Back to Browse

Besidka MCP Server

Developer ToolsLow Risk8.2MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Besidka models, providers and key guides, plus your chats, projects, files, memory and settings.

About

Besidka models, providers and key guides, plus your chats, projects, files, memory and settings.

Remote endpoints: streamable-http: https://besidka.com/mcp

Security Report

8.2
Low Risk8.2Low Risk

Besidka is a BYOK AI chat app whose MCP server (in the visible code) exposes user-scoped project, knowledge, and chat tools gated by ownership checks (resolveMcpOwnedProject filters by userId) and input validation. The visible code shows no hardcoded secrets, shell execution, or exfiltration to external hosts, though the code is truncated and the auth layer and remaining tools could not be fully reviewed. Main considerations are that the server touches user memory and uploaded knowledge content, and it includes a prompt-injection flagging mechanism that is good but relies on heuristics.

14 files analyzed · 4 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

database

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

Besidka: open-source BYOK AI chat

Besidka is an open-source BYOK (bring your own key) AI chat app. Pay the AI provider only for what you use, see the price of every message, and use all the models in one chat. No subscription, no ads, no markup. Self-hostable.

Who it's for

Besidka suits people who use AI every day for search, translation, PDFs, images or code, do not want another subscription, and are fine creating an API key in a provider's developer console. It is probably not for you if you already pay for ChatGPT Plus or Pro, Claude Pro or Google AI Pro and rarely hit their limits, since those apps do more than a chat window, or if you would rather not deal with API keys, or with prepaying credit at a provider. For scale, the maintainer's own non-work use costs between $1 and $5 a month. That is one person's usage, not a promise.

Get started

  1. Sign up at besidka.com with email and password, Google or GitHub.
  2. Add an API key at besidka.com/profile/keys. The easiest start is a free Gemini key from Google AI Studio, which needs no card. On Google's free tier your prompts may be used to improve its products, so keep sensitive material out.
  3. Start a new chat at besidka.com/chats/new and pick a model.

New to API keys? Read the BYOK guide.

Project

Project board is available here.

Contributing

Issues are welcome. Code contributions are by invitation only; see CONTRIBUTING.md.

Tech stack

Features

  • PINK: Dark and light themes, both unapologetically pink
  • BYOK (Bring Your Own API Key): Use your API keys from any supported LLM provider (Anthropic, Google, OpenAI, xAI, DeepSeek, Moonshot AI, Qwen), route through gateways (Vercel, Cloudflare, OpenRouter), and search with Brave or Exa. Only pay for what you use. No subscriptions, no markup
  • Multiple AI Models: Switch between the latest models from all providers in one place
  • Web Search: Ground AI answers with real-time web context; use native provider search, Brave, or Exa
  • Reasoning Mode: Step-by-step thinking for complex questions
  • AI Image Generation: Generate one image per request with supported OpenAI and Google models, then preview or download it from your private Generated by AI file library; generated images count toward your storage quota
  • Deep Research: Dedicated research-agent models browse the web and write cited reports; runs asynchronously with a push notification when it's ready, billed per-task on your own API key
  • File Attachments & File Manager: Send images and PDFs, reuse files across chats
  • Chat Branching: Fork a conversation mid-thread to explore a different direction
  • Shareable Chats: Share a chat via a public, unguessable link that anyone can view without an account and branch into their own chats; control link expiry, search-engine indexing, and what's visible per share
  • Projects: Organize chats with shared instructions and memory
  • Resumable Streams: Refresh the page and pick up right where you left off
  • Chat History: Search, pin and rename past conversations
  • Syntax Highlighting: Clean, readable code blocks out of the box
  • Mermaid Diagrams: Flowcharts, sequence, class, state, ER, Gantt, pie and more render as themed SVG diagrams right in the chat, with a one-click toggle back to the source
  • No Install Required: Works in any browser, sign in and go
  • Better Auth: Email/password, Google or GitHub sign-in

OAuth troubleshooting

Social OAuth in in-app browsers

  • Symptom: Google or GitHub social sign-in is unavailable, or Google shows 403: disallowed_useragent.
  • Cause: The app is opened in an embedded/in-app browser (for example Threads, Instagram, Facebook, TikTok), and OAuth providers may block these user agents.
  • Resolution: Open the same page in your system browser (Chrome/Safari/Firefox) and try again with social sign-in.
  • Config sanity check: Ensure your Google OAuth app has this redirect URI: https://<your-domain>/api/auth/callback/google

Local installation

Pay your attention that the project is designed to run on Cloudflare Workers. It requires additional steps to run it via Cloudflare Workers preview or deploy to the production environment.

