nostr-ops-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@nostr-ops-mcppublish a text note saying 'Hello from my agent!'"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
nostr-ops-mcp
A NOSTR identity for your LLM agent. MCP server that exposes NOSTR protocol primitives — sign, publish, query, NIP-19 encode/decode, NIP-05 lookup, encrypted DMs — as tools your agent can call. Drop it into Claude Desktop, Claude Code, Cursor, or any MCP-speaking client. Hand the agent a NIP-46 bunker key (not a raw nsec). Set a kind allowlist. Let it post on your behalf within rails you control.
v0.1 — full read + write + DM surface. 16 tools wrapped in a defense-in-depth safety stack: kind allowlist (deny-by-default), recipient allowlist, rate limits, optional two-step confirmation, structured audit log. Supports both nsec (dev) and NIP-46 bunker (production).
What you can do with this
A bot that publishes kind:1 notes from your npub — daily summaries, scheduled posts, programmatic reactions to incoming events.
A NOSTR sales agent — pair with
marketplace-mcpto publish NIP-15 stalls + products as the same identity.Profile management —
nostr_publish_metadatafor kind:0 (always demands confirmation — overwriting your profile is irreversible without older relay data).DM-driven workflows — a storefront agent that watches incoming DMs (with
nostr_list_dms), decrypts orders, and replies vianostr_send_dm. Default-off behindNOSTR_DM_TOOLS_ENABLED.Cross-server identity — share the same NIP-46 bunker URI across
nostr-ops-mcpandmarketplace-mcp. One key, one identity, two specialized tool surfaces.
The safety stack is the load-bearing reason this is usable in production: an agent with the keys to publish as you can ruin your reputation in seconds if unconstrained. The server enforces what kinds it'll sign, what rate, optional second-step confirmation, and writes every call to a structured audit log.
Related MCP server: nostr-bray
The sixteen tools
Read-only — local (no network, no signer needed)
Tool | Purpose |
| Parse NIP-19 strings (npub / nsec / note / nevent / naddr / nprofile). |
| Build NIP-19 strings from raw fields. |
Read-only — network (no signer needed for query/profile/nip05)
Tool | Purpose |
| Returns the signer's pubkey + npub. Errors clearly if no signer configured. |
| Configured relay pool + each relay's connection status. |
| The workhorse. NIP-01 filters: |
| Fetch + parse kind:0 metadata for a pubkey or npub. Returns the parsed JSON content (name, about, picture, nip05, lud16, …). |
| Resolve |
Write (require signer; gated by KindAllowlist + RateLimiter + optional confirm)
Tool | Purpose |
| The primitive write tool. Pass kind / content / tags. |
| Convenience for kind:1. Reply/mention/hashtag shortcuts auto-assemble into NIP-10 tags. |
| Kind:0 profile. Always demands two-step confirmation regardless of |
| Kinds 30000–39999 (replaceable). Sets the |
| NIP-09 kind:5 soft delete. Best-effort — relays may ignore. |
| Execute a token-gated publish. Single-use; safety pipeline re-runs. |
DMs (highest-risk; default-off via NOSTR_DM_TOOLS_ENABLED=true)
Tool | Purpose |
| NIP-04 (kind:4) DM with NIP-44 encryption by default; NIP-04 supported for legacy compat. Gated by |
| Fetch + decrypt the thread with a counterparty. Auto-detects NIP-44 vs NIP-04 per event. |
| Decrypt a single ciphertext (when you already have the event from elsewhere). |
NIP-17 sealed/gift-wrapped DMs are not yet supported — deferred to a future v0.2 (rumor events + gift-wrapping add nontrivial complexity).
Requirements
Node 20+
A NOSTR signer — strongly preferred: a NIP-46 bunker URI from Amber (Android), nsec.app (web), or any other NIP-46 implementation. Legacy path: a raw nsec in
.env. The server logs a stderr warning at startup when nsec-on-disk is detected.
Install
# From npm (once published)
npx -y nostr-ops-mcp
# From source
git clone <repo>
cd nostr-ops-mcp
corepack enable pnpm
pnpm install
pnpm buildConfigure
cp .env.example .env
# edit .env: set NOSTR_NIP46_URI (recommended) OR NOSTR_PRIVATE_KEY
# set NOSTR_RELAYS (comma-separated wss://)
# set NOSTR_ALLOWED_KINDS (required when a signer is configured)The server auto-loads .env from this binary's own directory (next to dist/) — deliberately NOT from cwd, to avoid env-var collision when multiple MCP servers run in the same Claude Code session.
