How to connect Cursor to Instagram for a client's shop

What you need

• Cursor on your computer, with its agent chat.
• A Spaces account in the shop's name. The Free plan starts when the first account is connected, with no card needed.
• The shop owner, with a few minutes to sign in to their own Instagram account.
• An hour with the owner to write down what they would and would not say in a reply.
• An hour or so for setup and a first look at the DMs and comments.

Step 1: connect your Instagram account to Spaces

You sign in to Instagram through a secure link and approve the connection. Your account stays yours, and you keep using it on your phone as normal.

Once it is connected, the account shows in your Spaces dashboard. Connecting does not send anything. It only means Spaces can read and send on that account when an AI agent you have added asks it to.

The shop owner signs in to their own Instagram account through Spaces, on their own device, with two-step verification turned on first: it helps the sign-in go through. Never ask for the shop's Instagram password. Instagram restricts automation, so the owner should read the note at the top of this page before connecting.

Step 2: add Spaces to Cursor

1. Add the block below to ~/.cursor/mcp.json, or to .cursor/mcp.json in one project.
2. Cursor finds the Spaces sign-in on its own. Sign in to Spaces in the browser and approve access.

{
  "mcpServers": {
    "spaces": { "url": "https://api.spacesos.com/mcp" }
  }
}

To check it worked: Spaces shows with its tools in Cursor’s MCP settings. The MCP Logs output panel shows any error.

You sign in on Spaces' own page during this step, so Cursor never sees your Instagram login or your Spaces password. If Spaces does not show up:

• Check the address is exactly https://api.spacesos.com/mcp, with nothing added at the end.
• Run the sign-in step again, in case the first sign-in in the browser did not finish.
• Restart Cursor so it reads the new settings.
• If it still does not appear, the Cursor MCP docs have the current steps, and our Cursor setup page has ours.

Step 3: try it

Open Cursor's agent chat in the project and ask in plain words. Start with requests that only read:

• List the Instagram accounts on this Spaces workspace.
• Show me the 20 most recent DMs, without sending anything.
• Group last month's DMs and comments by what the person wanted.
• Draft replies to the unanswered DMs using shop-notes.md, and do not send them.

Start with a question that only reads, like the first one. It shows you that Cursor can see your Instagram messages before you let it send anything. Then try a draft, read it carefully, and only then let it send.

Good to know

Cursor acts when you ask it in the editor. It does not watch the shop's Instagram on its own, and it stops when you close the chat. That makes it a good place to explore, test and build, but not the thing that answers customers.

The Spaces dashboard's "Your agent" page also has an Add to Cursor button. Cursor opens and asks you to install Spaces, and you then sign in to Spaces in the browser.

Keep the owner in the loop while you test. They know their customers, and the first drafts are where you learn what they would and would not say.

Who owns what

Set things up the way they will run after you finish. It saves a migration later and keeps the shop in control of its own customers.

If you prefer an API key to signing in, keep it out of the repository and read it from an environment variable:

{
  "mcpServers": {
    "spaces": {
      "url": "https://api.spacesos.com/mcp",
      "headers": { "Authorization": "Bearer ${env:SPACES_API_KEY}" }
    }
  }
}

Limit Cursor to Instagram

If the project is Instagram only, use the Instagram-only address, https://api.spacesos.com/mcp/instagram, in Cursor's config instead of the main one. It uses the same sign-in and limits, and only shows Instagram accounts, so nothing you try can reach a WhatsApp number or mailbox the shop connects later.

Explore real conversations without sending

These are the shop's real customers, so treat the first days as read-only. A safe order of work:

1. Reads only: list DMs, read threads, list comments on recent posts, and group them by what people wanted.
2. Write the business brief with the owner from what you found. Ask Cursor to save it with set_business_brief, so every agent the shop uses later reads the same facts.
3. Draft replies to real conversations and compare them with what the owner would have said. Send nothing.
4. When drafts are reliably right, ask the agent to hold replies as drafts in Spaces, and let the owner approve each one.
5. Only then let anything go out directly, and only the kinds of reply the owner agreed.

Reading is paced by Spaces rather than capped. If a read comes back asking you to wait a few seconds, that is Spaces' own pacing, not Instagram pushing back. Wait and read again.

