Mcp Bsky — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Bsky (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
██████╗ ███████╗██╗ ██╗██╗ ██╗
██╔══██╗██╔════╝██║ ██╔╝╚██╗ ██╔╝
██████╔╝███████╗█████╔╝ ╚████╔╝
██╔══██╗╚════██║██╔═██╗ ╚██╔╝
██████╔╝███████║██║ ██╗ ██║
╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═╝<div align="center">
Search, read, and post to Bluesky from any MCP client — a thin server over the [`@kud/bsky`](https://github.com/kud/bsky) AT Protocol library.
Features • Quick Start • Tools • Development
</div>
BLUESKY_HANDLE / BLUESKY_APP_PASSWORD (shared with @kud/bsky-cli).confirm: true, so an agent can never publish by accident.@kud/bsky; the API logic lives in the core library, not here.@modelcontextprotocol/sdk + zod.npx @kud/mcp-bsky{
"mcpServers": {
"bsky": {
"command": "npx",
"args": ["@kud/mcp-bsky"],
"env": {
"BLUESKY_HANDLE": "you.bsky.social",
"BLUESKY_APP_PASSWORD": "xxxx-xxxx-xxxx-xxxx"
}
}
}
}✅ Restart your client and the bsky tools appear.
| Tool | Description |
|---|---|
search_posts | Search Bluesky for posts matching a query |
timeline | The authenticated user's home timeline |
notifications | The authenticated user's notifications |
profile | A profile by handle or DID |
thread | A post and its replies |
confirm: true (6 tools)| Tool | Description |
|---|---|
post | Publish a post |
thread_post | Publish a self-thread (each post replies to the previous) |
reply | Reply to a post |
like | Like a post |
repost | Repost a post |
follow | Follow an account |
Total: 11 tools covering the core Bluesky workflow.
You: "What are people saying about the AT Protocol on Bluesky?"
AI: *calls search_posts → summarises the latest posts*
You: "Post 'shipped a new MCP server 🦋' to my Bluesky."
AI: *calls post with confirm: true → returns the post URL*
You: "Reply to that thread and like the original."
AI: *calls reply and like (confirm: true) → done*git clone https://github.com/kud/mcp-bsky.git
cd mcp-bsky
npm install
npm run build
npm test| Script | Description |
|---|---|
npm run build | Compile TypeScript to dist/ |
npm run dev | Run from source via tsx |
npm test | Run the vitest suite |
npm run inspect:dev | Launch the MCP Inspector against source |
Test against source with the Inspector:
export BLUESKY_HANDLE=you.bsky.social
export BLUESKY_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx
npm run inspect:devThis server reads two environment variables — @kud/bsky's contract, intentionally not MCP_-prefixed so the credentials are shared with @kud/bsky-cli:
BLUESKY_HANDLE (e.g. you.bsky.social) and BLUESKY_APP_PASSWORD (the generated app password — never your main password).@modelcontextprotocol/sdk)@kud/bskyMIT — see LICENSE.
<div align="center">
Made with ❤️ for the terminal
⭐ Star this repo if it helped you!
</div>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.