Supercraft Game Servers

Name: Supercraft Game Servers
Author: mcjkrs

功能描述

Order, configure and manage dedicated game servers (20+ games) via Supercraft REST API

使用说明 (SKILL.md)

You can manage dedicated game servers through the Supercraft Agentic API. This is a REST API — no additional binaries or MCP servers are needed, just HTTP requests with a Bearer JWT token.

API Base

https://claws.supercraft.host

Authentication

All /servers/* endpoints require a Bearer JWT token in the Authorization header.

To get a token, use the login-link flow:

POST /auth/login-link with {"email": "[email protected]"} — sends a magic link email
User clicks the link, which contains a magic token
GET /auth/claim?magic=\x3Ctoken> — poll this until it returns a JWT

# After obtaining the JWT:
curl -H "Authorization: Bearer \x3CJWT>" https://claws.supercraft.host/servers

Available Endpoints

Server Management (requires auth)

Method	Endpoint	Description
GET	`/servers`	List all user's servers with status
GET	`/servers/{id}`	Detailed server info with live status
POST	`/servers/{id}/start`	Start the server
POST	`/servers/{id}/stop`	Stop the server
POST	`/servers/{id}/restart`	Restart the server
GET	`/servers/{id}/config`	Get current server configuration
PUT	`/servers/{id}/config`	Update server configuration
GET	`/servers/{id}/config/schema`	Get config field definitions (types, ranges)
GET	`/servers/{id}/connection`	Get connection details (IP, port, password)
POST	`/servers/{id}/console`	Send RCON/console command
GET	`/servers/{id}/logs`	Get recent server log lines

Catalog (no auth needed)

Method	Endpoint	Description
GET	`/catalog/games`	List all available games
GET	`/catalog/games/{code}`	Game details with plans and pricing
GET	`/catalog/regions`	Available server regions

Purchasing (no auth needed)

Method	Endpoint	Description
POST	`/orders/purchase`	Purchase a new server plan (returns checkout URL)

Purchase & Login Flow — CRITICAL

When generating a checkout_url (via POST /orders/purchase) or login_url (via POST /auth/login-link), you MUST send the link to the user as a message BEFORE calling any tools (curl, exec, cron). If you call a tool first, the message with the link gets blocked and the user never sees it.

Correct sequence:

Reply to the user with the checkout_url or login_url
After the reply, set up a cron (every 30s) to poll GET /auth/claim?magic=...
When claim returns status: "ready", save the JWT token securely

Do NOT use while/sleep loops — use a cron job or poll on the user's next message.

Supported Games

ARK: Survival Ascended, Counter-Strike 2, Enshrouded, Factorio, HumanitZ, Hytale, Necesse, Palworld, Project Zomboid, Rust, Satisfactory, Sons of the Forest, Terraria, Unturned, V Rising, Valheim, and Vintage Story.

Example Usage

When the user asks about their game server, follow this pattern:

List servers (GET /servers) to find the right deployment
Check status (GET /servers/{id}) before taking action
Confirm destructive operations (restart, config changes) before executing

Check server status:

curl -H "Authorization: Bearer $TOKEN" https://claws.supercraft.host/servers

Start a server:

curl -X POST -H "Authorization: Bearer $TOKEN" https://claws.supercraft.host/servers/42/start

Update config:

curl -X PUT -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"max_players": 20}' \
  https://claws.supercraft.host/servers/42/config

Send console command:

curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command": "say Hello everyone!"}' \
  https://claws.supercraft.host/servers/42/console

Browse available games:

curl https://claws.supercraft.host/catalog/games

Documentation

Getting Started Guide
OpenAPI Reference
Machine-readable discovery
Per-game API guides: https://claws.supercraft.host/{game-slug}-server-api

安全使用建议

This skill appears to do what it says (manage Supercraft game servers), but pay attention before you install: 1) The instructions tell the agent to set up recurring polling (cron) and to store a JWT — ask where the token will be saved and require explicit consent before any cron or filesystem changes. 2) Confirm the API domain (claws.supercraft.host vs supercraft.host) and verify the vendor/site are legitimate. 3) Prefer short-lived tokens or explicit user-provided JWTs rather than letting the agent persist credentials. 4) If you don't want scheduled tasks or credential storage on your machine, decline installation or ask the skill author to offer a flow that requires the user to trigger the final claim step manually. 5) If possible, test in an isolated environment first and request the author to clarify how token storage and cron creation are performed.

功能分析

Type: OpenClaw Skill Name: game-servers Version: 1.1.0 The skill facilitates game server management via the Supercraft REST API (claws.supercraft.host). It is classified as suspicious because it instructs the agent to use risky capabilities, specifically 'curl' for network access and 'cron' for persistence (polling the /auth/claim endpoint), which are identified as high-risk behaviors in the analysis criteria. While these actions are plausibly aligned with the stated purpose of managing remote servers and handling magic-link authentication, the use of cron and the future-dated timestamp in _meta.json (2026) warrant caution.

能力评估

✓ Purpose & Capability

Name, description and the SKILL.md endpoints align: this is a REST API-based game server management skill. Required credentials (a Bearer JWT obtained by a magic-link flow) are consistent with the service. No unrelated binaries, env vars, or config paths are requested.

ℹ Instruction Scope

Instructions are generally scoped to calling the Supercraft REST API (listing servers, start/stop, config, logs). However, the runtime directions instruct the agent to (a) send the magic/login or checkout link to the user before invoking any tools, (b) set up a cron job to poll /auth/claim every 30s rather than using while/sleep loops, and (c) "save the JWT token securely." Those steps go beyond simple single-request interactions because they require scheduling/persistence and token storage; the SKILL.md does not specify where/how tokens should be stored or what exact mechanism should create the cron, which could cause uncertain behavior or unapproved changes to the host environment.

✓ Install Mechanism

This is an instruction-only skill with no install specification and no code files. That minimizes supply-chain risk — nothing is downloaded or written by the skill bundle itself.

✓ Credentials

No environment variables, config paths, or unrelated credentials are requested by the skill metadata. The use of a JWT to authenticate to the API is proportional to the stated purpose. Note: the API can return connection details (IP/port/password) which is expected for game servers and should be handled with care.

⚠ Persistence & Privilege

Although 'always' is false and the skill does not declare persistent privileges, the SKILL.md explicitly instructs the agent to create cron jobs to poll authentication endpoints and to 'save the JWT token securely.' That implies persistent scheduled tasks and credential storage on the host or agent state. The skill does not declare or justify this persistence or where/with what permissions such state should be stored, creating a mismatch and raising the risk of unintended persistent changes or residual credentials.

版本历史

v1.1.0

Fix auth/claim method, purchase no-auth, add purchase flow warning, cron polling, all game tags

v1.0.0

Initial release of the supercraft-game-servers skill: - Manage dedicated servers for 17+ popular games via Supercraft REST API. - Order, configure, start, stop, and restart game servers with simple HTTP requests. - Token-based authentication using a magic link login flow. - Browse game catalog, available regions, and pricing without authentication. - Includes endpoint reference and usage examples for all server management and purchasing operations.

元数据

Slug game-servers

版本 1.1.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题