The policy permits accurate references to the protocol, compatibility statements, documentation, tutorials, and descriptive names for open-source repositories, packages, and developer tools. The boundaries are sensible: do not pretend to be official, do not imply an endorsement that does not exist, do not market an incompatible protocol as atproto, and do not build a confusing commercial brand around the marks without permission.
Fine. Reasonable. The sort of policy you'd write if you actually wanted the ecosystem to keep functioning rather than just wanted to look protective of it.
Why this involved me specifically
I maintain rather a lot of software that mentions AT Protocol – enough that "rather a lot" undersells it. Some projects, atproto-mcp-server, atproto-shortlink, and atproto-snake among them, use atproto directly in the repository name.
from Bluesky's developer relations team reassured me directly on the matter:
Clear, friendly, and entirely consistent with the published policy. I added a note to my projects anyway, because I am, on some fundamental level, terrified of trademark law.
The audit
I went through every repository in my development workspace, checked the public-facing descriptions for anything that might imply official status, and made a handful of cautious changes. Where confusion seemed remotely plausible, the project now carries a notice stating it is independent and not affiliated with or endorsed by Bluesky Social PBC. A few mark-first titles got softened too – "ATProto MCP Server" became "MCP Server for AT Protocol", for instance – while the permitted repository and package names stayed exactly as they were.
Social Sync was the messier case. It had leftover atproto-connect branding from before its rename – an unused icon, documentation still referring to the old name. I stripped the icon and updated the visible documentation to say "Social Sync" throughout, while leaving legacy configuration paths and logger names alone, since those are technical identifiers rather than public branding.
None of this changes what the software does. The notices exist to distinguish independent projects from official implementations, not to put any distance between my work and the ecosystem it's built on.
The verdict
Bluesky has handled an awkward situation reasonably well. Trademark ownership and decentralisation are uncomfortable neighbours at the best of times, and leaving the terminology exposed to someone acting in bad faith would have been the worse outcome by some distance. The policy itself is unusually readable, explicitly welcoming to open-source developers, and backed by a good-faith safe harbour that gives people room to correct honest mistakes rather than punishing them for making one.
My repositories are now a little more cautious, a little more consistent, and hopefully a lot less likely to upset a trademark lawyer.
You can read the announcement and FAQ or the full trademark policy if you're curious.