No passwords
There is no code path that accepts a Bluesky password or an app password. The server holds a grant, which is a different kind of thing entirely.
Gives an AI assistant access to a Bluesky account through AT Protocol OAuth. You approve it on Bluesky itself, and you revoke it there. Nothing to paste, nothing stored.
Any MCP client that speaks OAuth registers itself: there is nothing to configure by hand and no credential to copy. Point it at this endpoint.
https://bluesky.pmcosta.dev/mcpIt will ask your Bluesky server for atproto transition:generic transition:chat.bsky. The third one is what makes direct messages work.
There is no code path that accepts a Bluesky password or an app password. The server holds a grant, which is a different kind of thing entirely.
Every request upstream is signed with a key its token is tied to. A token on its own, without that key, does nothing.
Access ends from your Bluesky settings, whenever you decide, without asking this server for permission.
| Property | Value |
|---|---|
| 42 | Tools: posts, feeds, threads, search, follows, likes, reposts, bookmarks, drafts, notifications, preferences, direct messages |
| OAuth 2.1 | AT Protocol profile: DPoP-bound access tokens, pushed authorization requests, PKCE, handle-to-server identity resolution |
| private_key_jwt | Token endpoint authentication. Signed ES256 client assertions, which is what raises session lifetime to 180 days. |
| RFC 7591 | Dynamic client registration, so MCP clients enrol themselves |
| Streamable | MCP transport over HTTP, stateless, no persistent process |
| 0 | Destructive tools. Account deletion, deactivation, app-password management, invite codes, and server administration are all deliberately absent |