← Back to Skills Marketplace
didro

Atlas Tracker

by Alexandr Petrov · GitHub ↗ · v1.0.5
cross-platform ⚠ suspicious
484
Downloads
0
Stars
0
Active Installs
6
Versions
Install in OpenClaw
/install atlas-tracker
Description
Work with Atlas Tracker (RedForester) mindmaps via MCP tools. Use when reading, creating, or updating nodes and branches in Atlas Tracker maps — including na...
README (SKILL.md)

Atlas Tracker Skill

Atlas Tracker (app.redforester.com) is a graph-based knowledge system combining mindmaps, Kanban, and structured properties. This skill covers working with it via the OpenClaw AT plugin tools.

Setup

This skill requires two components to be installed and running:

1. AT MCP Server

A local Node.js server that proxies requests to the Atlas Tracker REST API.

The AT MCP server is maintained by the Atlas Tracker / RedForester team.
Contact @gmdidro (Telegram) or visit app.redforester.com to request access.

Once you have the server files:

cd at-mcp/
yarn install
yarn build

# Run directly
node build/index.js

# Or run as a systemd user service (recommended)
cp at-mcp.service ~/.config/systemd/user/
systemctl --user daemon-reload
systemctl --user enable --now at-mcp

The server listens on http://localhost:3222 by default.

Required environment variables (set in the service file or .env):

AT_BASE_URL=https://app.redforester.com/api
AUTH_HEADER=Basic \x3Cbase64(username:md5(password))>
API_KEY=\x3Cyour-local-api-key>
PORT=3222

2. OpenClaw Plugin

Copy the plugin file to your OpenClaw extensions directory:

mkdir -p ~/.openclaw/extensions/atlas-tracker/
cp index.ts ~/.openclaw/extensions/atlas-tracker/
cp openclaw.plugin.json ~/.openclaw/extensions/atlas-tracker/

Then configure the plugin in your openclaw.json:

{
  "plugins": {
    "atlas-tracker": {
      "serverUrl": "http://localhost:3222",
      "apiKey": "\x3Cyour-local-api-key>"
    }
  }
}

OpenClaw will hot-reload the plugin automatically. Verify with:

openclaw status

You should see at_read_branch, at_create_branch, at_update_branch, at_get_node_types, at_read_attachments listed as available tools.


Core Concepts

  • Map — a mindmap, identified by mapId (full UUID)
  • Node — a single item in the map; has id, title (HTML), optional typeId, typeProperties, children[]
  • Branch — a node + all its descendants
  • Node type — a schema defining available properties (enum, text, htmltext, file, user, date, etc.)
  • Title format — always HTML: \x3Cp>My title\x3C/p>, never plain text

Tool URLs

All tools take a nodeUrl in format:

https://app.redforester.com/mindmap?mapid=\x3CUUID>&nodeid=\x3CUUID>

Both mapid and nodeid must be full UUIDs (e.g. 3d7340e8-c763-4c9e-b049-4e900b7cf565), never partial.

Workflow

Reading a branch

Always read before modifying — never assume structure:

at_read_branch(nodeUrl) → returns node tree with children, types, properties

Finding the right node

If you don't know a nodeId, search via AT REST API:

POST /api/search  body: {"query": "...", "map_ids": ["\x3CmapId>"]}
# Returns hits[].id — then at_read_branch each candidate to verify title

Creating branches

at_create_branch(parentNodeUrl, data)

data must include children: [] even for leaf nodes — required field.

Updating branches

at_update_branch(nodeUrl, delete[], update[], create[])
  • create items: {parentNodeId, data: {title, typeId?, typeProperties?, children: []}}
  • update items: {id, title?, typeProperties?, customProperties?}
  • All three arrays required (pass [] if unused)

Node Types

Call at_get_node_types(nodeUrl) once per map session — types vary per map. Common types: Идея, Задача, Заметка, Категория, Проект, Этап, Заявка, Лид.

For typed nodes, typeProperties keys must exactly match the property names from at_get_node_types.

