# io.github.cameronrye/activitypub-mcp (npm · activitypub-mcp)

Read-only-by-default MCP server: let LLMs explore the Fediverse — Mastodon, Misskey, Pleroma.

- Trust score: 81/100 (high trust)
- Change this week: +28
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `activitypub-mcp`: 81/100 (this document), [markdown](https://verifymcp.io/servers/cameronrye-activitypub-mcp/activitypub-mcp.md), [page](https://verifymcp.io/servers/cameronrye-activitypub-mcp/activitypub-mcp)

## Channel facts

- Registry: `npm`
- Package: `activitypub-mcp`
- Version: `3.2.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to cameronrye/activitypub-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1501 tokens (~53/item across 28 items; 18 tools + 10 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add cameronrye-activitypub-mcp -- npx -y activitypub-mcp
```

### Codex

```bash
codex mcp add cameronrye-activitypub-mcp -- npx -y activitypub-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cameronrye-activitypub-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "activitypub-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add cameronrye-activitypub-mcp --command npx --arg -y --arg activitypub-mcp
```

### Hermes

```yaml
mcp_servers:
  cameronrye-activitypub-mcp:
    command: "npx"
    args: ["-y", "activitypub-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "cameronrye-activitypub-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "activitypub-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 81, +3)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail
- [functional improvement] Stability: unverified → 0.30

### 2026-08-02 (score 78, +34)

- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] MCP protocol: unverified → pass

### 2026-08-01 (score 44, +18)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security] The attested source repository moved: cameronrye/activitypub-mcp
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-07-31 (score 26, −9)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 35, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 53)

First indexed and scored.

## MCP tools (18)

### `discover-actor` (~100 tokens)

Discover Fediverse Actor

Find and retrieve the profile of any fediverse user or account (called an 'actor' in ActivityPub). Returns display name, bio, follower/following URLs, and inbox/outbox endpoints. Pass a handle like '@alice@mastodon.social' or 'alice@mastodon.social'.

Input parameters:

- `identifier` (string, required): Actor handle in 'user@domain' or '@user@domain' form (e.g., 'alice@mastodon.social')

Output parameters:

- `actor` (object)

### `discover-instances` (~139 tokens)

Discover Fediverse Instances

Discover fediverse instances in real-time using the instances.social API with advanced filtering

Input parameters:

- `language` (string): Filter by language code (e.g., 'en', 'de', 'ja')
- `limit` (number): Number of results (default: 20)
- `maxUsers` (number): Maximum number of users
- `minUsers` (number): Minimum number of users
- `openRegistrations` (boolean): Only show instances with open registrations
- `software` (string): Filter by software type
- `sortBy` (string): Sort results by field
- `sortOrder` (string): Sort order (default: desc)

Output parameters:

- `hasMore` (boolean)
- `instances` (array)

### `fetch-timeline` (~146 tokens)

Fetch Actor Timeline

Fetch recent posts (the outbox) from any fediverse actor — a user or account — with cursor- and ID-based pagination. Pass a handle like 'alice@mastodon.social'.

Input parameters:

- `cursor` (string): Pagination cursor from previous response to fetch next page
- `identifier` (string, required): Actor identifier (e.g., user@example.social)
- `limit` (number): Number of posts to fetch (default: 20)
- `maxId` (string): Return posts older than this post ID (pagination)
- `minId` (string): Return posts newer than this post ID (pagination)
- `sinceId` (string): Return posts more recent than this post ID

Output parameters:

- `hasMore` (boolean)
- `nextCursor` (string): Opaque cursor for the next page, if more results
- `posts` (array)
- `source` (string): Account/actor/instance the posts came from

### `get-post-thread` (~80 tokens)

Get Post Thread

Fetch a post and its full conversation thread including replies and parent posts

Input parameters:

- `depth` (number): How many levels of nested replies to fetch (default: 2)
- `maxReplies` (number): Maximum number of replies to fetch (default: 50)
- `postUrl` (string, required): The URL of the post to fetch the thread for

Output parameters:

- `ancestors` (array)
- `post` (object)
- `replies` (array)

### `search` (~86 tokens)

Search Fediverse

Unified search across the fediverse - find accounts, posts, or hashtags on any instance

Input parameters:

- `domain` (string): Instance domain to search on (default: mastodon.social)
- `limit` (number): Number of results per type (default: 10)
- `query` (string, required): Search query
- `type` (string): Type of content to search for (default: all)

Output parameters:

- `accounts` (array)
- `hashtags` (array)
- `statuses` (array)

### `get-trending-hashtags` (~66 tokens)

Get Trending Hashtags

Get currently trending hashtags on a fediverse instance (Mastodon-compatible instances that expose a trends API).

Input parameters:

- `domain` (string, required): Instance domain (e.g., mastodon.social)
- `limit` (number): Number of hashtags to fetch (default: 20)

Output parameters:

- `hashtags` (array)

### `get-trending-posts` (~65 tokens)

Get Trending Posts

Get currently trending posts on a fediverse instance (Mastodon-compatible instances that expose a trends API).

Input parameters:

- `domain` (string, required): Instance domain (e.g., mastodon.social)
- `limit` (number): Number of posts to fetch (default: 20)

Output parameters:

- `hasMore` (boolean)
- `nextCursor` (string): Opaque cursor for the next page, if more results
- `posts` (array)
- `source` (string): Account/actor/instance the posts came from

### `get-public-timeline` (~110 tokens)

Get Public Timeline

Fetch an instance's public timeline. scope 'federated' (default) shows posts the instance has seen from across the fediverse; 'local' shows only posts authored on that instance.

