# community-post Post to a community (NIP-72). Creates a kind 1 note with an a-tag pointing to the community. A moderator must approve it before it appears in the feed. Agent View of the PolicyLayer registry record for `community-post`. HTML page: https://policylayer.com/tools/dev-forgesworn-bray/community-post ## Facts - Tool: `community-post` - Server: Nostr Bray (`nostr-bray`) — https://policylayer.com/tools/dev-forgesworn-bray.md - Install: `npx -y nostr-bray` - Homepage: https://github.com/forgesworn/bray - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "community-post", "arguments": {} } } ``` ## Why community-post is rated Medium This tool creates new data (a Nostr note) in a community context, which is a Write operation. It is not Read (no retrieval), not Execute (no code/command execution), not Destructive (content can be deleted or remains in moderation queue), and not Financial. Severity is medium because misuse could spam communities with unwanted posts, but the moderator approval gate and reversibility limit the blast radius. From the tool's own definition: "Tool description states it 'Creates a kind 1 note' and 'Posts to a community', indicating creation of new content. The note requires moderator approval before appearing, suggesting it is reversible (can be deleted/unapproved) rather than immediately permanent." ## Use case AI agents use community-post to create or update resources in Nostr Bray, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Nostr Bray environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Nostr Bray: ```json { "version": "1", "default": "deny", "tools": { "community-post": { "limits": [ { "counter": "community-post_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Nostr Bray (239) - `blossom-delete` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/blossom-delete.md - `group-remove-user` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/group-remove-user.md - `label-remove` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/label-remove.md - `marketplace-credentials-clear` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-credentials-clear.md - `marketplace-retire` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-retire.md - `social-delete` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/social-delete.md - `tombstone` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/tombstone.md - `trust-revoke` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/trust-revoke.md - `vault-revoke` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/vault-revoke.md - `zap-wallet-clear` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/zap-wallet-clear.md - `cast-spell` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/cast-spell.md - `execute-action` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/execute-action.md - `identity-restore-shamir` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/identity-restore-shamir.md - `identity-switch` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/identity-switch.md - `marketplace-probe` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-probe.md - `nip44-encrypt` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/nip44-encrypt.md - `onboard-verified` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/onboard-verified.md - `relay-auth` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/relay-auth.md - `trust-attest-chain` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-attest-chain.md - `trust-ring-lsag-sign` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-ring-lsag-sign.md - `trust-ring-prove` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-ring-prove.md - `trust-spoken-verify` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-spoken-verify.md - `vault-encrypt` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/vault-encrypt.md - `marketplace-pay` — Financial — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-pay.md - `zap-make-invoice` — Financial — https://policylayer.com/tools/dev-forgesworn-bray/zap-make-invoice.md - `zap-send` — Financial — https://policylayer.com/tools/dev-forgesworn-bray/zap-send.md - `article-list` — Read — https://policylayer.com/tools/dev-forgesworn-bray/article-list.md - `article-read` — Read — https://policylayer.com/tools/dev-forgesworn-bray/article-read.md - `badge-list` — Read — https://policylayer.com/tools/dev-forgesworn-bray/badge-list.md - `blossom-check` — Read — https://policylayer.com/tools/dev-forgesworn-bray/blossom-check.md - …and 209 more: https://policylayer.com/tools/dev-forgesworn-bray.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-forgesworn-bray · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-forgesworn-bray