mcp-instagram

The server correctly loads Instagram credentials (username, password) from environment variables (IG_USERNAME, IG_PASSWORD), preventing hardcoded secrets. Session data for `instagram-private-api` is persisted locally in `data/session.json` within the project directory, which is standard for local session management but means the user is responsible for securing this file. There are no obvious signs of arbitrary code execution (e.g., `eval` or `child_process.exec` on user input) or network-exposed vulnerabilities beyond its stdio interface designed for local client communication. The use of an unofficial Instagram API is explicitly disclosed as a risk to account status, but this is inherent to the chosen underlying library, not a direct vulnerability in the server's implementation.