A worked example: a florist's Friday DMs

Here is an exploratory session in Cursor for a florist, a week before Mother's Day. Names and details are examples.

In one session you learned what the shop actually gets, which half of it has a fixed answer, and which messages must stay with the owner. That is the design.

Instagram limits that shape the design

• Replies to people who wrote in: no daily limit, at least 15 seconds apart. Design around replies in existing conversations.
• Instagram only lets you message someone who has not replied inside its messaging window, so replies in existing chats work best.
• Comments: up to 10 an hour and 100 a day, shared with likes, follows, posts and new conversations. On a busy post, answer one comment in public and move the rest to private replies.
• Posts: part of the shared 10 an hour and 100 a day with likes, comments, follows and new chats.
• If Instagram pushes back on an action, that request is refused with a retry time. Reading conversations and other actions keep working
• Replies to people who wrote in, including a private reply to a commenter, go out from the first day. New chats and likes start on the warm-up ramp.

Spaces enforces these limits for every key and every agent on the account. However your code or prompts are written, a send over the limit is refused with a time to retry, and nothing goes out. Tell the shop that: no bug in your work can push their account past them.

Moving to something that runs day to day

Cursor acts when you ask it in the editor, so it is not what answers the shop's DMs in production. The usual options:

For a small shop, a chat app plus a routine for the busiest keyword is often the right answer. Keep it as simple as the owner can run without you.

A hand-over checklist for the shop

1. The owner can sign in to Spaces and sees the Instagram account connected.
2. They know where pause all sending is, and that reading keeps working while it is on.
3. The business brief is saved in Spaces, and they know how to ask their agent to change one part of it.
4. Any API key you used is revoked, or handed over and rotated.
5. They know what, if anything, runs on its own, and what it may send.
6. They know that if Instagram pushes back, Spaces rests the account and tells them.
7. They have read the Instagram note at the top of this page and understand the risk is lowered, not removed.

Summing up

Cursor and the Spaces MCP server make a good workbench for a shop's Instagram project. Have the owner connect their own account, keep the Spaces account in the shop's name, use the Instagram-only address, explore without sending, design around replies rather than outreach, and leave a hand-over the owner can run without you.

How Spaces keeps your account safe

Whatever you ask, Spaces keeps your Instagram account inside safe limits: at least 15 seconds between messages, up to 150 a day, and 100 new conversations a day at most, with a gentler start for a newly connected account. If your AI tries to go faster, Spaces holds the message and says when it can try again.

New conversations warm up over the first weeks after you connect:

Instagram only lets you message someone who has not replied inside its messaging window, so replies in existing chats work best.

These are Spaces' own limits. They lower the risk of a restriction, but they cannot remove it, because Instagram makes its own decisions about accounts. Read the note at the top of this page before you connect.

Pricing

Free to start, then $9 per connected account a month

Can I connect the shop's Instagram for them?

No. The owner signs in to their own account through Spaces' secure link, ideally with two-step verification on. You never need, and should never ask for, their Instagram password.

Does this use Meta's Instagram Platform?

No. The usual sign-in connects the shop's own account rather than going through Meta's developer APIs, so Instagram's Terms of Use apply. Business and Creator accounts can also connect through Meta's own business sign-in, which Spaces then uses for what it covers.

Can Cursor answer the shop's DMs around the clock?

No. Cursor acts when you ask it in the editor. For production, the shop can use a chat app, an always-on agent such as Claude Code or Hermes, a routine, or your own code on the Spaces API.

How do I stop test drafts reaching customers?

Start with reads only, ask Cursor to draft without sending, and ask the agent to hold replies as drafts in Spaces. Nothing then goes out until the owner approves it.

Can I build comment-to-DM for a giveaway post?

A Spaces routine can reply to a keyword in a comment and, on Instagram, message the commenter. Comments have their own limits, so check them against the size of the post before promising anything.

What happens if my code sends too fast?

Spaces refuses the send with a time to retry, and nothing goes out. Wait, then retry with the same Idempotency-Key, which never sends twice.

Can Cursor hide spam comments?

No. Hiding a comment is not available through Spaces. The owner hides or deletes those in the Instagram app.

Where is the developer reference?

The Spaces docs have the REST routes, the MCP tools, webhooks and error codes. This guide keeps to the set-up and the working practice.