Skip to main content
Glama

nostr-mcp

Ein schreibgeschützter Model Context Protocol-Server zum sicheren Erkunden von Nostr. Er bietet Agenten semantische Tools zum Auflösen von Nostr-Bezeichnern, zum Lesen von Profilen und Ereignissen, zum Abfragen von Notizen und zum Untersuchen von Relay-Metadaten.

Diese erste Version akzeptiert bewusst keine privaten Schlüssel und veröffentlicht keine Ereignisse. Die Signierung wird über einen entfernten Signierer wie NIP-46 ergänzt, wobei explizite Grenzen für die Benutzerfreigabe gelten.

Tools

Tool

Zweck

nostr_resolve_identity

Dekodiert Hex-, npub-, nprofile-, note-, nevent- und naddr-Bezeichner

nostr_get_profile

Ruft das neueste gültige Profil vom Typ 0 für einen Pubkey ab

nostr_get_event

Ruft ein einzelnes Ereignis anhand der Hex-ID, note oder nevent ab

nostr_query_notes

Fragt verifizierte Notizen vom Typ 1 mit begrenzten Filtern ab

nostr_inspect_relay

Ruft das NIP-11-Informationsdokument eines Relays ab und normalisiert es

Jedes zurückgegebene Ereignis enthält die Relays, die es geliefert haben. Ungültige Signaturen werden verworfen, doppelte Ereignisse werden zusammengeführt, und teilweise Relay-Fehler werden gemeldet statt versteckt.

Related MCP server: nostr-read-mcp

Voraussetzungen

  • Node.js 20.19 oder neuer

  • Ein MCP-Host, der stdio-Server unterstützt

Installation für Codex

Installieren und registrieren Sie den Server mit einem Befehl:

npx -y @diegoyegros/nostr-mcp install

Überprüfen Sie die Registrierung:

npx -y @diegoyegros/nostr-mcp doctor
codex mcp list

Der Installer speichert diesen stdio-Befehl in Codex:

npx -y @diegoyegros/nostr-mcp@latest

Entfernen Sie die Registrierung mit:

npx -y @diegoyegros/nostr-mcp uninstall

Als Codex-Plugin installieren

Das Repository ist außerdem ein Codex-Plugin-Marketplace, der den MCP-Server und einen gebündelten Nostr-Skill enthält:

codex plugin marketplace add DiegoYegros/nostr-mcp --ref master

Öffnen Sie Codex, führen Sie /plugins aus, wählen Sie Nostr Plugins und installieren Sie Nostr MCP. Das Plugin ist schreibgeschützt und bietet Anleitungen zum Auflösen von Bezeichnern, zum Abfragen öffentlicher Notizen, zum Untersuchen von Ereignissen und zum Melden der Relay-Herkunft.

Der direkte MCP-Installer und die Plugin-Installation sind Alternativen. Die Installation des Plugins stellt bereits den gebündelten MCP-Server bereit.

Mit einem beliebigen MCP-Client ausführen

Sobald das npm-Paket veröffentlicht ist, kann jeder stdio-kompatible MCP-Host den Server mit folgendem Befehl starten:

npx -y @diegoyegros/nostr-mcp@latest

Beispielkonfiguration für einen MCP-Client:

{
  "mcpServers": {
    "nostr": {
      "command": "npx",
      "args": ["-y", "@diegoyegros/nostr-mcp@latest"],
      "env": {
        "NOSTR_RELAYS": "wss://relay.damus.io,wss://nos.lol"
      }
    }
  }
}

Aus dem Quellcode ausführen

npm install
npm run build
node dist/index.js

Registrieren Sie einen Quellcode-Checkout mit Codex:

codex mcp add nostr -- "$(command -v node)" "$PWD/dist/index.js"

Konfiguration

Variable

Standard

Bedeutung

NOSTR_RELAYS

wss://relay.damus.io,wss://nos.lol,wss://relay.primal.net

Kommagetrennte Standard-Relay-URLs

NOSTR_QUERY_TIMEOUT_MS

5000

Timeout pro Abfrage, begrenzt auf 500-30000 ms

NOSTR_MAX_RELAYS

8

Maximale Anzahl von Relays pro Tool-Aufruf, begrenzt auf 1-20

Standardmäßig werden nur öffentliche wss://-Relay-URLs akzeptiert. URLs mit Anmeldeinformationen, Fragmenten, Loopback-Hosts oder IP-Adressen aus privaten Netzwerken werden abgelehnt.

