/ 100

29 days ago

glama

AT Protocol MCP Server

Enables LLMs to interact with the AT Protocol ecosystem, including Bluesky, through natural language. Supports public data access without authentication and full write operations with authentication.

→ cameronrye/atproto-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: ATPROTO_CLIENT_SECRET, ATPROTO_PASSWORD, ATPROTO_TEST_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies3 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediummermaid@11.12.0GHSA-87f9-hvmw-gh4p

Mermaid: Improper sanitization of configuration leads to CSS injection

mediummermaid@11.12.0GHSA-ghcm-xqfw-q4vr

Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection

mediummermaid@11.12.0GHSA-xcj9-5m2h-648r

Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection

lowmermaid@11.12.0GHSA-6m6c-36f7-fhxh

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configATPROTO_AUTH_METHOD

configATPROTO_CLIENT_ID

🔐 secretATPROTO_CLIENT_SECRET

configATPROTO_IDENTIFIER— "": "your-handle.bsky.social",

configATPROTO_MEDIA_DIR— base directory (, default: working directory).

🔐 secretATPROTO_PASSWORD— "": "your-app-password"

configATPROTO_RELAY

configATPROTO_SERVICE

configATPROTO_TEST_IDENTIFIER

🔐 secretATPROTO_TEST_PASSWORD

configATPROTO_TEST_SERVICE

configGITHUB_ACTIONS

configLOG_LEVEL

configMCP_SERVER_HOST

configMCP_SERVER_NAME

configMCP_SERVER_PORT

configRUN_INTEGRATION_TESTS

configTEST_ANALYTICS

configTEST_BATCH_OPERATIONS

configTEST_CLEANUP_ENABLED

configTEST_MAX_FOLLOWS_PER_RUN

configTEST_MAX_LIKES_PER_RUN

configTEST_MAX_POSTS_PER_RUN

configTEST_MEDIA_UPLOADS

configTEST_MODERATION

configTEST_PUBLIC_ACCOUNT_1

configTEST_PUBLIC_ACCOUNT_2

configTEST_PUBLIC_DID

configTEST_RATE_LIMIT_DELAY

configTEST_REQUEST_TIMEOUT

configTEST_STREAMING

configTEST_WRITE_OPERATIONS

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 1 concrete improvement we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/cameronrye-atproto-mcp-1p6sie)](https://m8ven.ai/mcp/cameronrye-atproto-mcp-1p6sie)

commit: a4bbe2754752d5036b078f8bc9283a3bdeed4bff

code hash: 0edea6daf9107c2b922d2f2ac161eed5da0b57623003cfa15a6067f9e2516918

verified: 6/11/2026, 12:25:07 PM

view raw JSON →