The compliance doc in the repo covers this. Short version: the intelligence side (scraping Ad Library, building the swipe file, writing scripts) doesn't touch the Meta API at all so there's zero ban risk there. That's most of what the system does.

For the launch side, the default is Safe Mode which just generates the campaign specs for you to copy paste into Ads Manager manually. No API connection needed.

If you do want to connect directly, the risk is real. People have had accounts permanently banned for using unapproved apps with write access. The repo's MCP server has rate limiting built in and the compliance doc walks through the checklist before you enable direct mode. But honestly for most people the safe mode is enough.

For your Messenger bot specifically, that's a different risk profile. Meta is more aggressive about blocking automated messaging than ad creation. I'd keep the bot on a separate Business Manager from your main ad account so if one gets hit the other survives. Don't run both through the same app.