Wenn ein Tool-Aufruf relay_urls liefert, werden nur diese Relays abgefragt. Andernfalls werden zuerst sichere Relay-Hinweise aus NIP-19-Bezeichnern ausprobiert, bevor die konfigurierten Standardwerte verwendet werden.

Entwicklung

npm run check

Die Prüfungen umfassen Typprüfung, 54 Einheiten- und Integrationstests, einen modernen MCP-stdio-Aushandlungs-Smoke-Test, die Installer-CLI, Konsistenz der Plugin-Metadaten sowie den Inhalt des npm-Pakets. Relay-Tests verwenden simulierte Relays und signierte Fixtures, sodass sie deterministisch sind und nicht von der Verfügbarkeit öffentlicher Relays abhängen.

npm-Artefakt ohne Veröffentlichung anzeigen:

npm pack --dry-run

Veröffentlichung

Der npm-Name lautet @diegoyegros/nostr-mcp. Eine manuelle erste Version kann mit folgendem Befehl veröffentlicht werden:

npm login
npm publish --access public

Der enthaltene prepublishOnly-Hook führt vor der Veröffentlichung die vollständige Verifizierungssuite aus. Spätere Releases können automatisiert werden, indem nach dem Konfigurieren des NPM_TOKEN-Geheimnisses des Repositorys ein GitHub-Release erstellt wird. Der Release-Workflow veröffentlicht das Paket mit npm-Provenienz.

Sicherheitsmodell

  • Schreibgeschützte MCP-Tool-Annotationen

  • Keine nsec- oder rohen Private-Key-Eingaben

  • Signaturprüfung, bevor Ereignisse den Agenten erreichen

  • Strenge Validierung der Relay-URLs zur Verringerung des SSRF-Risikos

  • Begrenzte Anzahl von Relays, Ergebnisgrößen und Timeouts

  • Relay-Herkunft und Fehler pro Relay in Abfrageergebnissen

Siehe SECURITY.md für Details zur Meldung und zu Vertrauensgrenzen.

Lizenz

MIT

Available Tools

5 tools
nostr_get_eventGet Nostr eventA
Read-onlyIdempotent

Fetch one signature-verified Nostr event by hex ID, note, or nevent and report which relays supplied it.

ParametersJSON Schema
NameRequiredDescriptionDefault
eventYes
relay_urlsNoOptional relay URLs to query instead of identifier hints and configured defaults

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so the description is not required to repeat safety. It adds valuable context: signature verification and relay reporting, which go beyond annotations. No contradiction found.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that immediately conveys the core purpose and key behaviors. No unnecessary words; it is front-loaded and easily parsed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only fetch with two parameters, the description covers purpose, verification, and relay reporting. It lacks explicit mention of return format or error behavior, but annotations and schema (relay_urls description) fill most gaps. It is sufficiently complete for the tool's low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides no description for 'event', but the tool description compensates by explaining accepted formats (hex ID, note, nevent). The 'relay_urls' parameter already has a schema description, and the description reinforces 'instead of identifier hints and configured defaults'. This coverage is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it fetches a single signature-verified Nostr event, specifying accepted ID formats (hex, note, nevent) and the relay reporting behavior. This distinguishes it from siblings like nostr_query_notes (multiple events) and nostr_get_profile (profile-specific).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for retrieving a single event by its identifier, but does not explicitly contrast with sibling tools or state when not to use it. The scope (one event vs. querying many) is evident, yet no explicit exclusions or alternatives are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nostr_get_profileGet Nostr profileA
Read-onlyIdempotent

Fetch the newest signature-verified, valid JSON kind 0 profile for an npub, nprofile, or hex pubkey.