Required
Var | Purpose |
| Comma-separated |
| Comma-separated event-kind numbers the server may sign. Required when a signer is configured. Example: |
Signer — provide AT MOST one
Var | Purpose |
|
|
| Raw |
Optional safety knobs
Var | Default | Purpose |
|
| Force read-only — disables all write tools. |
|
| Opt-in for |
| unset | Hex pubkeys allowed as DM recipients. Empty = |
|
| Two-step confirm: write tools return a token, |
|
| Rolling 60s rate limit on writes. |
|
| Same but for DMs. |
|
| Allow |
|
| Server log path. |
|
| Structured audit log (one JSON line per tool call). |
Wire into an MCP client
Claude Code (project-scoped)
claude mcp add nostr-ops -s project node "$(pwd)/dist/index.js"Claude Desktop / Cursor / other clients
{
"mcpServers": {
"nostr-ops": {
"command": "npx",
"args": ["-y", "nostr-ops-mcp"],
"env": {}
}
}
}Because the server loads its own .env, leave the env block empty in the client config — keep secrets out of any committed file.
Safety model
Every write tool runs the pipeline in this order:
NOSTR_READ_ONLYgate — refuse outright.Signer presence — refuse if neither nsec nor NIP-46 URI is configured.
KindAllowlist — refuse if the event kind isn't in
NOSTR_ALLOWED_KINDS.RateLimiter — refuse if the rolling 60s
eventsbucket is full.Confirm gate — if
NOSTR_REQUIRE_CONFIRM=true(or the tool always-confirms, likepublish_metadata), return a 16-byte hex token instead of signing.Sign + publish — via NDK; the signer handshake completes lazily on first use (relevant for NIP-46 where the bunker handshake is async).
Audit log — append-only JSON line for every attempt (ok / blocked / error).
DM tools add three more checks on top: NOSTR_DM_TOOLS_ENABLED, DmAllowlist (per-recipient), and a separate dms rate bucket.
The floor is your signer. If using NIP-46, the bunker can refuse any sign request — that's the strongest safety boundary. This server's checks are belt-and-suspenders on top.
Verifying calls actually went through
tail -n 5 nostr-mcp-audit.logSuccessful publish: {"ts":"...","tool":"nostr_publish_text_note","outcome":"ok","result":{"event_id":"...","relays_accepted":[...]}}. Blocked / error lines are equally structured. The audit log is append-only by intent — rotate it as part of your operational hygiene.
Testing
pnpm typecheck # tsc --noEmit
pnpm test # 13 vitest cases (KindAllowlist, RateLimiter, nip19 roundtrip)
pnpm build # dist/index.js (~58 KB ESM bundle)For end-to-end testing against live relays, configure a throwaway nsec + a couple of public relays (damus.io, nos.lol) and run a small loop: nostr_publish_text_note → nostr_query_events to confirm the note round-tripped. The nostr_send_dm → nostr_list_dms loop validates the DM path (you can DM yourself for a closed-loop check).
Companion servers
nwc-mcp— Lightning wallet over NWC. Pair these to build sats-spending NOSTR agents.marketplace-mcp— NIP-15 marketplace publish (Shopstr-compatible). Uses the same signer setup as this server.
License
MIT — see LICENSE.
Contact / Issues
Built by LLMOps.Pro.
NOSTR:
npub1hdg932jvwc3jdvkqywgqv0ue4nn60exrf92asy8mtazt3hjg7d2s2yw0nw— follow, DM, zap.Lightning Address:
sovereigncitizens@getalby.com— for support zaps and "this was useful" tips.Bug reports / feature requests: open a GitHub issue (link forthcoming).
Security issues: please disclose privately via NOSTR DM before opening a public issue.
Available Tools
16 toolsnostr_confirm_publishA
Execute a previously-prepared signed publish, identified by its one-time token. Only meaningful when NOSTR_REQUIRE_CONFIRM=true, or when called after publish_metadata (which always confirms). Token is consumed (single-use); the safety pipeline (read-only, signer, kind allowlist, rate limit, dm allowlist) re-runs before signing. Dispatches to the right execute path based on which tool issued the token (publish_event variants OR send_dm).
