nostr-bray 1.18.2 → 1.20.0

package/README.md

@@ -8,7 +8,7 @@
 [![licence](https://img.shields.io/npm/l/nostr-bray)](./LICENSE)
 [![TypeScript](https://img.shields.io/badge/TypeScript-ESM-blue)](./tsconfig.json)
 
-An MCP server that gives AI agents a full Nostr identity — not just a key pair, but a hierarchical identity tree with personas, attestations, ring signatures, encrypted DMs, and duress detection. 74 tools across 10 groups.
+An MCP server that gives AI agents a full Nostr identity — not just a key pair, but a hierarchical identity tree with personas, attestations, ring signatures, encrypted DMs, and duress detection. 77 tools across 10 groups.
 
 ## The Problem
 
@@ -68,140 +68,144 @@ Or with a secret file (recommended):
 
 ## Tool Groups
 
-### Identity (11 tools)
+### Identity (12 tools)
 
 | Tool | Description |
 |------|-------------|
-| `identity_create` | Generate a fresh identity with BIP-39 mnemonic |
-| `identity_derive` | Derive a child identity by purpose and index |
-| `identity_derive_persona` | Derive a named persona (work, personal, anonymous) |
-| `identity_switch` | Switch active identity — all tools operate as the new identity |
-| `identity_list` | List all known identities (public info only) |
-| `identity_prove` | Create blind/full linkage proof |
-| `identity_backup_shamir` | Split master secret into Shamir shard files |
-| `identity_restore_shamir` | Reconstruct secret from shard files |
-| `identity_backup` | Fetch profile, contacts, relay list as portable bundle |
-| `identity_restore` | Re-sign migratable events under the active identity |
-| `identity_migrate` | Full migration with preview, confirmation, and linkage proof |
+| `whoami` | Returns the active identity's npub |
+| `identity-create` | Generate a fresh identity with BIP-39 mnemonic |
+| `identity-derive` | Derive a child identity by purpose and index |
+| `identity-derive-persona` | Derive a named persona (work, personal, anonymous) |
+| `identity-switch` | Switch active identity — all tools operate as the new identity |
+| `identity-list` | List all known identities (public info only) |
+| `identity-prove` | Create blind/full linkage proof |
+| `identity-backup-shamir` | Split master secret into Shamir shard files |
+| `identity-restore-shamir` | Reconstruct secret from shard files |
+| `identity-backup` | Fetch profile, contacts, relay list as portable bundle |
+| `identity-restore` | Re-sign migratable events under the active identity |
+| `identity-migrate` | Full migration with preview, confirmation, and linkage proof |
 
 ### Social (14 tools)
 
 | Tool | Description |
 |------|-------------|
-| `social_post` | Post a text note (kind 1) |
-| `social_reply` | Reply with correct e-tag and p-tag threading |
-| `social_react` | React to an event (kind 7) |
-| `social_delete` | Request deletion of your event (kind 5) |
-| `social_repost` | Repost/boost an event (kind 6) |
-| `social_profile_get` | Fetch and parse a kind 0 profile |
-| `social_profile_set` | Set profile with overwrite safety guard |
-| `dm_send` | Send encrypted DM (NIP-17 default, NIP-04 opt-in) |
-| `dm_read` | Read and decrypt received DMs |
-| `contacts_get` | Fetch contact list (kind 3 follows) |
-| `contacts_follow` | Follow a pubkey (publishes updated kind 3) |
-| `contacts_unfollow` | Unfollow a pubkey |
-| `social_notifications` | Fetch mentions, replies, reactions, zap receipts |
-| `social_feed` | Fetch kind 1 text note feed |
+| `social-post` | Post a text note (kind 1) |
+| `social-reply` | Reply with correct e-tag and p-tag threading |
+| `social-react` | React to an event (kind 7) |
+| `social-delete` | Request deletion of your event (kind 5) |
+| `social-repost` | Repost/boost an event (kind 6) |
+| `social-profile-get` | Fetch and parse a kind 0 profile |
+| `social-profile-set` | Set profile with overwrite safety guard |
+| `dm-send` | Send encrypted DM (NIP-17 default, NIP-04 opt-in) |
+| `dm-read` | Read and decrypt received DMs |
+| `contacts-get` | Fetch contact list (kind 3 follows) |
+| `contacts-follow` | Follow a pubkey (publishes updated kind 3) |
+| `contacts-unfollow` | Unfollow a pubkey |
+| `social-notifications` | Fetch mentions, replies, reactions, zap receipts |
+| `social-feed` | Fetch kind 1 text note feed |
 
