# meta-ads-mcp

> MCP server to manage Facebook and Instagram Ads (Meta Ads)

- **URL**: https://www.freshcrate.ai/projects/meta-ads-mcp
- **Author**: pipeboard-co
- **Category**: MCP Servers
- **Latest version**: `1.0.115` (2026-06-05)
- **License**: NOASSERTION
- **Source**: https://github.com/pipeboard-co/meta-ads-mcp
- **Language**: Python
- **GitHub**: 801 stars, 186 forks
- **Registry**: github
- **Tags**: `python`

## Description

MCP server to manage Facebook and Instagram Ads (Meta Ads)

## Recent releases

| Version | Date | Urgency | Changes |
| --- | --- | --- | --- |
| `1.0.115` | 2026-06-05 | High | Security: fixes GHSA-45gf-fjxp-cjpq — Server-Side Request Forgery (SSRF, High) in `upload_ad_image`. A caller-supplied `image_url` was fetched server-side without host/IP validation, allowing requests to loopback, private-network, and cloud-metadata addresses. **Upgrade strongly recommended** for anyone running the `streamable-http` transport.  **What changed** - Restrict server-side image fetches to `http`/`https` URLs that resolve to public addresses; block private, loopback, link-local, reser |
| `1.0.113` | 2026-05-29 | High | ## What's Changed * fix(auth): distinguish policy-blocked errors from token expiry by @nictuku in https://github.com/pipeboard-co/meta-ads-mcp/pull/134  **Full Changelog**: https://github.com/pipeboard-co/meta-ads-mcp/compare/1.0.112...1.0.113 |
| `1.0.110` | 2026-05-23 | High | ## What is new  `get_image_by_hash(account_id, image_hash)` — new tool to view a Meta image given only its hash. Use when you have a hash from upload_ad_image, bulk_upload_ad_images, get_creative_details, or get_ad_creatives but no ad_id.  Docs: get_ad_image and upload_ad_image now cross-reference the new tool. |
| `1.0.109` | 2026-05-20 | High | Security: fixes GHSA-9gw6-46qc-99vr (operator token exposure on streamable-HTTP transport). Upgrade strongly recommended for any self-hosted deployment running `--transport streamable-http` on a network-reachable port.  ## Changes  - HTTP middleware now returns 401 + `WWW-Authenticate: Bearer` when no `Authorization: Bearer` or `X-PIPEBOARD-API-TOKEN` header is present, instead of falling through to tool handlers using the `META_ACCESS_TOKEN` env var as an implicit fallback. - Graph API error pa |
| `1.0.103` | 2026-05-14 | High | Fix CALL_NOW phone_number serialization on create_ad_creative.  Meta Marketing API v24 rejects a literal phone_number key inside call_to_action.value with error 100 ("Invalid keys phone_number were found in param call_to_action[value]"). The supported shape for click-to-call creatives is call_to_action.value.link = "tel:<E.164 number>".  - Updates all six CALL_NOW serialization paths in create_ad_creative: existing-post + asset_customization_rules, existing-post simple, DOF/PLACEMENT asset_feed_ |
| `v1.0.101` | 2026-05-12 | High | feat(campaigns): add adset_budgets to update_campaign for CBO to ABO migration  Disabling Advantage Campaign Budget (CBO) and reassigning budgets at the ad set level (ABO) is now exposed via a new adset_budgets parameter on update_campaign. Pass a list of {adset_id, daily_budget} objects and Meta atomically removes the campaign-level budget while assigning the supplied per-ad-set daily budgets in a single call (Meta's documented migration mechanism).  The legacy use_adset_level_budgets=true flag |
| `v1.0.99` | 2026-05-08 | High | Expand create_campaign tool description. |
| `v1.0.97` | 2026-05-05 | High | fix(insights): override action_breakdowns=[] when breakdown=media_type to avoid Meta (action_type, media_type) collision; add action_breakdowns parameter for caller-side override |
| `v1.0.93` | 2026-04-30 | High | feat(duplicate_creative): add new_creative_features_spec override param  Lets callers pass individual feature opt-ins/opt-outs on the duplicate (e.g. image_touchups, image_uncrop, text_optimizations, video_auto_crop with {enroll_status: OPT_IN \| OPT_OUT}). Pairs with the pipeboard.co side that now surfaces a structured warning when standard_enhancements gets stripped from the source creative (Meta deprecated this key on POST per error_subcode 3858504).  PR #102. |
| `v1.0.90` | 2026-04-22 | High | docs(ads): reword DOF-downgrade warning to name PAC, not is_dynamic_creative (#95) |

## Citation

- HTML: https://www.freshcrate.ai/projects/meta-ads-mcp
- Markdown: https://www.freshcrate.ai/projects/meta-ads-mcp.md
- Dependencies JSON: https://www.freshcrate.ai/api/projects/meta-ads-mcp/deps

_Generated by freshcrate.ai. Indexes github releases for AI-agent ecosystem packages._