The steps below are for local development only for the quick start and check.

Prerequisites

Steps

Clone the repository.

git clone git@github.com:besidka/besidka.git

Go to the project directory. Install the dependencies.

cd besidka
pnpm install

Copy ENV related files.

cp .dev.vars.example .dev.vars

Generate environment types for the project.

pnpm run cf-typegen

Prepare drizzle migrations.

# Expected output is .drizzle/migrations/*.sql
pnpm run db:generate

Apply the migrations to the D1 database.

# Expected output is .wrangler/state/v3/d1/*.sqlite
pnpx wrangler d1 migrations apply DB

Prepare and apply the cookie-consent database migrations. This is a separate D1 database (CONSENT_DB) used to store consent receipts. See docs/cookie-consent.md for details.

# Expected output is .drizzle/migrations-consent/*.sql
pnpm run db:consents:generate
pnpm run db:consents:migrate

Start the development server.

pnpm run dev

or to start Cloudflare Workers preview server

pnpm run preview
  1. Open http://localhost:3000 in your browser.
  2. Sign up http://localhost:3000/signup. Please use the Email + Password flow because you don't have prepared API keys for Google and GitHub OAuth yet. In development mode you don't need to wait for email confirmation. You have to be automatically redirected to the home page as a customer already.
  3. Put your own API keys here: http://localhost:3000/profile/keys
  4. You are welcome to start a new chat: http://localhost:3000/chats/new

Content (Nuxt Content + Studio)

The landing page is powered by Nuxt Content v3 with a dedicated Cloudflare D1 database (CONTENT_DB) that is fully isolated from the main application database (DB). Nuxt Studio provides an optional in-app visual editor that commits changes directly to the GitHub repository.

Creating the D1 databases

Run these commands once after cloning. They print a database_id UUID — copy it into the matching "TO_BE_CREATED" placeholder in wrangler.jsonc.

# Preview environment (default env in wrangler.jsonc)
pnpm exec wrangler d1 create besidka-content

# Production environment
pnpm exec wrangler d1 create besidka-content --env production

Replace both "TO_BE_CREATED" values in wrangler.jsonc under the CONTENT_DB binding with the returned UUIDs.

Nuxt Content manages its own schema inside CONTENT_DB at runtime — no Drizzle migrations are needed for this database.

Studio OAuth setup

Studio is optional. The landing page renders and all content is editable via Git without it. Studio adds a /_studio route to the deployed site so editors can make changes through a browser UI.

  1. Go to GitHub → Settings → Developer settings → OAuth Apps → New OAuth App.
  2. Set Homepage URL to https://besidka.com (the canonical apex host — a Cloudflare redirect sends www.besidka.com to besidka.com).
  3. Set Authorization callback URL to https://besidka.com/_studio (production) or http://localhost:3000/_studio (development).
  4. Copy the Client ID and generate a Client Secret.
  5. Add them to .dev.vars for local development:
    STUDIO_GITHUB_CLIENT_ID=<your_client_id>
    STUDIO_GITHUB_CLIENT_SECRET=<your_client_secret>
    
  6. Add them as Wrangler secrets for the deployed Worker:
    pnpm exec wrangler secret put STUDIO_GITHUB_CLIENT_ID
    pnpm exec wrangler secret put STUDIO_GITHUB_CLIENT_SECRET
    # For production:
    pnpm exec wrangler secret put STUDIO_GITHUB_CLIENT_ID --env production
    pnpm exec wrangler secret put STUDIO_GITHUB_CLIENT_SECRET --env production
    

Landing page without Studio

The landing page works without Studio configured. Content lives in content/landing/ as Markdown files and is committed to the repository like any other source file. Studio is purely an authoring convenience — it does not affect how the landing page is built or served.

Security

Snyk code checking repository

  • Snyk is a tool for finding and fixing vulnerabilities in your code.
# Total issues: 0
snyk code test

Preview

Reviews

No reviews yet

Be the first to review this server!