.codex-plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .codex-plugin (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center"> <h1>@cyanheads/bluesky-mcp-server</h1> <p><b>Search posts, profiles, feeds, threads, and trending topics on Bluesky via MCP. STDIO or Streamable HTTP.</b> <div>7 Tools • 1 Resource</div> </p> </div>
<div align="center">
</div>
<div align="center">
</div>
<div align="center">
Public Hosted Server: https://bluesky.caseyjhand.com/mcp
</div>
Seven tools for read-only access to the public Bluesky/AT Protocol AppView — no authentication required:
| Tool | Description |
|---|---|
bsky_search_posts | Full-text search across public Bluesky posts, with author, language, tag, domain, date, and sort filters |
bsky_get_profile | Fetch a Bluesky actor's public profile by handle or DID — the handle↔DID resolver |
bsky_get_author_feed | A user's recent posts ordered newest-first, filterable by post type |
bsky_get_post_thread | Fetch the full conversation for a post by AT-URI — parent chain upward and reply tree downward |
bsky_search_actors | Find Bluesky accounts by name or handle fragment |
bsky_get_follows | Paginated social graph edges — who a user follows or who follows them |
bsky_get_trending | Real-time trending topics on Bluesky with post count, category, and status |
bsky_search_postsFull-text search across public Bluesky posts.
since/until), and sort order (top or latest)hitsTotal when available — total matching posts, not just the current pageimages, external (link cards), record (quoted posts), video, unknownbsky_get_profileFetch a Bluesky actor's public profile by handle or DID.
bsky_get_author_feedA user's recent posts ordered newest-first.
posts_with_replies, posts_no_replies, posts_with_media, or posts_and_author_threadsbsky_get_post_threadFetch the full conversation for a post by AT-URI.
depth (reply tree depth, default 6) and parent_height (parent chain height, default 80)truncated: true; deleted posts surface as not_foundbsky_search_posts or bsky_get_author_feedbsky_get_followsFetch social graph edges for an account.
direction: followers (who follows the actor) or following (who the actor follows)bsky_get_trendingFetch real-time trending topics on Bluesky.
limitapp.bsky.unspecced.getTrends — Bluesky may change this endpoint without notice| Type | Name | Description |
|---|---|---|
| Resource | bsky://profile/{actor} | A Bluesky actor's public profile, addressable by handle or DID |
All resource data is also reachable via tools. Use bsky_get_profile for programmatic access or bsky://profile/{actor} to inject profile context directly.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Bluesky-specific:
api.bsky.app without credentialsBlueskyService wrapping the AT Protocol public AppView with retry (3 attempts, 500ms base), 15s timeout, and a versioned User-Agenttype-discriminated unionAgent-friendly output:
bsky_search_posts → bsky_get_post_thread without extra stepstype: "images" | "external" | "record" | "video" | "unknown") — branch on data, not $type stringshitsTotal on search results — communicate result scale to users without extra round tripstruncated: true) on thread nodes — agents know where the tree ends and whyConnect directly — no installation required:
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "streamable-http",
"url": "https://bluesky.caseyjhand.com/mcp"
}
}
}Add the following to your MCP client configuration file. No API key required.
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/bluesky-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with npx (no Bun required):
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/bluesky-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}Or with Docker:
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/bluesky-mcp-server:latest"
]
}
}
}For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcpapi.bsky.app without credentials.git clone https://github.com/cyanheads/bluesky-mcp-server.gitcd bluesky-mcp-serverbun installcp .env.example .env
# edit .env to override any framework defaultsThis server requires no API keys. All framework configuration is optional.
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | Port for HTTP server | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (RFC 5424) | info |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation | false |
See .env.example for the full list of optional overrides.
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against specdocker build -t bluesky-mcp-server .
docker run --rm -p 3010:3010 bluesky-mcp-serverThe Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/bluesky-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools, resource, and inits service. |
src/services/bluesky | AT Protocol AppView HTTP client with retry, timeout, and User-Agent. |
src/mcp-server/tools | Tool definitions (*.tool.ts) — seven read-only Bluesky tools. |
src/mcp-server/resources | Resource definitions (*.resource.ts) — bsky://profile/{actor}. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run testApache-2.0 — see LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.