Guide · 6 min read
Run your Instagram auto-replies from Claude, Cursor, or the terminal
PostEngage speaks MCP — the Model Context Protocol. Generate one key, drop it into your AI client, and you can run the day-to-day of the app from the same window you write everything else in. This walks through the setup, what the agent can and cannot do, and the controls that keep it safe.
Most of the time you are in your automations because something happened — a rule did not fire, a post is about to go up and you want to pause everything off-brand, a lead came in and you want to see it. And most of the time, you are already in Claude or Cursor when you notice. Switching to a browser, finding the rule, and clicking is friction the agent can remove.
PostEngage exposes its automations over MCP, so your AI client can do the reading and the steering for you. You ask "which of my rules are live?" or "pause the beta-invite rule, I'm posting something unrelated" and it happens, in the window you were already in.
Step 1 — Make a key
A key is how a program proves it is you. Generate one in the app; it is free on every plan.
- Open Settings → Developer.
- Name a key for where it will live — "Claude on my laptop" — and create it.
- Copy the
pe_live_…value now. It is shown once and never again. If you lose it, revoke it and make another; there is nothing to un-hide.
Step 2 — Connect your client
The server is an npm package run with npx, so there is nothing to install. Give
your client the command and your key.
Claude Code — one line:
claude mcp add postengage -- npx -y postengage-mcp
Then set the key in the environment it runs with (POSTENGAGE_API_KEY).
Claude Desktop or Cursor — add the server to the MCP config:
{
"mcpServers": {
"postengage": {
"command": "npx",
"args": ["-y", "postengage-mcp"],
"env": { "POSTENGAGE_API_KEY": "pe_live_…" }
}
}
}
Restart the client and it will list the PostEngage tools. Ask it something simple first — "what's my PostEngage account status?" — to confirm the key works.
To give the agent less, add "POSTENGAGE_READ_ONLY": "1" or
"POSTENGAGE_TOOLSETS": "automations,inbox" to the same env block. The safety
section below explains when to use each.
Step 3 — Use it
Talk to it in plain language. The agent picks the tool.
- "List my automations." You get every rule with its status and counts.
- "Pause the TESTER rule." It finds the id and pauses it. "Resume it" turns it back on.
- "Why didn't my beta-invite rule reply to the last few comments?" It reads the runs and reads back the reason on each — a blocked send, a closed window, an out-of-credits skip.
- "Draft a rule that replies to comments saying PRICE with 'check your DMs'." It creates a draft, and can preview or test it. Nothing goes live until you turn it on.
- "Tag everyone who asked about pricing this week and export them." It reads your leads, adds the tag, and exports the list.
- "Show me the held replies and approve the ones that look right." It lists the review queue and approves or dismisses each one you point at.
What the agent can reach
Every group below is a toolset you can switch on or off.
| Toolset | What it covers |
|---|---|
| accounts | Connection status, plan and credits, media, ice breakers, brand card, sending controls, branded link domain |
| automations | List, read, create, edit, pause, resume, delete, preview, test, rewind |
| activity | The run log, blocked sends, the reason on each run |
| inbox | Conversations, replies, human takeover, suggested replies |
| leads | Leads, tags, notes, details, stages, CSV export |
| broadcasts | Estimate, create and send a one-off message |
| review | Held replies: approve or dismiss |
| knowledge | The sources your AI replies draw on |
| voice | Your voice profile: build, rules, samples, test, roll back |
| insights | Dashboard, reports, link taps |
| notifications | Alerts and credit history |
Where each tool maps to one thing you can already do in the app, the cost is the same as in the app.
What the agent cannot do, and what keeps it safe
Some things never go through a key: signing in, making or revoking keys, billing, plans and add-ons, your team, data export and erasure, and disconnecting an Instagram account. Those need a browser sign-in, so a leaked key cannot touch them. Connecting an account cannot happen inside an agent either, because Instagram's login is a web page; the agent hands you the link to open.