 ### Trust (11 tools)
 
 | Tool | Description |
 |------|-------------|
-| `trust_attest` | Create kind 31000 verifiable attestation |
-| `trust_read` | Read attestations by subject/type/attestor |
-| `trust_verify` | Validate attestation structure |
-| `trust_revoke` | Revoke an attestation (identity check) |
-| `trust_request` | Send attestation request via NIP-17 |
-| `trust_request_list` | Scan DMs for attestation requests |
-| `trust_proof_publish` | Publish linkage proof (kind 30078) with confirmation |
-| `trust_ring_prove` | Anonymous group membership proof (ring signature) |
-| `trust_ring_verify` | Verify ring signature proof |
-| `trust_spoken_challenge` | Generate spoken verification token |
-| `trust_spoken_verify` | Verify spoken token response |
-
-### Relay (4 tools)
+| `trust-attest` | Create kind 31000 verifiable attestation |
+| `trust-read` | Read attestations by subject/type/attestor |
+| `trust-verify` | Validate attestation structure |
+| `trust-revoke` | Revoke an attestation (identity check) |
+| `trust-request` | Send attestation request via NIP-17 |
+| `trust-request-list` | Scan DMs for attestation requests |
+| `trust-proof-publish` | Publish linkage proof (kind 30078) with confirmation |
+| `trust-ring-prove` | Anonymous group membership proof (ring signature) |
+| `trust-ring-verify` | Verify ring signature proof |
+| `trust-spoken-challenge` | Generate spoken verification token |
+| `trust-spoken-verify` | Verify spoken token response |
+
+### Relay (5 tools)
 
 | Tool | Description |
 |------|-------------|
-| `relay_list` | List relays with shared-relay warnings |
-| `relay_set` | Publish kind 10002 relay list |
-| `relay_add` | Add relay to active identity (in-memory) |
-| `relay_info` | Fetch NIP-11 relay information document |
+| `relay-list` | List relays with shared-relay warnings |
+| `relay-set` | Publish kind 10002 relay list |
+| `relay-add` | Add relay to active identity (in-memory) |
+| `relay-query` | Query events from relays by kind, author, tags, or time range |
+| `relay-info` | Fetch NIP-11 relay information document |
 
 ### Zap (7 tools)
 
 | Tool | Description |
 |------|-------------|
-| `zap_send` | Pay a Lightning invoice via NWC |
-| `zap_balance` | Request wallet balance via NWC |
-| `zap_make_invoice` | Generate a Lightning invoice via NWC |
-| `zap_lookup_invoice` | Check invoice payment status via NWC |
-| `zap_list_transactions` | List recent Lightning transactions |
-| `zap_receipts` | Parse zap receipts (amount, sender, message) |
-| `zap_decode` | Decode bolt11 invoice fields |
+| `zap-send` | Pay a Lightning invoice via NWC |
+| `zap-balance` | Request wallet balance via NWC |
+| `zap-make-invoice` | Generate a Lightning invoice via NWC |
+| `zap-lookup-invoice` | Check invoice payment status via NWC |
+| `zap-list-transactions` | List recent Lightning transactions |
+| `zap-receipts` | Parse zap receipts (amount, sender, message) |
+| `zap-decode` | Decode bolt11 invoice fields |
 
 ### Safety (2 tools)
 
 | Tool | Description |
 |------|-------------|
-| `safety_configure` | Configure an alternative identity persona |
-| `safety_activate` | Switch to alternative identity |
+| `safety-configure` | Configure an alternative identity persona |
+| `safety-activate` | Switch to alternative identity |
 
 ### Blossom (3 tools)
 
 | Tool | Description |
 |------|-------------|
-| `blossom_upload` | Upload file to a blossom media server |
-| `blossom_list` | List blobs for a pubkey |
-| `blossom_delete` | Delete a blob by SHA-256 hash |
+| `blossom-upload` | Upload file to a blossom media server |
+| `blossom-list` | List blobs for a pubkey |
+| `blossom-delete` | Delete a blob by SHA-256 hash |
 
 ### Groups — NIP-29 (4 tools)
 
 | Tool | Description |
 |------|-------------|
-| `group_info` | Fetch group metadata |
-| `group_chat` | Read group chat messages |
-| `group_send` | Send message to a group |
-| `group_members` | List group members |
+| `group-info` | Fetch group metadata |
+| `group-chat` | Read group chat messages |
+| `group-send` | Send message to a group |
+| `group-members` | List group members |
 
