get_insightsGet performance insights for a Meta Ads entity (account, campaign, ad set, or ad).
Parameters:
entityId (string, required): Entity ID to get insights forfields (string[], optional): Metrics/fields to returndatePreset (string, optional): Date preset (today, yesterday, last_7d, last_30d, etc.)timeRange (object, optional): Object with since and until (YYYY-MM-DD)timeIncrement (string, optional): Granularity (1 for daily, 7 for weekly, monthly, all_days)level (string, optional): Aggregation level (account, campaign, adset, ad)limit (number, optional): Upstream Meta page size (1-500). Use maxRows to control the bounded view's returned-row count.after (string, optional): Cursor for next upstream pagemode, columns, offset, maxRows (optional): Bounded report-view params (see note above)meta_get_insights_breakdownsGet performance insights broken down by dimension (age, gender, country, device, etc.).
Parameters:
entityId (string, required): Entity ID to get insights forbreakdowns (string[], required): Breakdown dimensions (e.g., ['age', 'gender'])fields (string[], optional): Metrics to returndatePreset (string, optional): Date presettimeRange (object, optional): Object with since and untiltimeIncrement (string, optional): Time granularitylevel (string, optional): Aggregation levelactionAttributionWindows (string[], optional): Attribution windows (e.g., ['1d_click', '7d_click'])limit (number, optional): Upstream Meta page size (1-500). Use maxRows for bounded-view row count.after (string, optional): Cursor for next upstream pagemode, columns, offset, maxRows (optional): Bounded report-view params (see note above)meta_bulk_update_statusBatch update status for multiple Meta Ads entities.
Parameters:
entityType (string, optional): Type of entities to update (informational only, not used in API call)entityIds (string[], required): Entity IDs to update (max 50)status (string, required): ACTIVE, PAUSED, or ARCHIVEDmeta_bulk_create_entitiesBatch create multiple entities of the same type.
Parameters:
entityType (string, required): Type of entities to createadAccountId (string, required): Ad Account IDitems (array, required): Array of entity data objects (max 50)meta_bulk_update_entitiesBatch update multiple entities with individual data payloads.
Parameters:
entityType (string, optional): Type of entities being updated (informational only, not used in API call)items (array, required): Array of update items (max 50), each with entityId and datameta_search_targetingSearch for targeting options (interests, behaviors, demographics) by keyword.
Parameters:
type (string, required): Search type (adinterest, adinterestsuggestion, adgeolocation, adlocale, etc.)query (string, required): Search keywordlimit (number, optional): Max results (1-100, default 25)meta_get_targeting_optionsBrowse available targeting categories for an ad account.
Parameters:
adAccountId (string, required): Ad Account IDtype (string, optional): Filter by targeting type (e.g., interests, behaviors)meta_duplicate_entityDuplicate a campaign, ad set, or ad via POST /{id}/copies.
Parameters:
entityType (string, required): Type of entity to duplicate (campaign, adSet, ad)entityId (string, required): ID of the entity to duplicaterenameOptions (object, optional): Object with prefix and/or suffix for namingstatusOption (string, optional): Status for copy (ACTIVE, PAUSED, INHERITED)meta_get_delivery_estimateGet estimated audience size and delivery estimates for a targeting spec.
Parameters:
adAccountId (string, required): Ad Account IDtargetingSpec (object, required): Targeting specification (must include geo_locations or custom_audiences)optimizationGoal (string, optional): Optimization goal (e.g., LINK_CLICKS, REACH, CONVERSIONS)meta_get_ad_previewGet preview HTML for an ad in a specific format.
Parameters:
adId (string, required): Ad ID to previewadFormat (string, required): Ad format (e.g., DESKTOP_FEED_STANDARD, MOBILE_FEED_STANDARD, INSTAGRAM_STANDARD)meta_adjust_bidsBatch adjust ad set bid amounts with percentage or absolute changes.
Parameters:
adAccountId (string, required): Ad Account IDadjustments (array, required): Array of bid adjustments (max 50), each with adSetId, adjustmentType (percentage/absolute), and valuemeta_validate_entityClient-side validation of entity payloads without making API calls.
Parameters:
entityType (string, required): Type of entity to validatemode (string, required): Validation mode (create or update)data (object, required): Entity data to validateadAccountId (string, optional): Required for create modeentityId (string, optional): Required for update mode| Entity Type | API Object | Notes |
|---|---|---|
campaign | Campaign | Top-level entity under ad account |
adSet | Ad Set | Targeting, budget, schedule, bidding |
ad | Ad | Links ad creative to ad set |
adCreative | Ad Creative | Creative content (images, videos, copy) |
customAudience | Custom Audience | Lookalike, website, customer list audiences |
Entity Hierarchy: Ad Account > Campaign > Ad Set > Ad (+ Ad Creatives, Custom Audiences)
Phase: Production-Ready
All listed tools are fully implemented using the configured Meta Graph API with Bearer token authentication, insights reporting, and targeting discovery.
# Install dependencies
pnpm install
# Run in development mode
pnpm run dev:http
# Build
pnpm run build
# Start production server
pnpm run start
# Type check
pnpm run typecheck
META_MCP_PORT: Server port (default: 3005)META_MCP_HOST: Server host (default: 127.0.0.1)MCP_AUTH_MODE: Authentication mode - meta-bearer (default), jwt, or noneMCP_AUTH_SECRET_KEY: Required when MCP_AUTH_MODE=jwtMETA_API_BASE_URL: Graph API base URL (default: https://graph.facebook.com/v25.0)META_API_VERSION: API version (default: v25.0)META_RATE_LIMIT_PER_MINUTE: Rate limit ceiling (default: 200)META_ACCESS_TOKEN: Access token for stdio modeMETA_VIDEO_UPLOAD_MAX_BUFFERED_BYTES: Max buffered video upload size in bytes (default: 268435456)MetaGraphApiClient - HTTP client for the configured Graph API version with form-encoded POST for writesMetaService - CRUD, bulk ops, duplication, delivery estimates, ad previewsMetaInsightsService - Insights queries with breakdowns, attribution windows, and time seriesMetaTargetingService - Targeting search and category browsingMetaBearerAuthStrategy - Bearer token auth via GET /me validationMetaAuthAdapter - Token management for per-session API callsSessionServiceStore - Per-session service instances keyed by session ID1000 = $10.00)special_ad_categories is required on campaign creation even if empty ([])meta_update_entity returns {success: true} — fetch the entity after to confirm changestargeting on ad sets replaces entirely on update (no merge semantics)ARCHIVED status is permanent and cannot be reversedStreamable HTTP via Hono + @hono/mcp. Health check at /health.
See root CLAUDE.md for development guidelines, build system details, and monorepo conventions. See the root README for full architecture context.
Self-host: Follow the deployment guide to run this server on your own infrastructure.
Cesteral Intelligence: Request access -- governed execution with credential brokering, approvals, audit, and multi-tenant access.
Book a workflow demo: See it in action with your own ad accounts.
Compare options: OSS connectors vs Cesteral Intelligence
Apache License 2.0 — see LICENSE for details. This package is part of Cesteral's open-source connector layer; managed hosting and higher-level governance features live outside this repository.
FAQs
Meta Ads MCP Server - Campaign entity management and reporting via the configured Meta Graph API (default: v25.0)
The npm package @cesteral/meta-mcp receives a total of 19 weekly downloads. As such, @cesteral/meta-mcp popularity was classified as not popular.
We found that @cesteral/meta-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.