
Security News
Meet Socket at Black Hat Europe and BSides London 2025
Socket is heading to London! Stop by our booth or schedule a meeting to see what we've been working on.
@xmtp/bot-starter
Advanced tools
Hey you wanna make a bot on the XMTP network? Heck yeah. This repo makes that easier.
First, install the package in your project:
yarn add @xmtp/bot-starter
Here's a basic example of how to use the package:
import run from "@xmtp/bot-starter"
run(async (context) => {
const messageBody = context.message.content
await context.reply(ECHO: ${messageBody})
})
KEY environment variable)By default, your bot will have a new address every time you start it up. That's ideal. If you have a private key, you can encode it to a hex string and set the KEY environment variable. Your bot will then use this key to connect to the network.
Don't know how to create a private key? Here's how to do it with ethers.js:
import { Wallet } from "ethers"
const key = Wallet.createRandom().privateKey
console.log("Set your environment variable: KEY=" + key)
XMTP_ENV environment variable)By default, the bot connects to the dev network. If you want to connect to production, specify XMTP_ENV=production.
If you want to contribute to this package, here are the steps to set up the project for development:
Install the necessary packages and build the project:
yarn install
yarn build
Run the file echo under examples
examples/run echo
// Call `run` with a handler function. The handler function is called
// with a HandlerContext
run(async (context) => {
// When someone sends your bot a message, you can get the DecodedMessage
// from the HandlerContext's `message` field
const messageBody = context.message.content
// To reply, just call `reply` on the HandlerContext.
await context.reply(`ECHO: ${messageBody}`)
})
FAQs
Easy XMTP bots
We found that @xmtp/bot-starter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket is heading to London! Stop by our booth or schedule a meeting to see what we've been working on.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.