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | Confirmation token returned by a previous write tool call. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses key behaviors: token consumption (single-use), re-running of the safety pipeline (read-only, signer, kind allowlist, rate limit, dm allowlist), and dispatch based on the issuing tool. No contradictions with annotations exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two dense sentences with no wasted words. It front-loads the core purpose and immediately covers conditions, token behavior, and dispatch logic. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool, the description covers conditions, token lifecycle, safety pipeline, and dispatch. However, it does not describe the return value or expected response, which would improve completeness. No output schema exists to compensate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema description already states the token's purpose ('Confirmation token returned by a previous write tool call'). The tool description adds only minor context ('one-time token'), not substantial new parameter meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a previously-prepared signed publish using a one-time token, distinguishing it from sibling tools that create the signed publish (e.g., publish_event, send_dm). The verb 'Execute' and resource 'signed publish' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when the tool is meaningful (NOSTR_REQUIRE_CONFIRM=true or after publish_metadata) and explains that the token is single-use, providing clear context. However, it does not explicitly state when NOT to use it or mention direct alternatives, though sibling tools imply the workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_decodeA
Decode a NIP-19 bech32-encoded identifier (npub / nsec / note / nevent / naddr / nprofile) into its raw fields. Local-only — no network call. Refuses nsec unless NOSTR_ALLOW_NSEC_DECODE=true; guards against accidentally surfacing a private key in tool output.
| Name | Required | Description | Default |
|---|---|---|---|
| bech32 | Yes | A NIP-19 bech32 string (npub / nsec / note / nevent / naddr / nprofile). Decoding nsec is REFUSED by default — set NOSTR_ALLOW_NSEC_DECODE=true to opt in. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses that it's a local operation (no network call) and that decoding nsec is refused by default unless an environment variable is set. This is important safety information. Lacks details on output format or error handling, but overall good.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, and additional behavioral detail in the second. No redundant information; every word contributes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a decode tool with no output schema, it mentions 'raw fields' but doesn't specify the structure. However, given the simplicity and the list of id types, the output is somewhat implied. Could be slightly improved by noting the output fields (e.g., prefix, hex, relays for nevent).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with a description that already explains the bech32 string type and the nsec guard. The tool description adds context by listing the specific id types and reinforcing the safety behavior, adding value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it decodes NIP-19 bech32 identifiers into raw fields, listing the id types (npub/nsec/note/nevent/naddr/nprofile) and noting it's local-only. This distinguishes it from siblings like nostr_encode (which does the opposite).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Tells when to use (to decode identifiers) and provides important context about nsec decoding with a guard. While it doesn't explicitly state alternatives or when not to use, the tool is unique enough that usage is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_decrypt_dmA
Decrypt a single DM ciphertext using the signer's encrypt/decrypt interface. Useful when you already have a kind:4 event from elsewhere (e.g., nostr_query_events) and just need the plaintext. Auto-detects NIP-44 vs NIP-04 by default. Same NOSTR_DM_TOOLS_ENABLED gate as send/list — reading plaintext is still a confidentiality surface.
| Name | Required | Description | Default |
|---|---|---|---|
| version | No | Encryption scheme. `auto` (default) tries NIP-44 first, falls back to NIP-04. Force a specific scheme if you know which the sender used. | |
| ciphertext | Yes | The encrypted message payload (the `content` field of a kind:4 event). | |
| sender_pubkey | Yes | Author pubkey of the event (32-byte hex). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses auto-detection of NIP-44 vs NIP-04, the tool gate, and confidentiality concerns. It does not detail error behavior or authentication requirements, but the provided information is adequate for a decryption tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each essential: core function, usage context, and technical detail with a warning. No redundancy, perfectly front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and three parameters, the description covers purpose, usage, and behavioral traits. It lacks explicit mention of the return value format (plaintext string) and error handling, but the tool is straightforward enough that these are minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds concrete context for the version parameter (auto-detection) beyond the schema's enum explanation, providing practical guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool decrypts a single DM ciphertext, specifying the resource (DM ciphertext) and action (decrypt). It distinguishes from siblings by noting it's useful when already having a kind:4 event from nostr_query_events, avoiding confusion with send/list tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use (when you have a kind:4 event) and mentions the NOSTR_DM_TOOLS_ENABLED gate and confidentiality surface. It does not explicitly state when not to use, but the context is sufficient for an AI agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_delete_eventA
Publish a NIP-09 kind:5 deletion request for a previously-published event. Soft delete — relays may or may not honor it, and copies on relays you didn't reach stay. Requires kind 5 to be in NOSTR_ALLOWED_KINDS.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Optional human-readable reason. Goes in the deletion event's content field. | |
| event_id | Yes | The event id (32-byte hex) to request deletion of. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses soft delete nature, relay honor uncertainty, and permission requirement. Without annotations, description carries burden and does well.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each essential: purpose, behavior, prerequisite. No fluff, front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a simple delete tool but lacks return value description. Output schema absent, so description could mention what response looks like.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers both parameters completely; description adds minimal value (e.g., reason goes into content field). Baseline 3 given full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Publish a NIP-09 kind:5 deletion request', specifying verb, resource, and protocol standard. Differentiates from siblings like nostr_publish_event by focusing on deletion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides context on soft deletion, relay behavior, and prerequisite (allowed kinds). Missing explicit when-not-to-use, but guides agent effectively.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_encodeA
Encode a raw NIP-19 record (npub / note / nevent / naddr / nprofile) into its bech32 form. Local-only — no network call. Does NOT support nsec encoding (private keys must not transit the agent).
