# group-invite-create Create a NIP-29 invite with kind 9009. Returns the code that a user supplies to group-join. Agent View of the PolicyLayer registry record for `group-invite-create`. HTML page: https://policylayer.com/tools/dev-forgesworn-bray/group-invite-create ## Facts - Tool: `group-invite-create` - Server: Nostr Bray (`nostr-bray`) — https://policylayer.com/tools/dev-forgesworn-bray.md - Install: `npx -y nostr-bray` - Homepage: https://github.com/forgesworn/bray - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "group-invite-create", "arguments": {} } } ``` ## Why group-invite-create is rated Medium This tool creates new invite objects (NIP-29 protocol invites) and returns codes, which is a reversible write operation. It does not execute arbitrary code, delete data, or move funds. The severity is medium because misuse could spam invites or create unauthorized group access, but the blast radius is limited to group membership state which can be remediated by rejection or revocation. From the tool's own definition: "The tool description states it 'Create[s] a NIP-29 invite with kind 9009' and 'Returns the code that a user supplies to group-join.' The verb 'Create' indicates data modification; the return of an invite code means the tool generates and stores new invitation…" ## Use case AI agents use group-invite-create to create or update resources in Nostr Bray, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Nostr Bray environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Nostr Bray: ```json { "version": "1", "default": "deny", "tools": { "group-invite-create": { "limits": [ { "counter": "group-invite-create_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Nostr Bray (260) - `blossom-delete` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/blossom-delete.md - `group-delete` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/group-delete.md - `group-delete-event` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/group-delete-event.md - `group-remove-user` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/group-remove-user.md - `label-remove` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/label-remove.md - `marketplace-credentials-clear` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-credentials-clear.md - `marketplace-retire` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-retire.md - `social-delete` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/social-delete.md - `tombstone` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/tombstone.md - `trust-revoke` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/trust-revoke.md - `vault-revoke` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/vault-revoke.md - `wallet-revoke` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/wallet-revoke.md - `zap-wallet-clear` — Destructive — https://policylayer.com/tools/dev-forgesworn-bray/zap-wallet-clear.md - `cast-spell` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/cast-spell.md - `execute-action` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/execute-action.md - `identity-restore-shamir` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/identity-restore-shamir.md - `identity-switch` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/identity-switch.md - `marketplace-probe` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-probe.md - `nip44-encrypt` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/nip44-encrypt.md - `onboard-verified` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/onboard-verified.md - `relay-auth` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/relay-auth.md - `trust-attest-chain` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-attest-chain.md - `trust-ring-lsag-sign` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-ring-lsag-sign.md - `trust-ring-prove` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-ring-prove.md - `trust-spoken-verify` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/trust-spoken-verify.md - `vault-encrypt` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/vault-encrypt.md - `wallet-serve` — Execute — https://policylayer.com/tools/dev-forgesworn-bray/wallet-serve.md - `marketplace-pay` — Financial — https://policylayer.com/tools/dev-forgesworn-bray/marketplace-pay.md - `zap-make-invoice` — Financial — https://policylayer.com/tools/dev-forgesworn-bray/zap-make-invoice.md - `zap-send` — Financial — https://policylayer.com/tools/dev-forgesworn-bray/zap-send.md - …and 230 more: https://policylayer.com/tools/dev-forgesworn-bray.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-forgesworn-bray · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-forgesworn-bray