Nostr Ops MCP server

Read from the package source without running it. The installed server may list more.

• nostr_confirm_publishwrite action

  Execute a previously-prepared signed publish, identified by its one-time token. Only meaningful when NOSTR_REQUIRE_CONFIRM=true, or when called after publish_metadata (which always confirms). Token is consumed (single-use); the safety pipeline (read-only, signer, kind allowlist, rate limit, dm allowlist) re-runs before signing. Dispatches to the right execute path based on which tool issued the to

• nostr_decode

  Decode a NIP-19 bech32-encoded identifier (npub / nsec / note / nevent / naddr / nprofile) into its raw fields. Local-only \u2014 no network call. Refuses nsec unless NOSTR_ALLOW_NSEC_DECODE=true; guards against accidentally surfacing a private key in tool output.

• nostr_decrypt_dm

  Decrypt a single DM ciphertext using the signer's encrypt/decrypt interface. Useful when you already have a kind:4 event from elsewhere (e.g., nostr_query_events) and just need the plaintext. Auto-detects NIP-44 vs NIP-04 by default. Same NOSTR_DM_TOOLS_ENABLED gate as send/list \u2014 reading plaintext is still a confidentiality surface.

• nostr_delete_eventwrite action

  Publish a NIP-09 kind:5 deletion request for a previously-published event. **Soft delete** \u2014 relays may or may not honor it, and copies on relays you didn't reach stay. Requires kind 5 to be in NOSTR_ALLOWED_KINDS.

• nostr_encode

  Encode a raw NIP-19 record (npub / note / nevent / naddr / nprofile) into its bech32 form. Local-only \u2014 no network call. Does NOT support nsec encoding (private keys must not transit the agent).

• nostr_get_profile

  Fetch and parse a NOSTR profile (kind:0 metadata) for the given pubkey or npub. Convenience wrapper over nostr_query_events with kinds=[0], limit=1. Returns the parsed JSON content (name, about, picture, nip05, lud16, etc.) plus the source event id and timestamp. Returns `profile: null` if no kind:0 event was found for that pubkey on the configured relay pool.

• nostr_get_pubkey

  Return the configured signer's public key as hex + npub. Errors clearly if no signer is configured (server is in read-only mode). For NIP-46 signers, this blocks until the bunker handshake completes.

• nostr_list_dms

  Fetch + decrypt the DM thread between the configured signer and a counterparty. Pulls kind:4 events in both directions (sent and received), decrypts each via the signer's encrypt/decrypt interface (auto-selects NIP-44 or NIP-04 based on the ciphertext), and returns the thread sorted oldest-first. Decryption failures are surfaced per-event instead of failing the whole call.

• nostr_list_relays

  List the configured relay pool with each relay's current connection status.

• nostr_publish_addressable_eventwrite action

  Publish a parameterized-replaceable / addressable event (kind 30000\u201339999). The marketplace MCP's load-bearing bridge \u2014 NIP-15 stalls (kind 30017) and products (kind 30018) flow through this. Sets the `d` tag automatically from the `d_tag` input. Republishing with the same (kind, pubkey, d_tag) replaces the prior version on relays that honor replaceability.

• nostr_publish_eventwrite action

  Sign and broadcast a raw NOSTR event of any allowed kind. The primitive write tool \u2014 other publish_* tools are convenience wrappers around this. Runs the full safety pipeline: read-only gate, signer presence, kind allowlist, rate limit, optional two-step confirmation.

• nostr_publish_metadatawrite action

  Publish a kind:0 profile metadata event. **Always demands two-step confirmation** (regardless of NOSTR_REQUIRE_CONFIRM) because it overwrites your public profile and is hard to reason about safely from an LLM context. Requires kind 0 to be in NOSTR_ALLOWED_KINDS \u2014 explicitly opt in.

• nostr_publish_text_notewrite action

  Convenience wrapper for publishing a kind:1 text note. Builds the `e` / `p` / `t` tags from the structured inputs (replies, mentions, hashtags) so the agent doesn't have to assemble them. Requires kind 1 to be in NOSTR_ALLOWED_KINDS.

• nostr_query_events

  Query events from the configured relay pool using NIP-01 filters. Supports kinds, authors, since/until/limit, and tag filters (#e, #p, #d, #t). Returns an array of events as plain objects (id, kind, pubkey, created_at, content, tags, sig). The workhorse read tool.

• nostr_send_dmwrite action

  Encrypt + send a NIP-04 (kind:4) direct message. Defaults to NIP-44 encryption (current standard); pass version="nip04" only for legacy compatibility. Gated by NOSTR_DM_TOOLS_ENABLED + NOSTR_DM_ALLOWLIST + rate limit. For modern sealed DMs (NIP-17) wait for the next version.

• nostr_verify_nip05

  Verify a NIP-05 identifier resolves to the expected pubkey. Fetches `https://{domain}/.well-known/nostr.json?name={name}` and looks up `names[name]`. If `expected_pubkey` is provided, returns verified=true only if the resolved pubkey matches; otherwise returns verified=true on any successful resolution + the resolved pubkey. Also surfaces the recipient's relay hints if the well-known doc advertise

• Code scan2 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 104 days ago8/15
• Maintainer identityregistry namespace matches repository owner7/10

Safety score

71/100

higher than 36% of 48,255 servers

Tools

16

the typical server has 7

Tools that change things

44%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

28

more than 15% of 12,191 servers with a package

Nostr Ops: common questions

Is Nostr Ops MCP server safe?

Mostly: it is graded B (71/100). Read the Nostr Ops safety report

How do I install Nostr Ops?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Nostr Ops need an API key?

Yes. The registry entry asks for NOSTR_NIP46_URI, NOSTR_PRIVATE_KEY.

Is Nostr Ops maintained?

The last commit was 142 days ago (2026-06-15). The latest release is v0.2.3.

What can I use instead of Nostr Ops?

Servers from other publishers that do the same job: SSH — policy-gated remote access MCP server.

How does Nostr Ops compare with other MCP servers?

safety score 71/100 (higher than 36% of 48,255 servers); tools 16 (the typical server has 7); tools that change things 44% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.