Nostr Signer for ChatGPT and Codex

A local-first, open-source signer bridge that lets ChatGPT Work or Codex request Nostr signatures from Alby, nos2x, another NIP-07 browser extension, or an advanced NIP-46 remote signer. The signer keeps the private key. This project never needs, accepts, stores, logs, or transmits an nsec.

Use the local installation for the strongest security. It keeps the approval page and session coordinator on your computer. The hosted bridge is a convenience beta: event contents, public keys, signatures, ciphertext, and relay responses transit infrastructure operated by Frontier Crown on Railway. Hosted NIP-44 encryption and decryption are disabled because plaintext could otherwise transit that infrastructure.

Release status: v0.4.0 local public beta plus a live accountless hosted alpha. Live Chrome-family NIP-07 public-key access and signing succeeded on 2026-09-10. A user-approved announcement was accepted and independently read back with a valid signature from nos.lol, nostr.mom, and relay.primal.net. The hosted MCP endpoint at https://signer.frontiercrown.com/mcp completed external initialization and two-session pairing-page isolation tests. Its reduced hosted surface exposes 17 tools and omits NIP-44 encrypt/decrypt. It is active in the official MCP Registry but has not been approved by the OpenAI directory.

Will it work for everyone?

Not universally. The current release is for desktop users who can run Node.js 22+, connect a local stdio MCP server, and open the approval page in a Chrome- or Firefox-family profile with a compatible NIP-07 extension. It is not a mobile signer or unattended signing daemon. Prefer a signer that displays the complete event—including kind, content, tags, and timestamp—before every approval.

The free local plugin is the primary, recommended public release because each user keeps the key and runs the bridge. It needs no OAuth or separate account: the browser extension supplies the Nostr public key and approves each signature. The hosted prototype also has no OAuth or user accounts: it binds each AI MCP session to an extension-enabled browser with a short-lived, high-entropy capability URL. It still needs per-session isolation, abuse controls, privacy/retention operations, and an independent security review. See LAUNCH_READINESS.md, COMPATIBILITY.md, and HOSTED_SERVICE.md.

Install in Codex

Clone the public source, verify the release tag, build it locally, and register the bundled MCP server. Then start a new Codex task so its tools are loaded:

git clone --branch v0.4.0 https://github.com/hudhaifahz/nostr-signer-chatgpt.git
cd nostr-signer-chatgpt
npm ci
npm run check
codex mcp add nostr-signer -- node "$PWD/mcp/server.mjs"

The repository includes portable plugin manifests, but a one-command Grynvault marketplace wrapper is not published yet. Inspect the source and release tag before installing; the local signer bridge runs with the permissions of the desktop user who starts it.

Download the prebuilt local bundle

The release page includes a prebuilt archive and SHA-256 checksum. It contains the standalone MCP bundle, plugin manifests, signer skill, license notices, source, tests, and documentation. It does not contain a private key, signer session, or browser data.

Build hashes and the live deployment's claimed source revision are documented in PROVENANCE.md and published at https://signer.frontiercrown.com/provenance. Tagged archives receive GitHub build provenance attestations.

curl -LO https://github.com/hudhaifahz/nostr-signer-chatgpt/releases/download/v0.4.0/nostr-signer-chatgpt-0.4.0.tgz
curl -LO https://github.com/hudhaifahz/nostr-signer-chatgpt/releases/download/v0.4.0/nostr-signer-chatgpt-0.4.0.tgz.sha256
shasum -a 256 -c nostr-signer-chatgpt-0.4.0.tgz.sha256
mkdir nostr-signer-chatgpt
tar -xzf nostr-signer-chatgpt-0.4.0.tgz -C nostr-signer-chatgpt --strip-components=1
codex mcp add nostr-signer -- node "$PWD/nostr-signer-chatgpt/mcp/server.mjs"

Expected SHA-256 for the v0.4.0 bundle: 75d2c2cc7070ce0a15dbc122c479c312919279ff4160ed9e7e1993c335ce95a5.

The ordinary-user journey

1. Install and start the plugin locally.
2. Open the local setup page at http://127.0.0.1:34846/ in the Chrome or Firefox profile where Alby, nos2x, or another NIP-07 signer is installed.
3. Click Connect browser extension once and approve public-key access in the extension. Keep this page open.
4. Ask ChatGPT or Codex to prepare a Nostr note.
5. Review the exact note. Tell ChatGPT or Codex to request the signature.
6. The local page shows the exact pending operation. Click Continue in extension, then approve in the extension if it asks.
7. Separately tell ChatGPT or Codex to publish. A post is reported live only when at least one relay acknowledges it.