| Name | Required | Description | Default |
|---|---|---|---|
| kind | No | Event kind. Required for naddr; optional for nevent. | |
| type | Yes | NIP-19 type to encode. `nsec` is intentionally not encodable through this tool — private keys must never round-trip through the agent. | |
| relays | No | Optional relay hints (wss://...). | |
| author_hex | No | Optional author pubkey for nevent. | |
| identifier | No | Replaceable-event `d` tag value. Required for naddr. | |
| pubkey_hex | No | 32-byte (64 hex char) public key. Required for npub / naddr / nprofile. | |
| event_id_hex | No | 32-byte (64 hex char) event id. Required for note / nevent. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses important behavioral traits: local-only execution and prohibition of nsec encoding. However, it lacks details about error handling, return format, or input validation beyond what the schema provides. Without annotations, this is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—two sentences that efficiently convey purpose, scope, and constraints. No unnecessary words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the schema's richness, the description covers the core purpose and constraints. The output format is implied by 'bech32 form', but a brief mention of the return value (e.g., 'returns a bech32-encoded string') would complete the picture.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal value beyond the already detailed input schema (100% coverage). It repeats some parameter constraints (e.g., type values) but does not provide additional semantic guidance for using parameters together.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Encode' a raw NIP-19 record) and the output format ('bech32 form'). It explicitly lists supported types (npub, note, nevent, naddr, nprofile), differentiating it from sibling tools like nostr_decode.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: it's a local-only operation with no network call, and explicitly warns against using nsec encoding. While it doesn't explicitly name alternatives, the context implies this tool is for encoding public data, and private keys should be handled separately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_get_profileA
Fetch and parse a NOSTR profile (kind:0 metadata) for the given pubkey or npub. Convenience wrapper over nostr_query_events with kinds=[0], limit=1. Returns the parsed JSON content (name, about, picture, nip05, lud16, etc.) plus the source event id and timestamp. Returns profile: null if no kind:0 event was found for that pubkey on the configured relay pool.
| Name | Required | Description | Default |
|---|---|---|---|
| pubkey_or_npub | Yes | A pubkey to look up — either 32-byte hex (64 chars) or an npub bech32 string. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description covers primary behavior: returns parsed JSON content, source event id, timestamp, and null if not found. It lacks explicit mention of read-only nature or error handling, but the 'fetch and parse' language implies a safe read operation. Since no annotations are provided, the description carries the full burden and does a good job.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. The first sentence states purpose and return, the second handles the null case. Structure is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, one-parameter tool with no output schema, the description is complete. It covers input format, relationship to sibling tools, return values (including specific fields), and the null case. No significant gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with a clear parameter description. The tool description reinforces the parameter's purpose but does not add significant new meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the action ('Fetch and parse a NOSTR profile') and the resource ('kind:0 metadata'). It distinguishes itself from the general nostr_query_events by labeling itself a convenience wrapper, making its specific purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you want a single profile by pubkey or npub, and contrasts with the more general nostr_query_events. However, it does not explicitly state when not to use this tool or list alternatives among the many sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_get_pubkeyA
Return the configured signer's public key as hex + npub. Errors clearly if no signer is configured (server is in read-only mode). For NIP-46 signers, this blocks until the bunker handshake completes.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully bears the burden. It discloses error behavior for missing signer and blocking behavior for NIP-46 handshakes, which is valuable transparency beyond the tool's basic function.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, each adding distinct value: first states the output and error condition, second adds blocking detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, no output schema, and no annotations, the description covers the essential behavioral aspects (error, blocking) and output format. It is sufficient for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters and schema coverage is 100%, so baseline is 4. Description adds no parameter info, but none is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it returns the configured signer's public key in hex and npub formats. It distinguishes from siblings like nostr_get_profile by focusing on the signer's key rather than a profile.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly indicates when to use it (to get the signer's public key) and error conditions (no signer configured). While it doesn't explicitly state when not to use it, the sibling list makes it clear this is the only tool for this purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_list_dmsA