Critical Rules

  1. Full UUIDs only — partial IDs (e.g. b319f356) will return 404
  2. children: [] required — omitting it causes validation error on create
  3. HTML titles — wrap in \x3Cp>...\x3C/p>; use \x3Cul>\x3Cli>...\x3C/li>\x3C/ul> for lists
  4. Read before write — always at_read_branch first to get current state and node IDs
  5. 403 = permission denied — you can only write nodes owned by your AT account; read access may be broader
  6. Large maps are slow — avoid full subtree reads on large maps; use search + targeted node reads instead

Common Patterns

Add children to existing node

  1. at_read_branch to get parent nodeId and confirm it exists
  2. at_update_branch with create: [{parentNodeId: "\x3Cid>", data: {..., children: []}}]

Batch create a solution tree

Use at_create_branch with nested children[] to create the full tree in one call.

Update node content

  1. at_read_branch to get current node id and properties
  2. at_update_branch with update: [{id, typeProperties: {key: "\x3Chtml_value>"}}]

Create a link node (shortcut/reference)

A link node is a reference to an existing node — it appears in the map as a shortcut to the original. Useful for showing the same node in multiple places without duplicating it.

at_create_link_node(nodeUrl, originalNodeId)
  • nodeUrl — URL of the parent where the link node should appear
  • originalNodeId — UUID of the existing node to reference

Example: place a reference to node abc-123 under parent node def-456:

at_create_link_node(
  "https://app.redforester.com/mindmap?mapid=\x3CmapId>&nodeid=def-456",
  "abc-123"
)

Upload a file to a node

Attach any file (PDF, Excel, Word, image) to an AT node:

at_upload_file(nodeUrl, filePath)
  • filePath — absolute local path to the file
  • Uploads via PUT /api/files, then attaches as a type_id=10 property
  • Adds to existing files — does not overwrite

Work with comments

at_get_comments(nodeUrl)           → list all comments (with thread structure)
at_add_comment(nodeUrl, text, replyToCommentId?)  → add comment or reply to thread
at_update_comment(nodeUrl, commentId, text)       → edit comment text
at_delete_comment(nodeUrl, commentId)             → delete comment