ParametersJSON Schema
NameRequiredDescriptionDefault
identityYes
relay_urlsNoOptional relay URLs to query instead of identifier hints and configured defaults

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false, so the description doesn't need to repeat safety traits. It adds context by specifying 'signature-verified' and 'valid JSON kind 0', implying data quality guarantees and potential filtering behavior. It does not mention network behavior, timeouts, or fallback logic, but the annotation coverage is strong, so this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the key purpose and constraints. It is concise and has no filler words, earning its place with specific technical details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has simple parameters, no output schema, and strong annotations, the description offers sufficient context for correct selection and invocation. It lacks a list of possible output fields, but that might be okay for a profile fetch; however, it could mention that it returns a parsed profile object. Still, the description is adequate for a straightforward read operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The identity parameter is not described in the schema, but the description clarifies it accepts npub, nprofile, or hex pubkey. The relay_urls parameter is partially described in the schema as 'Optional relay URLs to query instead of identifier hints and configured defaults', which matches the description's intent. The description adds meaning for the key parameter, compensating for the 50% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool fetches the newest signature-verified, valid JSON kind 0 profile for an npub, nprofile, or hex pubkey. It specifies the verb (fetch), the resource (Nostr profile), and the exact scope (newest, signature-verified, valid JSON kind 0), which distinguishes it from sibling tools like nostr_get_event or nostr_query_notes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when you need a user's profile data, and the parameter 'relay_urls' suggests optional customization. However, it does not explicitly state when to use this tool versus alternatives like nostr_resolve_identity or nostr_get_event, nor does it provide exclusions or alternative recommendations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nostr_inspect_relayInspect Nostr relayA
Read-onlyIdempotent

Fetch a relay's NIP-11 information document without following redirects. Only public wss:// relay URLs are accepted.

ParametersJSON Schema
NameRequiredDescriptionDefault
relay_urlYes
timeout_msNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds meaningful behavioral details: it does not follow redirects and only accepts public wss:// URLs. This goes beyond the annotations and clarifies potential edge cases, though it doesn't explain what happens on redirects or invalid URLs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences that front-load the main action (fetch) and immediately state the key constraints. Every word earns its place with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and the core purpose is clear. However, with no output schema and no parameter descriptions, the description leaves a gap around the timeout_ms parameter and does not describe what the returned NIP-11 document might contain. Given the tool's narrow scope, it is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema lists two parameters (relay_url and timeout_ms) with no descriptions (0% schema description coverage). The description does not explain either parameter, leaving timeout_ms entirely unexplained. The meaning of relay_url is inferable from the tool's purpose, but the timeout behavior is undocumented, so the description fails to compensate for the schema gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (fetch) and the resource (relay's NIP-11 information document). It also adds specific constraints (doesn't follow redirects, only public wss:// URLs). This distinctly separates it from sibling tools like nostr_get_profile or nostr_query_notes, which handle different resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool (fetching relay metadata) and includes a strict input requirement (public wss://). It does not explicitly mention alternatives, but the sibling tools have obviously different purposes, so the usage context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nostr_query_notesQuery Nostr notesA
Read-onlyIdempotent

