Buzz messaging plugin

Cursor/Grok Bot plugin with a TypeScript MCP (stdio or Streamable HTTP) for Buzz/NIP-29 messaging—send, list, thread, and inbox tools plus split skills so keys can stay off the shared Bot box.

View source ↗

Caution: review the findings below before installing.

CautionScan verdict · score 50/100

Coverage: full
Checks run: Rule-based pattern scan
Files checked: 41
Findings: 4
Scanned: 2026-11-01

Badges are rule-based checks, not guarantees: Safe means our rules found no obvious threat in the code we could read. Review code before installing.

View source ↗

Botlens score · 8 factors

50/100

Each factor is 0, ½ or 1, computed only from catalog fields (scan result, coverage, findings, script files, commit/SHA, author, last seen, install link). A heuristic summary, not a guarantee.

Scan verdict	0.5/1	Caution
Code coverage	1/1	full
Rule findings	0/1	12 matched
No executable scripts	0/1	28 script file(s) of 41
Pinned source	1/1	commit/SHA-256 recorded
Named author	0/1	unknown
Recently seen	1/1	last seen 2026-10-30
Install path	0.5/1	source URL only

Scan details

Findings

Hand review 2026-11-01: Holds its own Nostr private key from config (src/config.ts:29); signs messages by design.
sends or posts automatically without approval: "…*directed-at-me** polling and auto-reply (mentions plus e-tag replies …"
uploads data to a remote server in test/http.test.ts: "… unknown; }> { const response = await fetch(url, { method: "POST", headers: { "content-type": …"
reads environment variables (where API keys live) in src/cli.ts: "…v: string[], env: NodeJS.ProcessEnv = process.env, ): CliOptions { const http = arg…"

Content SHA-256

ad191eb6bb6d1fb8…

Commit

4548c8b8dd

Files

.gitattributes
.gitignore
LICENSE
README.md
mcp.json
package-lock.json
+35

About

Author: davidorban ↗
Listed on: github:RongleCat/awesome-grok-bot ↗
Category (approx.): agentops
First seen: 2026-10-30
Last seen: 2026-10-30
URL: github.com ↗

Get the Botlens skill