Instagram Server NextSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server for fetching Instagram posts using Chrome's existing login session.
Features
- Modular architecture with clear separation of concerns
- Type-safe implementation using TypeScript
- Improved error handling and logging
- Configurable through environment variables
- JSON-RPC 2.0 compliant communication
- Automatic media downloading and metadata generation
- SEO-friendly description generation
Architecture
The server follows a modular architecture with the following structure:
src/ ├── core/ # Core MCP functionality │ ├── mcp/ # MCP server implementation │ │ ├── server.ts # Server class │ │ ├── stdio.ts # StdioServerTransport │ │ └── index.ts # Barrel exports │ ├── types/ # Core type definitions │ │ └── mcp.ts # MCP types │ └── utils/ # Utility functions │ ├── config.ts # Configuration management │ └── errors.ts # Error handling ├── features/ # Feature modules │ └── instagram/ # Instagram feature │ ├── types.ts # Instagram types │ ├── utils/ # Feature utilities │ │ ├── media.ts # Media handling │ │ ├── post.ts # Post processing │ │ └── seo.ts # SEO generation │ └── instagram.service.ts # Instagram service ├── services/ # Shared services │ └── browser/ # Browser service │ ├── types.ts # Browser types │ └── browser.service.ts # Browser service ├── index.ts # Entry point └── server.ts # Main server class
Configuration
The server requires the following environment variables:
CHROME_USER_DATA_DIR: Path to Chrome user data directory containing login session
Additional configuration options are available through the config manager:
- Browser settings (viewport,
a682c46e48f8OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add instagram-server -- npx -y [email protected]
{
"mcpServers": {
"instagram-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (3)
2 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_instagram_posts | read | Get recent posts from an Instagram profile using existing Chrome login |
get_post_data | write | Get detailed data from an Instagram post |
get_profile_data | read | Get comprehensive data from an Instagram profile |
Trust audit
SAFEgrade B · trust 85/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (9)
browserURL: `http://127.0.0.1:${this.config.debugPort}`,.cline.rules
import { Server, StdioServerTransport, ErrorCode, McpError, McpRequest } from '../../core/mcp/server';import { ConfigManager } from '../../core/utils/config';import { IInstagramPost } from '../../core/types/instagram.js';import { ConfigManager } from '../../core/utils/config.js';import { InstagramError, handleClassAsyncErrors } from '../../core/utils/errors.js';@modelcontextprotocol/sdk, axios, playwright, puppeteer, zod, @types/debug, @types/node, @typescript-eslint/eslint-plugin
Gates applied: no_behavioural_pass, no_license.
a682c46e48f8full audit observations/trust-audit/mcp-server/duhlink__instagram-server-next.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a682c46e48f8 | SAFE | B | 85 | first audit |
Questions
What tools does Instagram Server Next expose?
3 in total: 2 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Instagram Server Next safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (85/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Instagram Server Next need?
No credential environment variables were found in its source, so it appears to need none.
How does Instagram Server Next run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as instagram-server at 0.2.0.
How current is this page?
The grade is for one exact copy of the source (a682c46e48f8), read on 2026-10-08. The repository is watched and re-audited when it changes.