Reference Files

  • api-patterns.md — REST API search, auth, node fetch patterns (read when you need to search nodes or call AT API directly)
  • node-types-guide.md — property type reference (htmltext, enum, file, user, date, etc.) and how to set them (read when creating/updating typed nodes)
Usage Guidance
This skill appears to do what it says (operate on Atlas Tracker maps), but there are several red flags you should address before installing or running anything: - Metadata mismatch: The registry lists no required env vars or install steps, yet SKILL.md requires you to run a local MCP server and set AT_BASE_URL, AUTH_HEADER, API_KEY, PORT. Ask the publisher to correct the registry metadata or include clear provenance for those components. - Unbundled code: The skill tells you to copy index.ts and openclaw.plugin.json into ~/.openclaw/extensions, but those files are not included. Do NOT copy or run plugin code from unknown sources. Obtain the MCP server and plugin only from an official RedForester/OpenClaw repository or the maintainer and review their code first. - Credential handling: AUTH_HEADER requires base64(username:md5(password)). Storing such derived credentials in systemd service files or .env files can expose them (service files and env files may be readable by other local processes or backups). Use least-privilege credentials (a dedicated API key for the local proxy), avoid reusing your Atlas Tracker password, and restrict file permissions to the minimum required. - Network controls: The MCP server should be bound to localhost only and firewall rules applied so it cannot be reached remotely. Verify the MCP server does not accept external connections by default. - Review code: Before enabling the plugin or MCP service, inspect their source for data exfiltration (HTTP requests to unknown hosts, logging of credentials, telemetry). If you cannot review the code, do not install it. - Ask for clarification: Request that the skill package include or reference exact sources (GitHub repo and release tags) for the MCP server and plugin and update registry fields to list required env vars and files. Given these issues (inconsistencies in declared requirements, required persistent local components from external sources, and handling of credentials), proceed only after verifying sources and reviewing the code. If you want, provide the MCP server and plugin repository links and I can re-evaluate the supply-chain and code-level risks.
Capability Analysis
Type: OpenClaw Skill Name: atlas-tracker Version: 1.0.5 The skill is classified as suspicious due to several high-risk capabilities that, while potentially legitimate for its stated purpose, create a significant attack surface for prompt injection and potential abuse. Specifically, the `at_upload_file` tool in `SKILL.md` allows uploading arbitrary local files by absolute path. Furthermore, `SKILL.md` and `references/api-patterns.md` instruct the AI agent to make direct HTTP requests, including constructing authentication headers and providing `curl` examples, which implies broad network access and potential for shell command execution or injection if agent input is not properly sanitized. There is no explicit evidence of malicious intent within the skill bundle itself, but these capabilities pose a substantial risk.
Capability Assessment
Purpose & Capability
The skill is for manipulating Atlas Tracker maps and the SKILL.md's workflows (read/create/update nodes, upload files, comments, typed nodes) match that purpose. However, the registry metadata claims 'no required env vars' and 'no install', while the SKILL.md instructs installing a local MCP proxy and setting several env vars (AT_BASE_URL, AUTH_HEADER, API_KEY, PORT) and copying plugin files into ~/.openclaw/extensions. That mismatch is unexpected and reduces confidence.
Instruction Scope
The instructions require you to run a local Node.js MCP server, set auth-related environment variables (including an AUTH_HEADER derived from username/md5(password)), and copy an OpenClaw plugin (index.ts/openclaw.plugin.json) into your extensions directory. The skill's text also documents direct REST usage patterns that show how to construct Basic auth headers. These steps involve handling credentials and installing code not included with the skill; the SKILL.md reads and expects secrets and files that the package metadata did not declare. Reading/writing local service files and placing plugins into the agent's extension directory are beyond a simple instruction-only mapping skill and create supply-chain and credential-handling risk.
Install Mechanism
There is no install spec and no code files in the package; the skill is instruction-only. That reduces immediate supply-chain risk from the registry package itself. The instructions do tell the user to run and install external code (at-mcp server and an OpenClaw plugin) from outside sources, which is a user action rather than an automated install by the skill package.
Credentials
Although the skill itself declares no required env vars, the SKILL.md explicitly requires AT_BASE_URL, AUTH_HEADER, API_KEY, and PORT for the MCP server. Those credentials are plausibly needed to proxy to app.redforester.com, but the registry metadata omission is inconsistent and could hide credential requirements. AUTH_HEADER uses an MD5(password) scheme (documented in references), which is weak/odd and may cause accidental exposure of credentials if stored in systemd service files or .env without care.
Persistence & Privilege
The runtime instructions tell the user to run a long-lived local service (systemd user service) and to copy a plugin into ~/.openclaw/extensions so OpenClaw will load it persistently. While the skill metadata does not set always:true, these steps create persistent code and agent-scope plugins on the user's machine. Because the required plugin and MCP server code are not included in the packaged skill, installing them from external sources increases the attack surface and persistence risk.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install atlas-tracker
  3. After installation, invoke the skill by name or use /atlas-tracker
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.5
Sync SKILL.md: document at_upload_file + 4 comment tools (at_get_comments, at_add_comment, at_update_comment, at_delete_comment)
v1.0.4
Added comments support (at_get_comments, at_add_comment, at_update_comment, at_delete_comment) and file upload to nodes (at_upload_file)
v1.0.3
Added at_create_link_node tool: create link/shortcut nodes in AT maps
v1.0.2
Added Setup section: AT MCP server + OpenClaw plugin installation instructions
v1.0.1
Added Setup section: AT MCP server + OpenClaw plugin installation instructions
v1.0.0
atlas-tracker 1.0.0 - Initial release. - Supports reading, creating, and updating nodes and branches in Atlas Tracker mindmaps via MCP tools. - Provides guidance for navigating map structure, working with node types, and managing node properties. - Details on required tools, API usage, and critical validation rules included. - Reference materials available for API patterns and node property types.
Metadata
Slug atlas-tracker
Version 1.0.5
License
All-time Installs 0
Active Installs 0
Total Versions 6
Frequently Asked Questions

What is Atlas Tracker?

Work with Atlas Tracker (RedForester) mindmaps via MCP tools. Use when reading, creating, or updating nodes and branches in Atlas Tracker maps — including na... It is an AI Agent Skill for Claude Code / OpenClaw, with 484 downloads so far.

How do I install Atlas Tracker?

Run "/install atlas-tracker" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Atlas Tracker free?

Yes, Atlas Tracker is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Atlas Tracker support?

Atlas Tracker is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Atlas Tracker?

It is built and maintained by Alexandr Petrov (@didro); the current version is v1.0.5.

💬 Comments