← Back to Skills Marketplace

KVcore MCP CLI

Name: KVcore MCP CLI
Author: danielfoch

by danielfoch · GitHub ↗ · v0.1.0

cross-platform ⚠ suspicious

764

Downloads

Stars

Active Installs

Versions

Install in OpenClaw

/install kvcore-mcp-cli

Description

Perform KVcore CRM actions via MCP/CLI, including managing contacts, tags, notes, calls, emails, texts, campaigns, and raw API access with optional Twilio ca...

README (SKILL.md)

KVcore MCP/CLI Skill

Use this skill for KVcore CRM operations from chat interfaces.

Environment

Required:

KVCORE_API_TOKEN

Optional:

KVCORE_BASE_URL (default https://api.kvcore.com)
KVCORE_TIMEOUT_MS
TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, TWILIO_FROM_NUMBER

MCP Server

Start with:

npm run dev:kvcore-mcp

Primary tools:

kvcore_contact_search, kvcore_contact_get, kvcore_contact_create, kvcore_contact_update
kvcore_contact_tag_add, kvcore_contact_tag_remove
kvcore_note_add
kvcore_call_log, kvcore_call_schedule
kvcore_email_send, kvcore_text_send
kvcore_user_tasks, kvcore_user_calls
kvcore_campaigns_refresh
kvcore_request (raw endpoint access)
twilio_call_create (fallback outbound call)

CLI

Build:

npm run build

Examples:

node packages/kvcore-cli/dist/index.js contact search --query "john smith" --pretty
node packages/kvcore-cli/dist/index.js email:send --contact-id 123 --subject "Quick update" --body "Following up" --pretty
node packages/kvcore-cli/dist/index.js text:send --contact-id 123 --body "Can we connect today?" --pretty
node packages/kvcore-cli/dist/index.js call:schedule --json '{"contact_id":123,"user_id":456,"scheduled_at":"2026-02-15 10:00:00"}' --pretty
node packages/kvcore-cli/dist/index.js call:twilio --to "+14165550001" --twiml "\x3CResponse>\x3CSay>Hello\x3C/Say>\x3C/Response>" --pretty

Scope Notes

KVcore Public API v2 supports contacts, notes, call logging, send email/text, schedule call, user task/call listing, and campaign refresh.

For endpoints not wrapped yet, use kvcore_request or CLI raw.

Usage Guidance

This skill's instructions expect a local npm-based CLI and list required environment variables (KVCORE_API_TOKEN, optional Twilio creds), but the published bundle contains no code or install instructions and the registry metadata doesn't declare those env vars. Before installing or providing credentials, ask the publisher for the source repository or a homepage, request clear install steps (or a vetted package), and inspect the npm scripts and code you would be running. Do not provide KVCORE_API_TOKEN or Twilio credentials until you can verify the code and confirm where network requests will be sent. If you must test, run in an isolated environment (ephemeral VM/container) and limit credentials (use test accounts or tokens with minimal scope).

Capability Analysis

Type: OpenClaw Skill Name: kvcore-mcp-cli Version: 0.1.0 The skill is classified as suspicious due to several high-risk capabilities described in `SKILL.md`. It explicitly offers 'raw endpoint access' via `kvcore_request`, allowing the AI agent to make arbitrary API calls to the KVcore system. Furthermore, it allows specifying a custom `KVCORE_BASE_URL`, which could redirect sensitive API interactions to an attacker-controlled server. The `twilio_call_create` function also permits arbitrary TwiML, enabling potential social engineering or phishing calls. These features, while potentially intended for flexibility, introduce significant prompt injection vulnerabilities, allowing an attacker to coerce the AI agent into performing unauthorized data exfiltration, modifications, or other harmful actions against the KVcore API or via Twilio.

Capability Assessment

⚠ Purpose & Capability

The SKILL.md describes a CLI/‘MCP server’ and lists concrete binaries/commands (npm run dev:kvcore-mcp, node packages/kvcore-cli/dist/index.js) plus required env vars (KVCORE_API_TOKEN, optional Twilio creds). However, the registry metadata declares no required env vars and the skill bundle contains no code files. A user would reasonably expect either the CLI code or an install spec; their absence is inconsistent with the stated purpose.

⚠ Instruction Scope

Instructions tell the agent to run npm scripts and node executables under packages/..., and to use KVCORE_API_TOKEN and optional Twilio credentials. Those commands reference local project files that are not included in the skill. The instructions also permit raw endpoint access (kvcore_request) and fallback Twilio calls — behavior that will transmit data to external services. The SKILL.md asks the agent to access environment variables not declared in the registry metadata, which is a scope/information mismatch.

ℹ Install Mechanism

There is no install spec (instruction-only), which minimizes direct install risk. However, the runtime instructions require running npm build/dev commands implying a local repository or installed package; because no code or install steps are provided, an agent running those commands could either fail or execute arbitrary local npm scripts if present. The missing code/install details are a practical and transparency concern.

ℹ Credentials

Requiring KVCORE_API_TOKEN and optional Twilio credentials is proportionate to the CRM and outbound-call functionality described. That said, the registry metadata lists no required env vars while SKILL.md does — an inconsistency. Also note that Twilio auth tokens and the KVCORE API token are sensitive: if supplied they enable external API operations (sending texts/emails/placing calls).

✓ Persistence & Privilege

The skill does not request persistent installation or always:true. It is user-invocable and may be invoked autonomously by the agent (platform default), which is expected. There is no evidence the skill modifies other skills or system-wide settings.

How to Use

Make sure OpenClaw is installed (local or Docker)
Run the install command in chat: /install kvcore-mcp-cli
After installation, invoke the skill by name or use /kvcore-mcp-cli
Provide required inputs per the skill's parameter spec and get structured output

Version History

v0.1.0

Initial publish of KVcore MCP + CLI skill

Metadata

Slug kvcore-mcp-cli

Version 0.1.0

License —

All-time Installs 0

Active Installs 0

Total Versions 1

Frequently Asked Questions

What is KVcore MCP CLI?

Perform KVcore CRM actions via MCP/CLI, including managing contacts, tags, notes, calls, emails, texts, campaigns, and raw API access with optional Twilio ca... It is an AI Agent Skill for Claude Code / OpenClaw, with 764 downloads so far.

How do I install KVcore MCP CLI?

Run "/install kvcore-mcp-cli" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is KVcore MCP CLI free?

Yes, KVcore MCP CLI is completely free (open-source). You can download, install and use it at no cost.

Which platforms does KVcore MCP CLI support?

KVcore MCP CLI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created KVcore MCP CLI?

It is built and maintained by danielfoch (@danielfoch); the current version is v0.1.0.

More Skills