This server is an MCP bridge that lets agents read verified public Nostr data and act on Nostr while keeping private keys out of the conversation.
Resolve any Nostr identifier (npub, note, nevent, naddr, NIP-05) and reject private-key identifiers.
Fetch verified profiles and events with relay provenance; invalid signatures are discarded.
Query kind 1 notes with author/time/text/event-reference/pubkey-mention filters.
Inspect relay NIP-11 documents (public wss:// only, no redirects).
Publish notes with reply threading, reactions, reposts, ownership-checked deletes, profile edits, and long-form markdown articles.
Manage encrypted local drafts.
Send sealed-sender private messages over NIP-17.
Upload media via Blossom with imeta tags.
Send Lightning zaps through Nostr Wallet Connect with a server-side spend cap.
Runs read-only when no identity is configured; write tools explain how to enable themselves.
Allows sending Lightning zaps via Nostr Wallet Connect using an Alby wallet, with server-enforced spend caps.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@nostr-mcp Resolve this npub and fetch the profile."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol server for Nostr. Agents can read verified public data and act on Nostr: post notes and replies, react, repost, publish articles, manage drafts, send encrypted direct messages, upload media, and send Lightning zaps. Private keys stay out of the conversation because signing happens inside the server process.
Reads report relay provenance. Invalid signatures are discarded, duplicate events are merged, and partial relay failures show up in results instead of being hidden.
# Register with Codex (or point any MCP host at the stdio command below)
npx -y @diegoaly_/nostr-mcp@latest install
# Create an encrypted identity (NIP-49 key file, passphrase prompted)
npx -y @diegoaly_/nostr-mcp@latest key generate// Any MCP host. Signing activates when NOSTR_KEY_PASSPHRASE is present.
{
"mcpServers": {
"nostr": {
"command": "npx",
"args": ["-y", "@diegoaly_/nostr-mcp@latest"],
"env": { "NOSTR_KEY_PASSPHRASE": "{your-passphrase}" }
}
}
}With no identity configured the server runs read-only, and every write tool explains how to enable itself when called. If you would rather not hold keys locally at all, use a NIP-46 bunker: set NOSTR_BUNKER_URI=bunker://... from Amber on Android, and the key never touches this machine.
Related MCP server: nostr-read-mcp
Read & discover. Resolve any identifier (npub, note, nevent, naddr, NIP-05 handles), fetch profiles and events with relay provenance, reconstruct full threads, run full-text search over NIP-50 relays, look up NIP-65 relay lists, inspect NIP-11 relay documents.
Publish. Notes with automatic reply threading, reactions, reposts, deletes that check ownership first, profile editing that preserves unknown fields, and long-form markdown articles where republishing a slug edits the article.
Drafts, DMs, media, money. Encrypted local drafts. Sealed-sender private messages over NIP-17. Blossom media uploads that return ready-made imeta tags. Lightning zaps through Nostr Wallet Connect, capped by a server-side spend limit.
The complete tool reference lives in docs/tools.md, and the protocol coverage matrix in docs/nips.md.
Option | Setup | Key location |
Encrypted key file (recommended) |
| This machine, NIP-49-encrypted |
Remote signer / Amber (NIP-46) |
| Off-machine; signer approves each request |
Raw env var (automation only) |
| Process environment |
Zaps additionally need a wallet URI (NOSTR_WALLET_NWC, from Alby/Primal/Coinos). Per-zap spending is capped by NOSTR_MAX_ZAP_MSAT regardless of what an agent tries.
Full details in docs/configuration.md.
Doc | Contents |
All 31 tools: inputs, outputs, capability gating | |
Supported NIPs: implemented, internal, excluded | |
Every environment variable, identity setup, wallet setup | |
Layer structure, key interfaces, read/publish pipelines, secret handling | |
Dev workflow, testing principles, releasing | |
Trust boundaries and vulnerability reporting |
Node.js 20.19 or newer
An MCP host that supports stdio servers
npm run checkType checking, the offline test suite, build, a real-stdio smoke test, and npm package validation. See docs/development.md.