Fetch + decrypt the DM thread between the configured signer and a counterparty. Pulls kind:4 events in both directions (sent and received), decrypts each via the signer's encrypt/decrypt interface (auto-selects NIP-44 or NIP-04 based on the ciphertext), and returns the thread sorted oldest-first. Decryption failures are surfaced per-event instead of failing the whole call.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max events to consider (per direction). Hard cap 200. | |
| since | No | Unix timestamp (seconds). Only DMs at or after this time. | |
| counterparty | Yes | The other party in the conversation — 64-hex-char pubkey or npub bech32. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It transparently explains the decryption process (auto-selects NIP-44 or NIP-04 based on ciphertext), error handling (per-event failures), and sorting (oldest-first). It does not mention authentication or rate limits, but the core behavioral traits are well disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, coherent paragraph of three sentences with the main purpose front-loaded. It is slightly lengthy but each sentence adds value (decryption behavior, error handling, sorting). Could be trimmed slightly but remains effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (bidirectional DM fetch, decryption, error handling), the description covers the core behavior and return format (sorted oldest-first). No output schema exists, but the description provides sufficient context for correct invocation. Minor gap: does not specify whether the decrypted content is returned as plaintext strings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters have descriptions in the schema (100% coverage). The tool description adds minimal nuance: it mentions that limit is per direction and since is a Unix timestamp. This is helpful but does not significantly extend the schema's meaning, so baseline score 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Fetch + decrypt the DM thread') and specifies the resource ('between the configured signer and a counterparty'). It distinguishes from siblings like nostr_send_dm (sending) and nostr_decrypt_dm (single decryption) by describing a bidirectional, sorted thread get with decryption.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving DM threads with a specific counterparty, but does not explicitly state when to use this tool versus alternatives such as nostr_query_events or nostr_decrypt_dm. No when-not or conditions are provided, leaving the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_list_relaysA
List the configured relay pool with each relay's current connection status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It indicates a read operation (list), but does not disclose potential side effects, authentication requirements, or rate limits. The behavior is simple enough that this is minimally adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 12 words, containing no filler or redundancy. Every word is informative and earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description explains what the tool returns (a list of relays with their connection status), which is sufficient for a simple listing operation. No additional context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and the schema coverage is 100% (empty). The rubric sets a baseline of 4 for zero-parameter tools, and the description does not need to add parameter information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'configured relay pool', and adds specific detail about returning connection status. It is distinct from sibling tools which focus on profiles, events, and DMs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to get an overview of configured relays and their status. No alternatives exist among siblings, so explicit when/when-not guidance is unnecessary. However, no prerequisites or context are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_publish_addressable_eventA
Publish a parameterized-replaceable / addressable event (kind 30000–39999). The marketplace MCP's load-bearing bridge — NIP-15 stalls (kind 30017) and products (kind 30018) flow through this. Sets the d tag automatically from the d_tag input. Republishing with the same (kind, pubkey, d_tag) replaces the prior version on relays that honor replaceability.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | Addressable event kind in the parameterized-replaceable range (30000–39999). NIP-15 marketplace uses 30017 (stall) and 30018 (product). | |
| tags | No | Additional tags. The `d` tag is set automatically from d_tag — do not duplicate it here. | |
| d_tag | Yes | The `d` tag identifier — uniquely names this replaceable event within the kind+pubkey combination. Republishing with the same (kind, pubkey, d) replaces the prior version. | |
