atproto—crates

Tl.

Command-line tools

Eighteen binaries across fourteen crates. Most sit behind the clap feature, which is off by default, so a library never pulls in an argument parser you did not ask for.

§ 01

Building them

Build the whole set once and put them on your path, or run them ad hoc through cargo run. The workspace build produces the SQLite storage profile; see the PDS guide if you need the fjall one.

Everything with CLI supportListing 1
cargo build --features clap --bins

# Or install a single tool from the registry:
cargo install atproto-identity --features clap,hickory-dns

§ 02

Reference

Every binary in the workspace, with the crate it belongs to and the features it needs.

Identity & cryptography — atproto-identity
BinaryFeaturesDoes
atpdidclap, hickory-dnsIdentity, whole: resolve a handle or DID, generate and inspect keys, sign and verify, and read a did:plc audit log — atpdid plc forks reports every fork with the rotation key that won and why the others lost.
Content addressing & records — atproto-dasl, atproto-record, atproto-repo
BinaryFeaturesDoes
atpcidclapCompute the CID of a JSON value or a file. --record hashes through the data model, so a record carrying a blob or a CID link gets the CID a repository stores; --raw gives the bafkrei… a blob needs.
atproto-daslclapConvert between JSON and DAG-CBOR hex, both directions.
atptidclapGenerate TIDs; -n for a batch.
atproto-repo-carclapInspect a CAR v1 archive — roots, blocks, sizes.
atproto-repo-mstclapWalk the Merkle Search Tree inside an archive.
Attestation, lexicons & rich text
BinaryFeaturesDoes
atproto-attestation-signclap, tokioProduce an inline or remote attestation over a record.
atproto-attestation-verifyclap, tokioVerify an attestation, including the repository binding.
atproto-lexicon-resolveclap, hickory-dnsResolve an NSID through DNS and XRPC to its schema.
atproto-extras-parse-facetsclap, cli, hickory-dnsParse mentions, URLs and hashtags out of text into facets.
Clients, auth & services
BinaryFeaturesDoes
atpxrpcclapThe XRPC client: login stores a session, any method runs against it, --bytes streams a file for uploadBlob, and dpop makes a one-off call with an OAuth access token and a DPoP key. Also a library — atpmcp shares its account store.
atproto-oauth-service-tokenclapMint and inspect OAuth service tokens.
atproto-oauth-toolclapDrive a login flow end to end from the terminal.
Events, server & tooling
BinaryFeaturesDoes
atproto-jetstream-consumerclapStream Jetstream events with filtering and optional compression.
atproto-tap-clientclapStream verified TAP events as JSON, manage tracked repositories, and bulk-add a DID’s social graph.
pdsclap + profileThe Personal Data Server. See the operator guide.
atproto-pds-adminclap + profileInvite codes, account inspection, takedowns.
atpmcp—MCP server over stdio, MCP revision 2026-07-28. Twelve tools across CIDs, identity, records, lexicons, XRPC, TIDs, facets and blobs; blobs also readable as resources.

§ 03

Worked invocations

Copied from the workspace README, which is the version that gets exercised.

IdentityListing 2
cargo run --features clap,hickory-dns \
  --bin atpdid -- resolve alice.bsky.social

atpdid key generate p256
atpdid key inspect did:key:... --jwk
atpdid key sign did:key:... data.json
atpdid key verify did:key:... data.json <signature>

# Every fork in a PLC audit log, and why each loser lost.
atpdid plc verify did:plc:...
atpdid plc forks did:plc:... --verbose
Content addressingListing 3
cargo run --package atproto-dasl --features clap \
  --bin atpcid -- '{"text":"hello"}'

# JSON in, DAG-CBOR hex out — and back again.
echo '{"text":"hello","likes":1}' | atproto-dasl encode
echo 'a2656c696b6573016474657874656...' | atproto-dasl decode

# A record's own CID: hashed through the data model, so a blob's
# {"$link": ...} is a tag-42 link rather than a one-key map.
cat record.json | atpcid --record

# A blob needs the raw CID, not the DAG-CBOR one.
atpcid --raw --files avatar.png

cargo run --package atproto-record --features clap --bin atptid -- -n 5
RepositoriesListing 4
cargo run --package atproto-repo --features clap \
  --bin atproto-repo-car -- ls repo.car
cargo run --package atproto-repo --features clap \
  --bin atproto-repo-mst -- ls repo.car
Attestation and lexiconsListing 5
cargo run --package atproto-attestation --features clap,tokio \
  --bin atproto-attestation-sign -- \
  inline record.json did:key:... metadata.json

cargo run --package atproto-attestation --features clap,tokio \
  --bin atproto-attestation-verify -- signed_record.json

cargo run --features clap,hickory-dns \
  --bin atproto-lexicon-resolve -- app.bsky.feed.post
Clients and authListing 6
# One stored session; every later call runs against it.
atpxrpc login alice.bsky.social xxxx-xxxx-xxxx-xxxx

atpxrpc com.atproto.repo.listRecords \
  repo=alice.bsky.social collection=app.bsky.feed.post

# A file on stdin, for uploadBlob.
atpxrpc --bytes --content-type image/png \
  com.atproto.repo.uploadBlob < avatar.png

# A one-off call with an OAuth token and a DPoP key; nothing stored.
ATPROTO_ACCESS_TOKEN=... ATPROTO_DPOP_KEY=did:key:... \
  atpxrpc dpop com.atproto.repo.listRecords repo=alice.bsky.social

cargo run --package atproto-oauth-axum --features clap \
  --bin atproto-oauth-tool -- login did:key:... alice.bsky.social
Event streamsListing 7
cargo run --features clap --bin atproto-jetstream-consumer -- \
  jetstream1.us-east.bsky.network dictionary.zstd

cargo run --package atproto-tap --features clap \
  --bin atproto-tap-client -- --help
cargo run --package atproto-tap --features clap \
  --bin atproto-tap-client -- --help

§ 04

The MCP server

atpmcp speaks JSON-RPC 2.0 over stdio and exposes one tool, create_record_cid. It exists so an assistant can compute a real DAG-CBOR CID instead of producing something that looks like one.

Register it with an MCP clientListing 8
{
  "mcpServers": {
    "atpmcp": {
      "command": "/path/to/target/release/atpmcp"
    }
  }
}
cargo build -p atpmcp --release