Signing happens inside the server process; keys never appear in tool inputs, outputs, or logs
NIP-49 encrypted keys at rest; NIP-46 bunker mode keeps keys off the machine entirely
Server-enforced zap spend cap; destructive tools are annotated and gated behind explicit configuration
Signature verification before events reach the agent; strict relay URL validation against SSRF
Bounded relay counts, result sizes, and timeouts; per-relay errors reported, never swallowed
MIT
Fetch one signature-verified Nostr event by hex ID, note, or nevent and report which relays supplied it.
| Name | Required | Description | Default |
|---|---|---|---|
| event | Yes | ||
| relay_urls | No | Optional relay URLs to query instead of identifier hints and configured defaults |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the description is not required to repeat safety. It adds valuable context: signature verification and relay reporting, which go beyond annotations. No contradiction found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that immediately conveys the core purpose and key behaviors. No unnecessary words; it is front-loaded and easily parsed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only fetch with two parameters, the description covers purpose, verification, and relay reporting. It lacks explicit mention of return format or error behavior, but annotations and schema (relay_urls description) fill most gaps. It is sufficiently complete for the tool's low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides no description for 'event', but the tool description compensates by explaining accepted formats (hex ID, note, nevent). The 'relay_urls' parameter already has a schema description, and the description reinforces 'instead of identifier hints and configured defaults'. This coverage is adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches a single signature-verified Nostr event, specifying accepted ID formats (hex, note, nevent) and the relay reporting behavior. This distinguishes it from siblings like nostr_query_notes (multiple events) and nostr_get_profile (profile-specific).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a single event by its identifier, but does not explicitly contrast with sibling tools or state when not to use it. The scope (one event vs. querying many) is evident, yet no explicit exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch the newest signature-verified, valid JSON kind 0 profile for an npub, nprofile, or hex pubkey.
| Name | Required | Description | Default |
|---|---|---|---|
| identity | Yes | ||
| relay_urls | No | Optional relay URLs to query instead of identifier hints and configured defaults |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false, so the description doesn't need to repeat safety traits. It adds context by specifying 'signature-verified' and 'valid JSON kind 0', implying data quality guarantees and potential filtering behavior. It does not mention network behavior, timeouts, or fallback logic, but the annotation coverage is strong, so this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the key purpose and constraints. It is concise and has no filler words, earning its place with specific technical details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has simple parameters, no output schema, and strong annotations, the description offers sufficient context for correct selection and invocation. It lacks a list of possible output fields, but that might be okay for a profile fetch; however, it could mention that it returns a parsed profile object. Still, the description is adequate for a straightforward read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The identity parameter is not described in the schema, but the description clarifies it accepts npub, nprofile, or hex pubkey. The relay_urls parameter is partially described in the schema as 'Optional relay URLs to query instead of identifier hints and configured defaults', which matches the description's intent. The description adds meaning for the key parameter, compensating for the 50% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches the newest signature-verified, valid JSON kind 0 profile for an npub, nprofile, or hex pubkey. It specifies the verb (fetch), the resource (Nostr profile), and the exact scope (newest, signature-verified, valid JSON kind 0), which distinguishes it from sibling tools like nostr_get_event or nostr_query_notes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when you need a user's profile data, and the parameter 'relay_urls' suggests optional customization. However, it does not explicitly state when to use this tool versus alternatives like nostr_resolve_identity or nostr_get_event, nor does it provide exclusions or alternative recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Fetch a relay's NIP-11 information document without following redirects. Only public wss:// relay URLs are accepted.