| content | Yes | Event content (typically JSON for NIP-15). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It discloses automatic d-tag setting and replaceability behavior. However, it does not mention authentication, relay acceptance, or error handling, which are relevant for a publish tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, and no redundant content. Every sentence provides essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 4 parameters and no output schema, the description covers the key aspects: kind range, automatic d-tag, replaceability, and market-specific examples. It could mention event signing or failure behavior, but overall sufficient for the complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, giving a baseline of 3. The description adds context about marketplace kinds and replaceability, but mostly repeats schema info (d_tag sets d tag). No additional meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it publishes parameterized-replaceable events (kind 30000–39999) and specifically calls out NIP-15 marketplace use cases (stalls and products). It distinguishes itself from siblings like nostr_publish_event, which publishes regular events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains that this tool is the 'load-bearing bridge' for marketplace events and notes republishing behavior. While it does not explicitly list when not to use it, the context strongly implies it is for addressable events only, providing adequate guidance for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_publish_eventA
Sign and broadcast a raw NOSTR event of any allowed kind. The primitive write tool — other publish_* tools are convenience wrappers around this. Runs the full safety pipeline: read-only gate, signer presence, kind allowlist, rate limit, optional two-step confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | NOSTR event kind number. Must be in NOSTR_ALLOWED_KINDS. Common kinds: 0 (profile), 1 (text note), 4 (legacy DM), 5 (delete), 30017 (NIP-15 stall), 30018 (NIP-15 product). | |
| tags | No | Array of tags. Each tag is an array of strings; first element is the tag letter (e.g., ["e", "<event_id>", "<relay>"]). | |
| content | Yes | Event content payload (typically text or JSON). | |
| created_at | No | Unix timestamp in seconds. Defaults to now; some relays reject timestamps too far in the past or future, so don't over-set this. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, but the description lists safety pipeline steps (read-only gate, signer presence, kind allowlist, rate limit, optional confirmation), disclosing behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that are front-loaded: first defines core function, second adds context. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description does not mention return value (e.g., event ID) or signing prerequisites. Missing some completeness for a primitive write tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds value with examples for kind (common kinds), tag structure, content type, and created_at constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it signs and broadcasts a raw NOSTR event of any allowed kind, and distinguishes itself as the primitive write tool with 'convenience wrappers around this'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides context that it's the primitive tool and mentions the safety pipeline, but does not explicitly state when to prefer convenience wrappers or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_publish_metadataA
Publish a kind:0 profile metadata event. Always demands two-step confirmation (regardless of NOSTR_REQUIRE_CONFIRM) because it overwrites your public profile and is hard to reason about safely from an LLM context. Requires kind 0 to be in NOSTR_ALLOWED_KINDS — explicitly opt in.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Display name. | |
| about | No | Short bio. | |
| lud16 | No | Lightning Address (LUD-16) for receiving zaps. | |
| nip05 | No | NIP-05 identifier (e.g. alice@getalby.com). | |
| banner | No | Banner URL. | |
| picture | No | Avatar URL. | |
| website | No | Website URL. | |
| display_name | No | Preferred display name (vs `name`). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description must cover behavioral traits. It discloses the mandatory two-step confirmation due to the destructive nature (overwrites public profile) and the requirement for kind 0 to be in the allowed kinds list. However, it does not specify whether the update is a full replacement or partial merge, nor does it describe the response format or potential errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, using two sentences to state the purpose and key behavioral aspects. It front-loads the action and uses bold for emphasis. It is efficient and avoids redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that the tool has 8 optional parameters, no output schema, and no annotations, the description covers essential behavioral constraints but omits important details such as update semantics (merge vs. replace) and return value. The user must infer behavior from external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema covers all 8 parameters with individual descriptions, achieving 100% coverage. The tool description adds no additional parameter-level semantics beyond what the schema already provides, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that this tool publishes a kind:0 profile metadata event, using specific verb-resource phrasing. It distinguishes itself from sibling tools like nostr_publish_text_note and nostr_publish_event by focusing on profile metadata and noting that it overwrites the user's public profile.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use this tool (for profile metadata) and provides important context: it always requires two-step confirmation and needs opt-in via NOSTR_ALLOWED_KINDS. However, it does not explicitly state when alternatives should be used, so it lacks full guidance for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_publish_text_noteA
Convenience wrapper for publishing a kind:1 text note. Builds the e / p / t tags from the structured inputs (replies, mentions, hashtags) so the agent doesn't have to assemble them. Requires kind 1 to be in NOSTR_ALLOWED_KINDS.
