🦞 Moltbook MCP Server

An MCP (Model Context Protocol) server that provides sandboxed, tool-bounded access to the Moltbook AI-agent social network. Designed to run in a Docker container, isolated from your development environment and sensitive data.

Architecture

┌─────────────────────────────────────────────────────────┐
│  YOUR MACHINE                                           │
│                                                         │
│  ┌───────────────────┐     Streamable HTTP              │
│  │   Claude Code /   │◄───────────────────────────┐     │
│  │   Anthropic API   │     (MCP protocol)         │     │
│  │   (reasoning)     │                            │     │
│  └───────────────────┘                            │     │
│         ▲                                         │     │
│         │ Your other MCP servers                  │     │
│         │ (Neo4j, code-standards, etc.)           │     │
│         ▼                                         │     │
│  ┌───────────────────┐                            │     │
│  │  Other trusted     │                           │     │
│  │  tools & data      │                           │     │
│  └───────────────────┘                            │     │
│                                                   │     │
│  ┌ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┐  │     │
│  │  Docker Container (isolated)               │  │     │
│  │                                            │  │     │
│  │  ┌──────────────────────────────────────┐  │  │     │
│  │  │  Moltbook MCP Server (:8080)         │──┘  │     │
│  │  │                                      │     │     │
│  │  │  ┌────────────┐  ┌───────────────┐   │     │     │
│  │  │  │ Content    │  │ API Client    │   │     │     │
│  │  │  │ Filter     │  │ (httpx)       │───┼──┐  │     │
│  │  │  └────────────┘  └───────────────┘   │  │  │     │
│  │  └──────────────────────────────────────┘  │  │     │
│  │                                            │  │     │
│  │  Read-only filesystem │ No capabilities    │  │     │
│  │  Non-root user        │ No privilege esc.  │  │     │
│  └ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┘  │     │
│                                              │        │
└──────────────────────────────────────────────┼────────┘
                                               │
                                               ▼
                                    ┌─────────────────┐
                                    │  moltbook.com   │
                                    │  API (HTTPS)    │
                                    └─────────────────┘

Why This Architecture?

Moltbook is an interesting experiment, but it comes with well-documented security concerns:

• Prompt injection: Any agent can post content designed to hijack other agents
• API key exposure: The platform has had credential leaks
• Supply chain risk: "Skills" downloaded from other agents can be malicious

By running the Moltbook interaction behind an MCP boundary inside a Docker container, the agent that does your actual reasoning (Claude) never directly parses raw Moltbook content — it only sees structured tool responses. The content filter catches obvious injection attempts before they even reach the tool output.

Quick Start

1. Clone & configure

cd moltbook-mcp-server

# Option A: credentials file
cp config/credentials.example.json config/credentials.json
# Edit config/credentials.json with your Moltbook API key

# Option B: environment variable
cp .env.example .env
# Edit .env with your key

2. Build & run

docker compose up -d

The MCP server is now listening on http://localhost:8080.

3. Connect from Claude Code

Add to your Claude Code MCP configuration (~/.claude/claude_code_config.json or project-level):

{
  "mcpServers": {
    "moltbook": {
      "type": "streamable_http",
      "url": "http://localhost:8080/mcp"
    }
  }
}

4. Register (first time only)

If you don't have a Moltbook account yet, ask Claude to use the moltbook_register tool. It will return a claim URL — visit that and post the verification tweet to activate.

Available Tools

Security Measures

Container Hardening

The Docker Compose config enforces:

• Read-only filesystem — the container can't write anywhere except a tiny /tmp
• No Linux capabilities — cap_drop: ALL
• No privilege escalation — no-new-privileges
• Non-root user — runs as moltbot
• Credentials mounted read-only — can't be modified from inside

Content Filtering

The content filter uses a two-layer defence:

Layer 1 — ML-based detection (LLM Guard): ProtectAI's fine-tuned DeBERTa v3 model classifies every post and comment as injection or benign with a confidence score. The model is pre-downloaded during docker build (~400MB) so the container never needs outbound access to HuggingFace at runtime. The scanner runs on CPU and adds ~50–200ms per text field scanned.

Layer 2 — Regex patterns: Catch domain-specific threats the ML model may not flag, such as attempts to exfiltrate your Moltbook API key to third-party URLs, eval()/import os code injection, or download-and-execute patterns.

Flagged content is redacted with [REDACTED — blocked by filter] and a _security object is attached to the post:

{
  "title": "Totally normal post",
  "content": "[REDACTED — blocked by filter]",
  "_security": {
    "flags": ["LLM Guard: injection detected (score=0.987)"],
    "risk_score": 0.987,
    "filtered": true
  }
}

If llm-guard is not installed (e.g. you want a lighter image), the filter falls back to regex-only mode automatically.

Credential Isolation

Your Moltbook API key:

• Lives only in config/credentials.json or an env var
• Is never logged or included in MCP tool responses
• Is mounted read-only into the container
• Is excluded from .gitignore and .dockerignore

Extending This

Tuning the Content Filter

The ML scanner threshold defaults to 0.5 in content_filter.py. Lower values catch more injections but may flag benign content; higher values are more permissive. You can also switch MatchType.FULL to MatchType.SENTENCE for longer posts where only part of the text may be injected.

To add your own regex patterns (e.g. blocking specific domains or keywords), add them to the INJECTION_PATTERNS or SUSPICIOUS_PATTERNS lists in content_filter.py.

Heartbeat / Autonomous Browsing

Uncomment the moltbook-heartbeat service in docker-compose.yml and create a heartbeat.py that periodically calls the Anthropic API with the MCP tools to browse and engage. This gives you the "autonomous agent" loop while keeping all the security boundaries.

Agent Personality / Policy

The reasoning layer (Claude) decides what to post and how to engage. You can shape this through your Claude Code system prompt or a project-level CLAUDE.md that defines your agent's voice, interests, and engagement rules.

Project Structure

moltbook-mcp-server/
├── server.py                          # MCP server (FastMCP + tools)
├── content_filter.py                  # LLM Guard ML + regex defence
├── download_model.py                  # Pre-downloads DeBERTa model (build-time only)
├── requirements.txt                   # Python dependencies (includes llm-guard)
├── Dockerfile                         # Container build with model baked in
├── docker-compose.yml                 # Orchestration + security hardening
├── config/
│   └── credentials.example.json       # Template for API key
├── .env.example                       # Environment variable template
├── .gitignore
├── .dockerignore
├── claude-code-config.example.json    # Claude Code MCP connection config
└── README.md

License

Personal use / experimentation. Be mindful of Moltbook's terms of service.