| Name | Required | Description | Default |
|---|---|---|---|
| relay_url | Yes | ||
| timeout_ms | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds meaningful behavioral details: it does not follow redirects and only accepts public wss:// URLs. This goes beyond the annotations and clarifies potential edge cases, though it doesn't explain what happens on redirects or invalid URLs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences that front-load the main action (fetch) and immediately state the key constraints. Every word earns its place with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the core purpose is clear. However, with no output schema and no parameter descriptions, the description leaves a gap around the timeout_ms parameter and does not describe what the returned NIP-11 document might contain. Given the tool's narrow scope, it is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema lists two parameters (relay_url and timeout_ms) with no descriptions (0% schema description coverage). The description does not explain either parameter, leaving timeout_ms entirely unexplained. The meaning of relay_url is inferable from the tool's purpose, but the timeout behavior is undocumented, so the description fails to compensate for the schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (fetch) and the resource (relay's NIP-11 information document). It also adds specific constraints (doesn't follow redirects, only public wss:// URLs). This distinctly separates it from sibling tools like nostr_get_profile or nostr_query_notes, which handle different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (fetching relay metadata) and includes a strict input requirement (public wss://). It does not explicitly mention alternatives, but the sibling tools have obviously different purposes, so the usage context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Query signature-verified kind 1 notes with bounded author, time, text-search, event-reference, and pubkey-mention filters.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | ||
| until | No | ||
| search | No | ||
| authors | No | ||
| relay_urls | No | Optional relay URLs to query instead of identifier hints and configured defaults | |
| mentioned_pubkey | No | ||
| referenced_event | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint, readOnlyHint, etc., but the description adds the important behavioral detail that results are 'signature-verified', which is not in annotations. It also mentions 'bounded' filters, implying limits. This adds value beyond the structured fields, though it doesn't cover pagination or relay behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, dense sentence that front-loads the core purpose and adds key context (signature-verified) without fluff. Every word contributes value, and it is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters, no output schema, and low schema coverage, the description is too thin. It doesn't explain how filters combine (AND/OR), output ordering, pagination, default limit, or what 'signature-verified' entails operationally (e.g., rejection of unverified events). The description fails to provide enough operational detail for an agent to correctly invoke the tool with proper parameter values and expectations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 13% (only relay_urls has a description). The description lists filter categories (author, time, text-search, event-reference, pubkey-mention) that map to several parameters, giving high-level meaning. However, it doesn't explain parameter formats (e.g., pubkey hex, UNIX timestamps) or constraints like limit defaults. It partially compensates for low schema coverage but leaves gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it queries 'signature-verified kind 1 notes' with specific filter types, which is a precise verb+resource combination. It distinguishes from siblings like nostr_get_event (single event) and nostr_resolve_identity (identity resolution) by focusing on filtered queries over kind 1 notes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for querying/filtering notes, and the filter list makes it clear this is the go-to tool for searching notes. However, it doesn't explicitly name alternatives or state when not to use it, though the sibling tools naturally cover other cases (single event, profiles, relays).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Decode a hex, npub, nprofile, note, nevent, or naddr identifier. nsec and encrypted private-key identifiers are rejected.
| Name | Required | Description | Default |
|---|---|---|---|
| expected | No | auto | |
| identifier | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, establishing the safety profile. The description adds valuable behavioral context beyond these annotations by explicitly rejecting nsec and encrypted private-key identifiers, which is not inferable from the annotations or schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the verb and subject, and contains no redundant information. Every clause adds value: accepted formats and rejected formats.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and annotations are strong, but the description does not explain the 'expected' parameter or describe the output shape. Since there is no output schema, the agent is left without a clear picture of what the resolution returns (e.g., a pubkey, event id, or type indicator), making the description incomplete for smooth invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It partially covers 'identifier' by listing valid formats, but it completely ignores the 'expected' parameter and its enum values (auto, pubkey, event). The meaning of 'expected' and its effect on decoding is left unexplained, leaving the agent uncertain about a key input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Decode' and enumerates exactly which identifier formats are accepted (hex, npub, nprofile, note, nevent, naddr), clearly distinguishing this from sibling tools that fetch profiles, events, or query notes. It also states what is rejected (nsec, encrypted keys), further sharpening the tool's purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context makes it clear this tool is for decoding identifiers before fetching related data, and the listed sibling tools (get_profile, get_event) imply an alternative workflow. However, there is no explicit 'when to use' or 'when not to use' comparison, only the implicit separation of concerns via the description and sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v0.1.0nostr_get_eventnostr_get_profilenostr_inspect_relaynostr_query_notesnostr_resolve_identityEach tool targets a distinct Nostr operation: identifier resolution, profile fetch, specific event fetch, note querying, and relay inspection. No two tools overlap in purpose; boundaries are clear.
All tools use the consistent prefix 'nostr_' followed by a verb_noun pattern (resolve_identity, get_profile, get_event, query_notes, inspect_relay). Perfectly uniform and predictable.
With 5 tools, the server is well-scoped for a read-oriented Nostr client. Each tool provides a distinct capability without redundancy, fitting the typical 3-15 range ideal.
The surface covers core read operations: identity decoding, profiles, single events, filtered note queries, and relay metadata. Missing publishing and multi-event/list fetching, but these are minor gaps for a query-focused server.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Public read-only MCP server for HODLXXI agent identity, trust, receipts, and verification.
Read-only MCP server for The Quiet Protocol's engines, benchmarks, proof, and business data.
Read-only Remote MCP for externally grounded AI agent trust receipts.
Agent-native MCP server over the public saagarpatel.dev corpus. Read-only, stateless.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/DiegoYegros/nostr-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