| Name | Required | Description | Default |
|---|---|---|---|
| content | Yes | The text note's body. | |
| hashtags | No | Optional. Hashtags to attach (adds `t` tags). Don't include the `#` prefix. | |
| mention_pubkeys | No | Optional. Additional pubkeys to mention (adds `p` tags). | |
| reply_to_author | No | Optional. Author pubkey of the event being replied to (adds a `p` tag). | |
| reply_to_event_id | No | Optional. If set, the note is a reply to this event id (adds an `e` tag with marker `reply`). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the burden. It explains tag assembly and the allowed kinds constraint, but doesn't disclose other traits like idempotency, rate limits, or error behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states purpose, second states a key requirement. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 5-parameter tool with no output schema, the description is adequate but lacks details about the return value (e.g., the published event ID) or error conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds minor value by noting hastags omit the # prefix, but otherwise repeats schema info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it's a convenience wrapper for publishing kind:1 text notes, distinguishing it from generic event publishing (nostr_publish_event) and other siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Mentions the NOSTR_ALLOWED_KINDS requirement, but doesn't explicitly state when to use this vs alternatives (e.g., for simple text notes vs custom kinds).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_query_eventsA
Query events from the configured relay pool using NIP-01 filters. Supports kinds, authors, since/until/limit, and tag filters (#e, #p, #d, #t). Returns an array of events as plain objects (id, kind, pubkey, created_at, content, tags, sig). The workhorse read tool.
| Name | Required | Description | Default |
|---|---|---|---|
| d_tag | No | Filter for addressable events with these `d` tag values. Maps to NIP-01 `#d`. | |
| e_tag | No | Filter for events tagging these event IDs (hex). Maps to NIP-01 `#e`. | |
| kinds | No | Filter by event kind numbers (e.g. [0, 1, 30017]). | |
| limit | No | Max events to return. Default 50, hard cap 500. | |
| p_tag | No | Filter for events tagging these pubkeys (hex). Maps to NIP-01 `#p`. | |
| since | No | Unix timestamp (seconds). Only events at or after this time. | |
| t_tag | No | Filter for events with these hashtag `t` values. Maps to NIP-01 `#t`. | |
| until | No | Unix timestamp (seconds). Only events at or before this time. | |
| authors | No | Filter by author pubkeys (32-byte hex). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must disclose behavioral traits. It does not mention that this is a read-only operation with no side effects, nor does it discuss authentication, rate limits, or potential errors. The word 'Query' implies reading, but it is not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph of ~40 words. It front-loads the purpose, lists filters, mentions return format, and ends with a characterizing phrase. No redundant sentences, but could be slightly more structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with no output schema, the description covers the return format, filter types, and source (configured relay pool). It mentions the limit default and maximum in the schema, but the description doesn't add pagination or error handling context. Overall adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description summarizes the filter types (kinds, authors, etc.) and adds context about NIP-01 mapping, which adds some value but does not go beyond summarizing existing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Query', the resource 'events', and specifies it uses NIP-01 filters. It lists the supported filter types and calls itself 'The workhorse read tool', which clearly distinguishes it from sibling publish/decode tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly indicates this is the primary read tool for events, and there are no sibling tools that query events, so usage context is clear. However, no explicit when-to-use or when-not-to guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_send_dmA
Encrypt + send a NIP-04 (kind:4) direct message. Defaults to NIP-44 encryption (current standard); pass version="nip04" only for legacy compatibility. Gated by NOSTR_DM_TOOLS_ENABLED + NOSTR_DM_ALLOWLIST + rate limit. For modern sealed DMs (NIP-17) wait for the next version.
| Name | Required | Description | Default |
|---|---|---|---|
| content | Yes | Plaintext message; encrypted before broadcast. | |
| version | No | Encryption scheme. Defaults to nip44 (current standard). NIP-04 is deprecated but widely deployed — use only if you know the recipient's client expects it. | |
| to_pubkey | Yes | Recipient — 32-byte hex pubkey OR an npub bech32 string. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes encryption behavior and default version, and discloses gating conditions. No annotations exist, so description carries full burden. Could be improved by mentioning return value or success/error behavior, but current detail is adequate for a send operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no redundancy. Each sentence adds value: first states core purpose, second provides version guidance and gating. Front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, description covers encryption, version choice, gating, and future alternative. Missing return value details, but overall sufficiently complete for a DM send tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, baseline 3. The description adds context beyond schema by clarifying default encryption and advising when to use nip04 for legacy compatibility. This enhances understanding of the version parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Encrypt + send a NIP-04 (kind:4) direct message', specifying the action and resource. It distinguishes from sibling tools like nostr_list_dms and nostr_decrypt_dm by focusing on sending, and mentions modern sealed DMs (NIP-17) as a separate future tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides when to use each encryption version: 'Defaults to NIP-44 encryption...pass version="nip04" only for legacy compatibility.' Also notes gating conditions (NOSTR_DM_TOOLS_ENABLED, NOSTR_DM_ALLOWLIST, rate limit) and directs users to wait for a future version for modern sealed DMs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
nostr_verify_nip05A
Verify a NIP-05 identifier resolves to the expected pubkey. Fetches https://{domain}/.well-known/nostr.json?name={name} and looks up names[name]. If expected_pubkey is provided, returns verified=true only if the resolved pubkey matches; otherwise returns verified=true on any successful resolution + the resolved pubkey. Also surfaces the recipient's relay hints if the well-known doc advertises them (NIP-65 outbox path).
