Pipeworx bluesky

Read Bluesky profiles, posts, feeds, followers, and threads via the AT Protocol — 8 tools, mostly public endpoints

Security Scan

The skill is generally coherent for reading public Bluesky data via a Pipeworx gateway, but it asks (in its docs) that you send Bluesky credentials as URL query parameters to a third‑party gateway — a disproportionate and risky practice that isn't reflected in the declared requirements.

Purpose & Capability

Name and description match the runtime instructions: the skill is an instruction-only wrapper for Bluesky (AT Protocol) read endpoints exposed through gateway.pipeworx.io. Requiring curl (a client to call HTTP endpoints) is appropriate.

Instruction Scope

SKILL.md only instructs HTTP calls to the pipeworx gateway and configuration for an MCP client; it does not ask the agent to read local files or unrelated environment variables. However, it explicitly instructs passing credentials as query parameters on the gateway URL for authenticated search, which is a security/correctness concern (credentials in URLs are easily leaked via logs, referer headers, etc.).

Install Mechanism

No install spec and no code files — lowest installation risk. The skill is instruction-only and relies on curl being present.

Credentials

The skill declares no required credentials, yet the documentation instructs users to provide Bluesky credentials (bsky_handle and bsky_app_password) to the pipeworx gateway as query parameters. That means sensitive credentials would be transmitted to a third party (gateway.pipeworx.io) even though the skill doesn't declare or protect them. This is disproportionate and potentially hazardous.

Persistence & Privilege

The skill is not always-enabled and uses normal model invocation. It doesn't request persistent system-wide configuration or elevated privileges.

What to consider before installing

This skill appears to be a simple proxy to a third-party gateway (gateway.pipeworx.io) for reading Bluesky data — that part is coherent. The main problem: its docs tell you to include your bsky_handle and bsky_app_password as query parameters on the gateway URL. That would send your app password to pipeworx (and could leak via logs, referer headers, analytics). Before installing or using it: (1) Confirm you trust the pipeworx gateway and review its privacy/security policy; (2) avoid putting credentials in a URL — prefer server-side auth, POST bodies, or Authorization headers; (3) if you must use an app password, create a scoped/ephemeral password you can revoke; (4) consider running your own MCP/gateway instance instead of a third party; (5) ask the skill author why credentials are not declared in requires.env and why secure auth patterns (env vars, headers) aren't used. If you cannot verify the gateway's trustworthiness, do not supply real Bluesky credentials to it.

Bluesky

Tap into the Bluesky social network through the AT Protocol. Most tools work without authentication against the public API — you can read profiles, browse feeds, list followers, and view threads. Post search requires BYO credentials.

All 8 tools

Tool	Auth	Purpose
get_profile	Public	User profile by handle (e.g., jay.bsky.team)
get_posts	Public	Recent posts from a user's feed
search_posts	Auth required	Search posts by keyword
get_feed	Public	Browse a feed generator (default: What's Hot)
get_followers	Public	List a user's followers
get_follows	Public	List accounts a user follows
get_thread	Public	Full thread from a post's AT URI
resolve_handle	Public	Resolve a handle to its DID

When to use

• Monitoring mentions of a brand or project on Bluesky
• Analyzing follower/following graphs for social network research
• Pulling recent posts from a specific user to summarize or quote
• Building a Bluesky dashboard that aggregates multiple feeds

Example: reading someone's recent posts

curl -s -X POST https://gateway.pipeworx.io/bluesky/mcp \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_posts","arguments":{"handle":"jay.bsky.team","limit":5}}}'

Each post includes the text, timestamp, like count, repost count, and reply count.

Authentication note

search_posts requires Bluesky credentials. Pass them as query parameters on the gateway URL:

https://gateway.pipeworx.io/bluesky/mcp?bsky_handle=you.bsky.social&bsky_app_password=xxxx-xxxx-xxxx

All other tools work anonymously.

MCP client config

{
  "mcpServers": {
    "pipeworx-bluesky": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://gateway.pipeworx.io/bluesky/mcp"]
    }
  }
}