 ### Community NIPs (2 tools)
 
 | Tool | Description |
 |------|-------------|
-| `nip_publish` | Publish a community NIP (kind 30817) |
-| `nip_read` | Fetch community NIPs |
+| `nip-publish` | Publish a community NIP (kind 30817) |
+| `nip-read` | Fetch community NIPs |
 
-### Utility (16 tools)
+### Utility (18 tools)
 
 | Tool | Description |
 |------|-------------|
 | `decode` | Decode npub/nsec/note/nevent/nprofile/naddr |
-| `encode_npub` | Encode hex pubkey as npub |
-| `encode_note` | Encode hex event ID as note |
-| `encode_nprofile` | Encode pubkey + relays as nprofile |
-| `encode_nevent` | Encode event ID + relays as nevent |
-| `encode_naddr` | Encode addressable event as naddr |
-| `encode_nsec` | Encode hex private key as nsec |
-| `key_public` | Derive pubkey from secret key |
-| `verify_event` | Verify event hash and signature |
+| `encode-npub` | Encode hex pubkey as npub |
+| `encode-note` | Encode hex event ID as note |
+| `encode-nprofile` | Encode pubkey + relays as nprofile |
+| `encode-nevent` | Encode event ID + relays as nevent |
+| `encode-naddr` | Encode addressable event as naddr |
+| `encode-nsec` | Encode hex private key as nsec |
+| `key-public` | Derive pubkey from secret key |
+| `key-encrypt` | Encrypt a secret key with a password (NIP-49 ncryptsec) |
+| `key-decrypt` | Decrypt an ncryptsec (NIP-49) with a password |
+| `verify-event` | Verify event hash and signature |
 | `filter` | Test if an event matches a filter |
-| `nip44_encrypt` | NIP-44 encrypt for a recipient |
-| `nip44_decrypt` | NIP-44 decrypt from a sender |
+| `nip44-encrypt` | NIP-44 encrypt for a recipient |
+| `nip44-decrypt` | NIP-44 decrypt from a sender |
 | `count` | Count events matching a filter |
 | `fetch` | Fetch events by nip19 code |
-| `nip_list` | List all official NIPs |
-| `nip_show` | Show a specific NIP's content |
+| `nip-list` | List all official NIPs |
+| `nip-show` | Show a specific NIP's content |
 
 ## Identity Switching
 
 The killer feature. Every tool operates as the "active identity." Switch with a single call:
 
 ```
-identity_derive_persona("work")    → npub1abc...
-identity_switch("work")            → now operating as work persona
-social_post("Hello from work!")    → signed by npub1abc...
-identity_switch("master")          → back to master
-social_post("Back to main")       → signed by master npub
+identity-derive-persona("work")    → npub1abc...
+identity-switch("work")            → now operating as work persona
+social-post("Hello from work!")    → signed by npub1abc...
+identity-switch("master")          → back to master
+social-post("Back to main")       → signed by master npub
 ```
 
 Derived identities are cryptographically unlinkable unless you publish a linkage proof.