Input parameters:

- `domain` (string, required): Instance domain, e.g. mastodon.social
- `limit` (number): Number of posts to fetch (default: 20)
- `maxId` (string): Return results older than this ID (for pagination)
- `scope` (string): default: federated

Output parameters:

- `hasMore` (boolean)
- `nextCursor` (string): Opaque cursor for the next page, if more results
- `posts` (array)
- `source` (string): Account/actor/instance the posts came from

### `get-instance-info` (~54 tokens)

Get Instance Information

Get detailed information about a fediverse instance: software and version, description, registration policy, supported languages, user/post/domain counts, and contact account.

Input parameters:

- `domain` (string, required): Instance domain (e.g., example.social)

Output parameters:

- `description` (string)
- `domain` (string)
- `registrationsOpen` (boolean)
- `software` (string)
- `title` (string)
- `users` (number)
- `version` (string)

### `list-accounts` (~18 tokens)

List Configured Accounts

List all configured authenticated accounts for write operations

Output parameters:

- `accounts` (array)
- `activeAccountId` (string)
- `writeEnabled` (boolean)

### `switch-account` (~39 tokens)

Switch Active Account

Switch the active account used for write operations

Input parameters:

- `accountId` (string, required): The account ID to switch to (use list-accounts to see IDs)

Output parameters:

- `accountId` (string)
- `active` (boolean)
- `instance` (string)
- `username` (string)
- `verified` (boolean)

### `verify-account` (~38 tokens)

Verify Account Credentials

Verify that the account credentials are valid and get account information

Input parameters:

- `accountId` (string): The account ID to verify (defaults to active account)

Output parameters:

- `accountId` (string)
- `active` (boolean)
- `instance` (string)
- `username` (string)
- `verified` (boolean)

### `get-home-timeline` (~75 tokens)

Get Home Timeline

Get your personalized home timeline (posts from accounts you follow)

Input parameters:

- `accountId` (string): Account ID
- `limit` (number): Number of posts (default: 20)
- `maxId` (string): Return posts older than this ID
- `sinceId` (string): Return posts newer than this ID

Output parameters:

- `hasMore` (boolean)
- `nextCursor` (string): Opaque cursor for the next page, if more results
- `posts` (array)
- `source` (string): Account/actor/instance the posts came from

### `get-notifications` (~57 tokens)

Get Notifications

Get your notifications (mentions, follows, boosts, favourites)

Input parameters:

- `accountId` (string): Account ID
- `limit` (number): Number of notifications (default: 20)
- `types` (array): Filter by notification types

Output parameters:

- `notifications` (array)

### `get-bookmarks` (~39 tokens)

Get Bookmarks

Get your bookmarked posts

Input parameters:

- `accountId` (string): Account ID
- `limit` (number): Number of posts (default: 20)

Output parameters:

- `hasMore` (boolean)
- `nextCursor` (string): Opaque cursor for the next page, if more results
- `posts` (array)
- `source` (string): Account/actor/instance the posts came from

### `get-favourites` (~41 tokens)

Get Favourites

Get posts you have favourited

Input parameters:

- `accountId` (string): Account ID
- `limit` (number): Number of posts (default: 20)

Output parameters:

- `hasMore` (boolean)
- `nextCursor` (string): Opaque cursor for the next page, if more results
- `posts` (array)
- `source` (string): Account/actor/instance the posts came from

### `get-relationship` (~123 tokens)

Get Relationship

Check your relationship status with another account (following, followed by, blocking, muting, etc.). Pass a single acct like 'username@instance'. To check multiple accounts, call this tool once per account.

Input parameters:

- `accountId` (string): Your account ID
- `accountIds`: Deprecated / not supported. Use 'acct' (a single username@instance string) and call this tool once per account.
- `acct` (string, required): Account to check relationship with (username@instance). If you have multiple accounts to check, call this tool once per account.

Output parameters:

- `acct` (string)
- `blocking` (boolean)
- `followedBy` (boolean)
- `following` (boolean)
- `muting` (boolean)
- `requested` (boolean)

### `get-scheduled-posts` (~46 tokens)

Get Scheduled Posts

List your scheduled posts that haven't been published yet

Input parameters:

- `accountId` (string): Account ID
- `limit` (number): Number of posts (default: 20)

Output parameters:

- `scheduledPosts` (array)

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/cameronrye-activitypub-mcp/activitypub-mcp#diagnostics

## Score history

- 2026-08-04: 81
- 2026-08-03: 78
- 2026-08-02: 78
- 2026-08-01: 44
- 2026-07-31: 26
- 2026-07-30: 35
- 2026-07-28: 53
- 2026-07-27: 53

## Links

- npm package: https://www.npmjs.com/package/activitypub-mcp
- Socket report: https://socket.dev/npm/package/activitypub-mcp
- Repository: https://github.com/cameronrye/activitypub-mcp
- Changelog RSS feed: https://verifymcp.io/servers/cameronrye-activitypub-mcp/activitypub-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/cameronrye-activitypub-mcp/activitypub-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/cameronrye-activitypub-mcp/activitypub-mcp