Meta’s October 26, 2026 developer announcement introduces tools for AI agents to create apps, find or create Business Portfolios, link them and add use cases such as WhatsApp Business messaging, according to PPC Land’s report. The update moves Meta’s Social Technologies MCP server beyond mostly read-only inspection and into account-changing setup work.
Meta’s developer-news index confirms the broad capabilities. Availability needs more care: PPC Land reports conflicting language between Meta’s announcement and documentation about whether all six lifecycle tools are live, with access described as gradual and account-dependent.
The detailed tool behavior, confirmation rules and creation limits below come from PPC Land’s account of Meta’s announcement and documentation. Meta’s opened news index and GitHub README confirm the broader product scope, but do not independently supply those lifecycle details.
What the Six Lifecycle Tools Do
MCP, short for Model Context Protocol, lets an AI application discover and call external tools. Here, those tools connect a coding assistant to Meta’s developer platform, allowing it to inspect configuration and, where enabled, make changes.
Meta’s agentic-tools repository describes existing workflows for app settings, webhooks, compliance, app review and API health. The new lifecycle tools extend that work toward the beginning of an integration: creating the app and connecting it to a business and use case.
PPC Land identifies six tools, split between two read operations and four account-changing operations:
| Tool | Function | Important condition |
|---|---|---|
devtools_app_create | Creates a Meta app and returns its app ID | The app starts in development mode, without use cases or a linked Business Portfolio |
devtools_business_list | Lists Business Portfolios accessible to the server | Also indicates whether assets can be added to each portfolio |
devtools_business_create | Creates a Business Portfolio | Requires the optional business_management permission |
devtools_app_business_manage | Links an app to a Business Portfolio | Rejects an app already owned by another portfolio |
devtools_app_use_cases | Lists configured and available use cases | Read-only |
devtools_app_use_cases_manage | Adds a use case, such as WhatsApp Business messaging | Adds associated privileges; the server cannot subsequently remove the use case |
These names and conditions are reported in PPC Land’s documentation analysis.
Creating an app is therefore only the first step. A request to prepare a WhatsApp integration may require an app-creation call, a portfolio lookup, possibly portfolio creation, a linking operation and a use-case addition.
Two boundaries matter. The linking tool is not an ownership-transfer tool, so it cannot move an app between Business Portfolios. And adding a use case is not paired with a removal operation through this server.
I’d give those two decisions the most attention during approval. A mistaken name is easy to spot; choosing the wrong business owner or adding privileges without a matching MCP undo operation has more consequential implications.
Each Write Requires Confirmation
The four write tools cover app creation, Business Portfolio creation, linking and use-case addition. According to PPC Land, Meta says the agent asks for confirmation before each enabled write.
A broad request to set up an integration should therefore be treated as a plan, with approval checkpoints along the way. It should not mean unrestricted permission to make every subsequent change.
For developers reviewing a proposed action, the useful checks are concrete:
- App creation: Confirm the intended app name and purpose.
- Portfolio creation or selection: Check that the correct business is being used and that a suitable portfolio does not already exist.
- Linking: Verify both the app ID and target portfolio.
- Use-case addition: Check the requested capability and its associated privileges.
Confirmation also provides a checkpoint against prompt injection, where an agent encounters instructions embedded in material it should treat as data. The safeguard gives a person an opportunity to catch an unwanted action before it changes the account.
My view is that the quality of the approval prompt matters as much as its existence. A vague request to continue gives the developer less useful information than a prompt naming the exact app, portfolio and operation.
App Secrets Stay in the Dashboard
App creation returns an app ID, but not the app secret. PPC Land reports that Meta keeps secret retrieval in the App Dashboard, behind re-authentication, and excludes it from the agent conversation.
That creates a deliberate handoff: an assistant can help build the configuration, while retrieving the sensitive credential still requires a dashboard action. An app ID identifies the app; it is not a substitute for its secret.
Developers should preserve that separation in their own workflows. Pasting the secret into chat after retrieving it would undermine the benefit of keeping it out of the tool response.
This is a useful distinction between automating setup and distributing credentials. The agent can still remove configuration work without receiving every sensitive value associated with the account.
The Creation Limit Counts Attempts, Not Just Results
Meta’s announcement describes “per-user safety limits,” according to PPC Land. The documentation is more specific: app creation and Business Portfolio creation are each limited to 15 calls per day, the publication reports.
These are separate limits on the two creation operations, not a reported blanket limit of 15 calls across all six tools.
The accounting detail is especially important for automation. Failed validation, declined confirmations and timed-out confirmations may consume an attempt. Developers should not budget on the assumption that only successfully created resources count toward the allowance. These limits and caveats are reported by PPC Land.
That changes how an agent should recover from errors. If app creation succeeds but linking fails, restarting the entire sequence could create an unnecessary second app and spend another creation attempt.
A more careful workflow would retain the returned app ID, inspect the linking error and resume from the failed step. That is a practical recommendation derived from the published limits, not a claim that Meta’s client integrations automatically implement recovery this way.
I’d also settle the app name and intended business owner before invoking creation. Using a limited write operation to explore possible configurations is an avoidable way to consume the daily allowance.
Availability and Installation Are Separate Checks
PPC Land reports that Meta’s blog and documentation disagree about whether all six lifecycle tools are available. Developers should therefore distinguish the announced tool set from what their authenticated account can actually access.
Frequently Asked Questions
4 questions
1Can Meta’s MCP create an app without approval?
According to PPC Land’s reporting, app creation is one of four write operations that require confirmation before acting.