package/dist/identity/tools.js

@@ -6,7 +6,15 @@ import { handleBackupShamir, handleRestoreShamir } from './shamir.js';
 import { hexId } from '../validation.js';
 import { handleIdentityBackup, handleIdentityRestore, handleIdentityMigrate } from './migration.js';
 export function registerIdentityTools(server, deps) {
-    server.registerTool('identity_create', {
+    server.registerTool('whoami', {
+        description: 'Returns the active identity\'s npub. The simplest way to check which identity is currently in use.',
+        annotations: { readOnlyHint: true },
+    }, async () => {
+        return {
+            content: [{ type: 'text', text: deps.ctx.activeNpub }],
+        };
+    });
+    server.registerTool('identity-create', {
         description: 'Generate a fresh Nostr identity with a BIP-39 mnemonic seed. Returns { npub, mnemonic }. Store the mnemonic securely — it will not be shown again. Use this when the user needs a brand new identity unrelated to the current one.',
         annotations: { readOnlyHint: false },
     }, async () => {
@@ -15,7 +23,7 @@ export function registerIdentityTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
         };
     });
-    server.registerTool('identity_derive', {
+    server.registerTool('identity-derive', {
         description: 'Derive a child Nostr identity from the master key by purpose and index. Deterministic — same inputs always produce the same npub. Returns { npub, purpose, index }. Use identity_switch after deriving to operate as the new identity.',
         inputSchema: {
             purpose: z.string().describe('Purpose string for derivation (e.g. "messaging", "signing")'),
@@ -28,7 +36,7 @@ export function registerIdentityTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
         };
     });
-    server.registerTool('identity_derive_persona', {
+    server.registerTool('identity-derive-persona', {
         description: 'Derive a named persona (e.g. "work", "personal", "anonymous"). Like identity_derive but uses a human-readable name. Returns { npub, personaName, index }. Follow with identity_switch to activate.',
         inputSchema: {
             name: z.string().describe('Persona name (e.g. "work", "personal", "anonymous")'),
@@ -41,7 +49,7 @@ export function registerIdentityTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
         };
     });
-    server.registerTool('identity_switch', {
+    server.registerTool('identity-switch', {
         description: 'Switch the active Nostr identity. ALL subsequent tool calls will sign events and query relays as the new identity. Pass "master" to return to root. Returns { npub } of the now-active identity. This is the key tool for multi-persona workflows.',
         inputSchema: {
             target: z.string().describe('Purpose, persona name, or "master" to switch to'),
@@ -54,17 +62,17 @@ export function registerIdentityTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
         };
     });
-    server.registerTool('identity_list', {
+    server.registerTool('identity-list', {
         description: 'List all known identities (master + all derived). Returns array of { npub, purpose, index, personaName }. Never includes private keys. Use this to see what identities are available before switching.',
         inputSchema: {
-            output: z.enum(['json', 'human']).default('json').describe('Response format'),
+            output: z.enum(['json', 'human']).default('human').describe('Response format'),
         },
         annotations: { readOnlyHint: true },
     }, async ({ output }) => {
         const result = handleIdentityList(deps.ctx);
         return toolResponse(result, output, fmt.formatIdentityList);
     });
-    server.registerTool('identity_prove', {
+    server.registerTool('identity-prove', {
         description: 'Create a cryptographic linkage proof between the master key and the active identity. "blind" (default) proves they share a master without revealing how the child was derived. "full" also reveals the purpose and index. Returns a LinkageProof object that can be verified by anyone with nsec-tree. Use trust_proof_publish to make it permanent on relays.',
         inputSchema: {
             mode: z.enum(['blind', 'full']).default('blind').describe('Proof mode: "blind" hides derivation path, "full" reveals purpose and index'),
@@ -76,7 +84,7 @@ export function registerIdentityTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify(proof, null, 2) }],
         };
     });
-    server.registerTool('identity_backup_shamir', {
+    server.registerTool('identity-backup-shamir', {
         description: 'Split the active identity\'s private key into Shamir shard files using threshold secret sharing. Any "threshold" shards can reconstruct the key. Files written with 0600 permissions via atomic rename. Returns file paths only — shard content never appears in the response.',
         inputSchema: {
             threshold: z.number().int().min(2).describe('Minimum shards needed to reconstruct'),
@@ -98,7 +106,7 @@ export function registerIdentityTools(server, deps) {
                     }, null, 2) }],
         };
     });
-    server.registerTool('identity_restore_shamir', {
+    server.registerTool('identity-restore-shamir', {
         description: 'Reconstruct a secret from Shamir shard files. Returns the restored npub for verification.',
         inputSchema: {
             files: z.array(z.string()).describe('Paths to shard files'),
@@ -121,7 +129,7 @@ export function registerIdentityTools(server, deps) {
                     }, null, 2) }],
         };
     });
-    server.registerTool('identity_backup', {
+    server.registerTool('identity-backup', {
         description: 'Fetch profile, contacts, relay list, and attestations for a pubkey. Returns a portable JSON bundle (no private keys).',
         inputSchema: {
             pubkeyHex: hexId.describe('Hex pubkey to back up'),
@@ -139,7 +147,7 @@ export function registerIdentityTools(server, deps) {
                     }, null, 2) }],
         };
     });
-    server.registerTool('identity_restore', {
+    server.registerTool('identity-restore', {
         description: 'Re-sign migratable events (profile, contacts, relay list) under the active identity. Skips attestations (trust chain protection).',
         inputSchema: {
             pubkeyHex: hexId.describe('Hex pubkey of the original identity to restore from'),
@@ -154,7 +162,7 @@ export function registerIdentityTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
         };
     });
-    server.registerTool('identity_migrate', {
+    server.registerTool('identity-migrate', {
         description: 'Migrate from an old identity to the active one. Shows preview first — set confirm: true to execute. Publishes linkage proof and re-signs migratable events.',
         inputSchema: {
             oldPubkeyHex: z.string().describe('Hex pubkey of the old identity'),

