
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
@cyanheads/bluesky-mcp-server
Advanced tools
Search posts, profiles, feeds, threads, and trending topics on Bluesky via MCP. STDIO or Streamable HTTP.
Search posts, profiles, feeds, threads, and trending topics on Bluesky via MCP. STDIO or Streamable HTTP.
Public Hosted Server: https://bluesky.caseyjhand.com/mcp
Seven tools for read-only access to the public Bluesky/AT Protocol AppView — no authentication required:
| Tool | Description |
|---|---|
bsky_search_posts | Full-text search across public Bluesky posts, with author, language, tag, domain, date, and sort filters |
bsky_get_profile | Fetch a Bluesky actor's public profile by handle or DID — the handle↔DID resolver |
bsky_get_author_feed | A user's recent posts ordered newest-first, filterable by post type |
bsky_get_post_thread | Fetch the full conversation for a post by AT-URI — parent chain upward and reply tree downward |
bsky_search_actors | Find Bluesky accounts by name or handle fragment |
bsky_get_follows | Paginated social graph edges — who a user follows or who follows them |
bsky_get_trending | Real-time trending topics on Bluesky with post count, category, and status |
bsky_search_postsFull-text search across public Bluesky posts.
since/until), and sort order (top or latest)hitsTotal when available — total matching posts, not just the current pageimages, external (link cards), record (quoted posts), video, unknownbsky_get_profileFetch a Bluesky actor's public profile by handle or DID.
bsky_get_author_feedA user's recent posts ordered newest-first.
posts_with_replies, posts_no_replies, posts_with_media, or posts_and_author_threadsbsky_get_post_threadFetch the full conversation for a post by AT-URI.
depth (reply tree depth, default 6) and parent_height (parent chain height, default 80)truncated: true; deleted posts surface as not_foundbsky_search_posts or bsky_get_author_feedbsky_get_followsFetch social graph edges for an account.
direction: followers (who follows the actor) or following (who the actor follows)bsky_get_trendingFetch real-time trending topics on Bluesky.
limitapp.bsky.unspecced.getTrends — Bluesky may change this endpoint without notice| Type | Name | Description |
|---|---|---|
| Resource | bsky://profile/{actor} | A Bluesky actor's public profile, addressable by handle or DID |
All resource data is also reachable via tools. Use bsky_get_profile for programmatic access or bsky://profile/{actor} to inject profile context directly.
Built on @cyanheads/mcp-ts-core:
none, jwt, oauthin-memory, filesystem, Supabase, Cloudflare KV/R2/D1Bluesky-specific:
api.bsky.app without credentialsBlueskyService wrapping the AT Protocol public AppView with retry (3 attempts, 500ms base), 15s timeout, and a versioned User-Agenttype-discriminated unionAgent-friendly output:
bsky_search_posts → bsky_get_post_thread without extra stepstype: "images" | "external" | "record" | "video" | "unknown") — branch on data, not $type stringshitsTotal on search results — communicate result scale to users without extra round tripstruncated: true) on thread nodes — agents know where the tree ends and whyConnect directly — no installation required:
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "streamable-http",
"url": "https://bluesky.caseyjhand.com/mcp"
}
}
}
Add the following to your MCP client configuration file. No API key required.
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "stdio",
"command": "bunx",
"args": ["@cyanheads/bluesky-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}
Or with npx (no Bun required):
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@cyanheads/bluesky-mcp-server@latest"],
"env": {
"MCP_TRANSPORT_TYPE": "stdio",
"MCP_LOG_LEVEL": "info"
}
}
}
}
Or with Docker:
{
"mcpServers": {
"bluesky-mcp-server": {
"type": "stdio",
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "MCP_TRANSPORT_TYPE=stdio",
"ghcr.io/cyanheads/bluesky-mcp-server:latest"
]
}
}
}
For Streamable HTTP, set the transport and start the server:
MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 bun run start:http
# Server listens at http://localhost:3010/mcp
api.bsky.app without credentials.git clone https://github.com/cyanheads/bluesky-mcp-server.git
cd bluesky-mcp-server
bun install
cp .env.example .env
# edit .env to override any framework defaults
This server requires no API keys. All framework configuration is optional.
| Variable | Description | Default |
|---|---|---|
MCP_TRANSPORT_TYPE | Transport: stdio or http | stdio |
MCP_HTTP_PORT | Port for HTTP server | 3010 |
MCP_AUTH_MODE | Auth mode: none, jwt, or oauth | none |
MCP_LOG_LEVEL | Log level (RFC 5424) | info |
LOGS_DIR | Directory for log files (Node.js only) | <project-root>/logs |
STORAGE_PROVIDER_TYPE | Storage backend | in-memory |
OTEL_ENABLED | Enable OpenTelemetry instrumentation | false |
See .env.example for the full list of optional overrides.
Build and run:
# One-time build
bun run rebuild
# Run the built server
bun run start:stdio
# or
bun run start:http
Run checks and tests:
bun run devcheck # Lint, format, typecheck, security
bun run test # Vitest test suite
bun run lint:mcp # Validate MCP definitions against spec
docker build -t bluesky-mcp-server .
docker run --rm -p 3010:3010 bluesky-mcp-server
The Dockerfile defaults to HTTP transport, stateless session mode, and logs to /var/log/bluesky-mcp-server. OpenTelemetry peer dependencies are installed by default — build with --build-arg OTEL_ENABLED=false to omit them.
| Directory | Purpose |
|---|---|
src/index.ts | createApp() entry point — registers tools, resource, and inits service. |
src/services/bluesky | AT Protocol AppView HTTP client with retry, timeout, and User-Agent. |
src/mcp-server/tools | Tool definitions (*.tool.ts) — seven read-only Bluesky tools. |
src/mcp-server/resources | Resource definitions (*.resource.ts) — bsky://profile/{actor}. |
tests/ | Unit and integration tests mirroring src/. |
See CLAUDE.md for development guidelines and architectural rules. The short version:
try/catch in tool logicctx.log for request-scoped logging, ctx.state for tenant-scoped storagesrc/index.tsIssues and pull requests are welcome. Run checks and tests before submitting:
bun run devcheck
bun run test
Apache-2.0 — see LICENSE for details.
FAQs
Search posts, profiles, feeds, threads, and trending topics on Bluesky via MCP. STDIO or Streamable HTTP.
The npm package @cyanheads/bluesky-mcp-server receives a total of 223 weekly downloads. As such, @cyanheads/bluesky-mcp-server popularity was classified as not popular.
We found that @cyanheads/bluesky-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.