Skip to content

nabuxai/nabu-threads

v0.1.0

Manage connected Threads accounts and supported content workflows.

GitHubOpen Website

Community source release (MIT). Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

Threads MCP by Nabux

Multi-user, multi-account MCP gateway powered by Meta's official Threads API.

  • Production target: https://threads.nabuxai.com
  • MCP: https://threads.nabuxai.com/mcp
  • OAuth callback: https://threads.nabuxai.com/threads/callback

Capabilities

  • Connect multiple Threads accounts with Meta OAuth.
  • Encrypt long-lived Threads tokens at rest and refresh them automatically.
  • OAuth 2.1 + PKCE for ChatGPT, Claude, Cursor and MCP clients.
  • Publish text, image and video Threads posts.
  • Read a user's Threads posts.
  • Read/respond to replies, hide/unhide replies and approve/ignore pending replies.
  • Read mentions and perform official keyword/topic search.
  • Read account and post insights.
  • Opaque th_... Account Keys for trusted Nabux integrations.

MCP tools

threads_accounts, threads_profile, threads_list_posts, threads_publish_text, threads_publish_image, threads_publish_video, threads_get_replies, threads_reply, threads_hide_reply, threads_manage_pending_reply, threads_mentions, threads_keyword_search, threads_account_insights, threads_post_insights.

Meta setup

Create a Meta app with the Threads use case and configure the exact redirect:

https://threads.nabuxai.com/threads/callback

Default scopes:

threads_basic
threads_content_publish
threads_read_replies
threads_manage_replies
threads_manage_insights
threads_keyword_search
threads_manage_mentions

The gateway uses https://graph.threads.net. Short-lived tokens are exchanged for long-lived Threads tokens and refreshed before expiry.

Coolify

Deploy this branch with docker-compose.coolify.yml, domain threads.nabuxai.com, container port 8000, persistent /data volume, and set:

PUBLIC_BASE_URL=https://threads.nabuxai.com
APP_SECRET_KEY=<random 32+ chars>
TH_APP_ID=<Threads App ID>
TH_APP_SECRET=<Threads App Secret>
TH_REDIRECT_URI=https://threads.nabuxai.com/threads/callback
INTERNAL_SERVICE_TOKEN=<random server-to-server secret>

Do not commit secrets. Rotating APP_SECRET_KEY invalidates the ability to decrypt existing stored platform tokens.

NabuGen/internal API

GET  /internal/v1/accounts/{account_key}
POST /internal/v1/accounts/{account_key}/publish/text
POST /internal/v1/accounts/{account_key}/publish/image

Requests require Authorization: Bearer <INTERNAL_SERVICE_TOKEN>.

Security

  • No password/session/cookie automation.
  • Platform access uses Meta's supported Threads API.
  • Platform tokens encrypted at rest.
  • MCP bearer/refresh tokens stored as hashes.
  • Account resolution is owner-scoped.
  • AI clients never receive the Meta token.

Status

Code is production-shaped and CI-tested. Real end-to-end authorization/publishing still requires a configured Meta app, the required permissions/access levels, HTTPS/DNS, and a real Threads account.