To use the same signer inside a NIP-46-capable app such as Noornote or YakiHonne, connect the browser extension first, click Create app sign-in link, copy the private bunker:// link, and paste it into the app's Remote signer or Bunker login. Return to the local page to approve the exact client public key and every subsequent signing, encryption, or decryption request. The link expires, is valid for one approved client, and must be treated like a temporary password.

For Grynvault in the Codex in-app browser, open https://frontiercrown.com/portal, click Sign in with Codex signer, and ask Codex to approve the exact short code using this plugin. The portal tab keeps a separate high-entropy secret; the short code only locates the pending request. The signed authorization returns that public key's read-only account dashboard to the originating tab and does not publish an event, create an invoice, change settlement, or grant wallet custody.

Never paste an nsec, raw private key, seed phrase, or backup into ChatGPT, Codex, the setup page, or a tool call. If an nsec was exposed, rotate it in a trusted signer outside this project.

Architecture

flowchart LR
  U[User] --> C[ChatGPT Work or Codex]
  U --> E[Alby, nos2x, or NIP-07 extension]
  U --> S[Advanced NIP-46 signer]
  U --> A[Noornote, YakiHonne,
  or another NIP-46 app]
  C -->|focused MCP tools| P[Local plugin process]
  B[Local approval page\n127.0.0.1 only] <--> P
  B -->|window.nostr request| E
  E -->|signed or encrypted result| B
  P -->|NIP-46 encrypted requests| R[(Configured Nostr relays)]
  A -->|NIP-46 encrypted requests| R
  R -->|approval-gated responses| P
  R -->|NIP-46 events| S
  S -->|approve or reject| R
  P -->|verified signed event\nafter separate publish intent| R

  K[nsec] -. remains inside signer .-> E
  K -. remains inside signer .-> S

The code separates the signer interface, session/intent state, relay gateway, MCP adapter, and local UI. A future MCP Apps component, WebMCP site tool, hardware signer, or different transport can reuse the service layer without changing event-validation policy.

What is implemented

• Primary NIP-07 bridge for Alby, nos2x, and compatible extensions: one local connection, one queued approval at a time, random request IDs, stale-response rejection, and no private-key access.
• Advanced bunker:// and client-generated nostrconnect:// flows using nostr-tools NIP-46 support.
• Experimental remote-signer mode for third-party NIP-46 clients. It creates a one-client, short-lived bunker:// link, accepts both NIP-44 and legacy NIP-04 encrypted RPC transport, and requires local approval for connect, event signing, NIP-04, and NIP-44 operations.
• get_public_key, exact generic-event and kind:1 preparation, bound sign_event, nip44_encrypt, nip44_decrypt, separately confirmed publish_event, and bounded relay reads for kinds 0 and 1.
• Exact unsigned-event validation, signature/hash verification, signer-pubkey binding, one-use signing intents, timeouts, session expiry, and stale-pairing rejection.
• Per-relay publication acknowledgements. No success claim when every relay rejects or times out.
• In-memory-only signer sessions. Restarting or disconnecting forgets pairing material and prepared events.
• A localhost-only setup page with a per-process anti-CSRF token, request size limit, no external scripts, and no persistence.
• Redacted structured logs and hard rejection of nsec-like input.
• Signed Grynvault account-dashboard access plus separately prepared/confirmed supporter and 2,000-sat name@frontiercrown.com NIP-05 invoice requests. An invoice response is always reported as pending, never as payment or settlement.
• Short-lived Grynvault in-app browser handoff approval bound to the exact HTTPS URL, challenge, code, and payload hash. Only the browser holding the separate secret can claim its read-only dashboard.
• Portable Agent Plugins manifests plus the scaffolded Codex compatibility manifest.
• A deterministic safe simulated signer/relay path for CI and onboarding.

Local setup

Requirements: Node.js 22 or later and npm. Use a test Nostr identity for the public beta.

npm ci
cp .env.example .env
npm run build
npm start

Set NOSTR_RELAYS to comma-separated wss:// relay URLs before live pairing or publication. The example file contains starting values, not an availability guarantee. ws:// is rejected except for localhost/loopback test relays.

The setup page binds to and accepts only 127.0.0.1. Open it in the browser profile containing your NIP-07 extension—not the Codex in-app browser unless that browser actually has such an extension. Connect once and keep the tab open while signing. The page queues the exact request and requires a browser-side click before calling window.nostr. That interaction gate is not proof of human presence when the host also has browser automation, so the extension's own approval policy remains the final protection.