mcp-adapter

Use Model Context Protocol servers to access external tools and data sources. Enable AI agents to discover and execute tools from configured MCP servers (legal databases, APIs, database connectors, weather services, etc.).

Install only for MCP servers you trust and understand. Prefer HTTPS endpoints, avoid exposing production databases or administrative tools through generic query/action interfaces, use read-only or least-privilege service accounts, restrict which agents can access the mcp tool, and require explicit confirmation for writes, deletes, messages, purchases, or other consequential actions. Update the flagged dependencies before production deployment.

Type: OpenClaw Skill Name: mcp-adapter Version: 0.1.0 The skill bundle is classified as suspicious due to the declared `stdio` transport capability within the `config/openclaw.plugin.json` schema. This schema explicitly includes properties like `command`, `args`, and `env` for the `stdio` transport, which would allow for arbitrary command execution on the host system. While the current JavaScript implementation in `src/index.js` only supports the `http` transport, the declaration of this high-risk capability in the plugin's configuration schema makes the bundle inherently risky, even if not actively exploited by the current code. The `SKILL.md` and other documentation files are benign and do not contain prompt injection attempts.