Everything else is reachable, including deletes and sends, and that is why the safety is in your hands, not hidden. Comments, DMs and lead messages are written by strangers, and they flow back into the agent through runs, leads and the inbox. A crafted comment can try to steer an agent that holds a delete tool. Four things work against that:
- Your client asks first. Deletes, sends and broadcasts are marked, so MCP clients stop for your approval. Do not set your client to approve everything.
- Read-only mode.
POSTENGAGE_READ_ONLY=1registers only the tools that read. - Toolsets.
POSTENGAGE_TOOLSETS=automations,inboxregisters only those groups. Leave out the ones you do not need. - Untrusted labels. Text written by strangers comes back marked as untrusted, and the tool descriptions say to treat it as data.
The blog walkthrough shows the config for each.
Two habits that make it work well
Start in read-only mode for a week. Ask it to explain your runs, your leads and your insights, and learn what the agent gets right before it can change anything. Then add the toolsets you need, one at a time, rather than switching everything on at once.
Keep your client set to ask before it runs a tool that deletes or sends. It is a few extra clicks, and it is the control that stands between a strange comment and a message going out in your name. If a request touches many rows, such as tagging forty leads, ask the agent to list what it would change and wait for your yes. For worked prompts, see the setup walkthrough with real prompts, and for the rule behind the replies, the comment-automation guide.
What it costs
Nothing to connect, and the actions cost what they already do: pausing, resuming and drafting are free; an AI-written reply spends a credit whether the model wrote it from the app or because an agent turned a rule on. Broadcasts and the inbox follow the same plan rules as in the app. The MCP does not change the meter — it just moves the switch to where you work.
Start at Settings → Developer, and if you have not built a rule yet, the comment-automation guide is the ten-minute version.
Questions people ask
Does the MCP cost extra?
No. The MCP server and API keys are free on every plan, including Free. What the actions cost is what they already cost in the app: templated replies and pausing are free, an AI-written reply spends a credit, and the inbox and leads need a paid plan. The MCP is a second door to the same metered product, not a separate product.
What can a key actually do?
Almost everything you do in the app day to day: build, edit, pause and delete automations, read runs and the reason for each, work the inbox and take over a conversation, manage leads, send broadcasts, clear held replies, edit knowledge and voice, and read your insights. Sign-in, keys, billing, plans and add-ons, team, data export and erasure, and disconnecting an Instagram account are not reachable from a key at all. They stay in the browser.
Can the agent delete things or message people without asking me?
Deletes, sends and broadcasts are marked as destructive, so a well-behaved MCP client stops and asks you before running them. That prompt is your client's feature, not ours, so check that your client has not been set to approve everything automatically. If you would rather the agent could not do them at all, set POSTENGAGE_READ_ONLY=1 and it only gets the tools that read.
Can I limit what the agent can touch?
Yes, two ways. POSTENGAGE_READ_ONLY=1 registers only the tools that read. POSTENGAGE_TOOLSETS lists the groups you want, for example automations,inbox, and the server registers only those. A tool the agent was never given is one it cannot be talked into using.
Is it safe to let an agent read my DMs and comments?
It is safe the way any agent reading stranger-written text is safe: with care. Comments, DMs and lead messages are written by people you do not know, and a crafted one could try to steer an agent. PostEngage labels that text as untrusted in what the tools return, so the agent is told it is data and not an instruction. Read-only mode and a narrow toolset remove the risk of the agent acting on it.
Where is the key stored?
Only as a hash on our side — the raw pe_live_ key is shown once, at creation, and never again. It lives in your MCP client config on your own machine. If you lose it, you revoke it and make a new one; there is no "show me the key again".
Which clients work?
Anything that speaks MCP over stdio: Claude Code, Claude Desktop, and Cursor are the common ones, and the config is the same shape for each. The server is a small npm package run with npx, so there is nothing to install globally.