package/dist/index.js

@@ -32,9 +32,10 @@ export const deps = { ctx: ctx, pool, nip65, nwcUri: config.nwcUri };
 config.secretKey = '';
 config.nwcUri = undefined;
 config.bunkerUri = undefined;
-// Load master identity relay list
-const masterRelays = await nip65.loadForIdentity(ctx.activeNpub);
-pool.reconfigure(ctx.activeNpub, masterRelays);
+// Load master identity relay list in the background — don't block tool registration
+nip65.loadForIdentity(ctx.activeNpub).then(masterRelays => {
+    pool.reconfigure(ctx.activeNpub, masterRelays);
+}).catch(e => console.error('NIP-65 relay load failed:', e.message));
 const server = new McpServer({ name: 'nostr-bray', version: '0.1.0' });
 // Phase 2: Identity tools
 registerIdentityTools(server, deps);

package/dist/relay/tools.js

@@ -4,18 +4,18 @@ import { toolResponse } from '../tool-response.js';
 import * as fmt from '../format.js';
 import { handleRelayList, handleRelaySet, handleRelayAdd, handleRelayInfo, handleRelayQuery } from './handlers.js';
 export function registerRelayTools(server, deps) {
-    server.registerTool('relay_list', {
+    server.registerTool('relay-list', {
         description: 'List the relay set (read/write) for the active identity. Optionally check for shared relays with another identity.',
         inputSchema: {
             compareWithNpub: z.string().optional().describe('Compare shared relays with this npub'),
-            output: z.enum(['json', 'human']).default('json').describe('Response format'),
+            output: z.enum(['json', 'human']).default('human').describe('Response format'),
         },
         annotations: { readOnlyHint: true },
     }, async ({ compareWithNpub, output }) => {
         const result = handleRelayList(deps.ctx, deps.pool, compareWithNpub);
         return toolResponse(result, output, fmt.formatRelays);
     });
-    server.registerTool('relay_set', {
+    server.registerTool('relay-set', {
         description: 'Publish a kind 10002 relay list for the active identity. Warns if a relay list already exists.',
         inputSchema: {
             relays: z.array(z.object({
@@ -24,7 +24,7 @@ export function registerRelayTools(server, deps) {
             })).describe('Relay entries'),
             confirm: z.boolean().default(false).describe('Set true to overwrite existing relay list'),
         },
-        annotations: { readOnlyHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true },
     }, async ({ relays, confirm }) => {
         const result = await handleRelaySet(deps.ctx, deps.pool, { relays, confirm });
         return {
@@ -33,7 +33,7 @@ export function registerRelayTools(server, deps) {
                         : { published: true, id: result.event.id }, null, 2) }],
         };
     });
-    server.registerTool('relay_add', {
+    server.registerTool('relay-add', {
         description: 'Add a single relay to the active identity\'s relay set (in-memory only — does not publish kind 10002).',
         inputSchema: {
             url: relayUrl.describe('Relay WebSocket URL'),
@@ -46,7 +46,7 @@ export function registerRelayTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
         };
     });
-    server.registerTool('relay_query', {
+    server.registerTool('relay-query', {
         description: 'Query events from Nostr relays by kind, author, tags, or time range. Useful for discovering events, scanning for specific kinds, or investigating unknown event schemas. Uses explicit relays if provided, otherwise the active identity\'s read relays.',
         inputSchema: {
             kinds: z.array(z.number().int()).optional().describe('Event kinds to filter by (e.g. [30301, 31000])'),
@@ -74,7 +74,7 @@ export function registerRelayTools(server, deps) {
             content: [{ type: 'text', text: JSON.stringify({ count: events.length, events: summary }, null, 2) }],
         };
     });
-    server.registerTool('relay_info', {
+    server.registerTool('relay-info', {
         description: 'Fetch the NIP-11 relay information document for a relay URL.',
         inputSchema: {
             url: relayUrl.describe('Relay WebSocket URL (wss://...)'),

package/dist/safety/tools.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { handleDuressConfigure, handleDuressActivate } from './handlers.js';
 export function registerSafetyTools(server, deps) {
-    server.registerTool('safety_configure', {
+    server.registerTool('safety-configure', {
         description: 'Configure an alternative identity persona and pre-warm relay connections.',
         inputSchema: {
             personaName: z.string().default('anonymous').describe('Persona name for the alternative identity'),
@@ -14,12 +14,12 @@ export function registerSafetyTools(server, deps) {
         };
     });
     // Description intentionally does NOT mention duress — appears as normal identity switch
-    server.registerTool('safety_activate', {
+    server.registerTool('safety-activate', {
         description: 'Switch to an alternative identity configuration.',
         inputSchema: {
             personaName: z.string().default('anonymous').describe('Persona name to switch to'),
         },
-        annotations: { readOnlyHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true },
     }, async ({ personaName }) => {
         const result = handleDuressActivate(deps.ctx, { personaName });
         return {