insta-mcp

This project utilizes the `instagram-private-api`, which is an unofficial API client. Use of this client carries inherent risks, including potential violations of Instagram's Terms of Service and the risk of account suspensions or permanent bans. The server attempts to mitigate some risks with built-in rate limiting and robust error handling for Instagram's security challenges (e.g., checkpoints, 2FA, spam blocks). Credentials can be stored in `data/credentials.json`, which is less secure than environment variables if the file is not properly protected. The `uploadAlbum` tool fetches image/video URLs from external sources, which could lead to SSRF or fetching malicious content if LLM input is not carefully constrained. Media upload tools (`upload_photo`, `upload_video`, `upload_reel`) require absolute file paths, posing a risk if an attacker can control these paths to access arbitrary files on the server's filesystem.