| Name | Required | Description | Default |
|---|---|---|---|
| identifier | Yes | NIP-05 identifier. Either `name@domain.tld` (e.g., `alice@getalby.com`) or a bare `domain.tld` (resolves the `_@domain.tld` root identity). | |
| expected_pubkey | No | Optional. If provided, the tool returns verified=true only when the resolved pubkey matches. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full burden. It explains the HTTP fetch, JSON lookup, verification logic, and relay hints. It does not mention failure modes or performance, but provides substantial transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is a single paragraph that covers key points without excess. It could be slightly more structured, but it remains concise and informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, so description must hint at returns. It mentions verified flag, resolved pubkey, and relay hints, which is reasonably complete for a verification tool. Lacks explicit return structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with param descriptions. Description adds meaning beyond schema by explaining the fetch URL and lookup process, providing context for how parameters are used.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it verifies a NIP-05 identifier and resolves to a pubkey, using specific verb 'Verify' and resource 'NIP-05 identifier'. It distinguishes from sibling tools like nostr_get_profile by focusing on verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (to verify a NIP-05 identifier) and details behavior with and without expected_pubkey. It does not explicitly state when not to use or compare to siblings, but context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
16 tool updates
v0.2.3- First observed
nostr_confirm_publish - First observed
nostr_decode - First observed
nostr_decrypt_dm - First observed
nostr_delete_event - First observed
nostr_encode - First observed
nostr_get_profile - First observed
nostr_get_pubkey - First observed
nostr_list_dms - First observed
nostr_list_relays - First observed
nostr_publish_addressable_event - First observed
nostr_publish_event - First observed
nostr_publish_metadata - First observed
nostr_publish_text_note - First observed
nostr_query_events - First observed
nostr_send_dm - First observed
nostr_verify_nip05
TDQS
Most tools have distinct purposes, but the publish wrappers (publish_text_note, publish_metadata, publish_addressable_event) around the primitive publish_event could cause minor confusion if descriptions aren't read carefully.
All tools follow a consistent snake_case pattern with 'nostr_' prefix and verb_noun format (e.g., nostr_get_profile, nostr_publish_text_note). No deviations.
16 tools is well-scoped for a Nostr operations server, covering basic CRUD, DMs, utilities, and marketplace-specific events without being excessive.
Covers essential operations: event query/publish/delete, profile management, DMs, encoding/decoding, relay listing, and NIP-05 verification. Adequate for its stated marketplace focus.
Maintenance
Related MCP Connectors
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
The Remote MCP server acts as a standardized bridge between LLM applications (like Claude, ChatGPT, and Cursor) and external services, enabling AI agents to access external tools and resources. Its primary capability is providing a centralized search tool to discover other MCP servers and their respective tools. Unlike local implementations, it runs remotely with OAuth authentication and permission controls for security.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceA Model Context Protocol (MCP) server enabling AI models to interact with the Nostr network, facilitating note posting and interaction with the freedom of speech protocol.938MIT
- AlicenseNot gradedqualityAmaintenanceTrust-aware Nostr MCP server. 236 tools for identity, social, DMs, trust scoring, AI-to-AI dispatch, Lightning payments, privacy proofs, and encrypted vaults. NIP-46 bunker auth; keys never leave the signing device.5531MIT
- AlicenseAqualityCmaintenanceMCP server exposing a Lightning wallet to LLM agents over Nostr Wallet Connect (NIP-47): balance, invoices, LN address/LNURL payments, batch pay, and keysend. All spend tools are wrapped in a defense-in-depth safety stack — budget caps, allowlist, two-step confirmation, audit log.1361MIT
- AlicenseNot gradedqualityCmaintenanceA read-only MCP server for AI agents to access Nostr profiles, notes, search, and relay lists through user-chosen relays, without requiring an account or keys.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/llmops-pro/nostr-ops-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server