Query signature-verified kind 1 notes with bounded author, time, text-search, event-reference, and pubkey-mention filters.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sinceNo
untilNo
searchNo
authorsNo
relay_urlsNoOptional relay URLs to query instead of identifier hints and configured defaults
mentioned_pubkeyNo
referenced_eventNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide idempotentHint, readOnlyHint, etc., but the description adds the important behavioral detail that results are 'signature-verified', which is not in annotations. It also mentions 'bounded' filters, implying limits. This adds value beyond the structured fields, though it doesn't cover pagination or relay behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense sentence that front-loads the core purpose and adds key context (signature-verified) without fluff. Every word contributes value, and it is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 8 parameters, no output schema, and low schema coverage, the description is too thin. It doesn't explain how filters combine (AND/OR), output ordering, pagination, default limit, or what 'signature-verified' entails operationally (e.g., rejection of unverified events). The description fails to provide enough operational detail for an agent to correctly invoke the tool with proper parameter values and expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 13% (only relay_urls has a description). The description lists filter categories (author, time, text-search, event-reference, pubkey-mention) that map to several parameters, giving high-level meaning. However, it doesn't explain parameter formats (e.g., pubkey hex, UNIX timestamps) or constraints like limit defaults. It partially compensates for low schema coverage but leaves gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it queries 'signature-verified kind 1 notes' with specific filter types, which is a precise verb+resource combination. It distinguishes from siblings like nostr_get_event (single event) and nostr_resolve_identity (identity resolution) by focusing on filtered queries over kind 1 notes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for querying/filtering notes, and the filter list makes it clear this is the go-to tool for searching notes. However, it doesn't explicitly name alternatives or state when not to use it, though the sibling tools naturally cover other cases (single event, profiles, relays).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

nostr_resolve_identityResolve Nostr identityA
Read-onlyIdempotent

Decode a hex, npub, nprofile, note, nevent, or naddr identifier. nsec and encrypted private-key identifiers are rejected.

ParametersJSON Schema
NameRequiredDescriptionDefault
expectedNoauto
identifierYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, establishing the safety profile. The description adds valuable behavioral context beyond these annotations by explicitly rejecting nsec and encrypted private-key identifiers, which is not inferable from the annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the verb and subject, and contains no redundant information. Every clause adds value: accepted formats and rejected formats.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and annotations are strong, but the description does not explain the 'expected' parameter or describe the output shape. Since there is no output schema, the agent is left without a clear picture of what the resolution returns (e.g., a pubkey, event id, or type indicator), making the description incomplete for smooth invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It partially covers 'identifier' by listing valid formats, but it completely ignores the 'expected' parameter and its enum values (auto, pubkey, event). The meaning of 'expected' and its effect on decoding is left unexplained, leaving the agent uncertain about a key input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Decode' and enumerates exactly which identifier formats are accepted (hex, npub, nprofile, note, nevent, naddr), clearly distinguishing this from sibling tools that fetch profiles, events, or query notes. It also states what is rejected (nsec, encrypted keys), further sharpening the tool's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context makes it clear this tool is for decoding identifiers before fetching related data, and the listed sibling tools (get_profile, get_event) imply an alternative workflow. However, there is no explicit 'when to use' or 'when not to use' comparison, only the implicit separation of concerns via the description and sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observednostr_get_event
    • First observednostr_get_profile
    • First observednostr_inspect_relay
    • First observednostr_query_notes
    • First observednostr_resolve_identity

TDQS

A4.3/5.0

Scored across 5 tools

Disambiguation5/5

Each tool targets a distinct Nostr operation: identifier resolution, profile fetch, specific event fetch, note querying, and relay inspection. No two tools overlap in purpose; boundaries are clear.

Naming Consistency5/5

All tools use the consistent prefix 'nostr_' followed by a verb_noun pattern (resolve_identity, get_profile, get_event, query_notes, inspect_relay). Perfectly uniform and predictable.

Tool Count5/5

With 5 tools, the server is well-scoped for a read-oriented Nostr client. Each tool provides a distinct capability without redundancy, fitting the typical 3-15 range ideal.

Completeness4/5

The surface covers core read operations: identity decoding, profiles, single events, filtered note queries, and relay metadata. Missing publishing and multi-event/list fetching, but these are minor gaps for a query-focused server.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers