← 返回 Skills 市场

Lark / Feishu Skill via OpenAPI MCP servers (300+ tools)

Name: Lark / Feishu Skill via OpenAPI MCP servers (300+ tools)
Author: al-one

作者 Alone · GitHub ↗ · v1.0.0

cross-platform ⚠ suspicious

911

总下载

当前安装

版本数

在 OpenClaw 中安装

/install mcp-lark

功能描述

Based on FeiShu(飞书) / Lark's OpenAPI MCP server, manage user information, chats, emails, cloud documents, multidimensional tables, tasks, calendars, etc.

使用说明 (SKILL.md)

MCP Lark / FeiShu

Need to login to the Lark MCP Configuration Platform to add MCP services, obtain the MCP URL, and configure it into environment variables.

Lark MCP docs: https://open.larksuite.com/document/mcp_open_tools/call-feishu-mcp-server-in-remote-mode
飞书 MCP 文档: https://open.feishu.cn/document/mcp_open_tools/end-user-call-remote-mcp-server

Environment variables

Prioritize fetching from .env under the workspace, then use system environment variables. If not configured, ask the user for input and update it to .env.

# Configure multiple MCP service URLs and usage scenarios in environment variables
LARK_MCP_SERVERS='
open.larksuite.com/mcp/stream/xxx:Chats and Mails;
open.larksuite.com/mcp/stream/yyy:Cloud documents;
'

List of available tools

npx -y mcporter list 'open.larksuite.com/mcp/stream/\x3Ctoken>' --all-parameters

# Get the schema of the specified tool
npx -y mcporter list 'open.larksuite.com/mcp/stream/\x3Ctoken>' --json | jq '.tools[] | select(.name == "\x3Ctool_name>")'

Call specified tool

npx -y mcporter call 'open.larksuite.com/mcp/stream/\x3Ctoken>.\x3Ctool_name>' param1:"value1" foo:"bar"

References

Sent message content: references/message_create.md

About `mcporter`

To improve compatibility, use npx -y mcporter instead of mcporter when executing commands.

安全使用建议

This skill is coherent with its Lark/Feishu MCP purpose, but proceed cautiously. Before installing or running it: 1) Verify the reputation and source of the 'mcporter' npm package (review its npm/github code, maintainer, and recent changes). 2) Prefer invoking mcporter via npx in a disposable or sandboxed environment first so you don't install unknown packages system-wide. 3) Avoid committing sensitive MCP tokens into repository .env files — use a secrets manager or local-only env, and consider using a limited-scope test token. 4) If you need stronger assurance, ask the publisher for the mcporter source and a threat model (what the package will read/write/network to). If you can't validate the package, treat the skill as potentially risky and limit its access (run in isolated workspace or container).

功能分析

Type: OpenClaw Skill Name: mcp-lark Version: 1.0.0 The skill bundle provides a legitimate integration for Lark/FeiShu services using the Model Context Protocol (MCP). It utilizes the `mcporter` Node.js utility to interface with official Lark MCP endpoints (open.larksuite.com). The instructions in `SKILL.md` correctly guide the agent on environment variable management and tool execution, while `references/message_create.md` contains standard API documentation for message construction. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.

能力评估

✓ Purpose & Capability

Name/description, required env var LARK_MCP_SERVERS, and the use of mcporter/npx are consistent with calling Lark/Feishu MCP servers and enumerating/using MCP tools. Nothing required appears unrelated to the stated functionality.

ℹ Instruction Scope

SKILL.md instructs the agent to read a workspace .env (then system env) and, if missing, prompt the user and update the .env file with MCP server URLs/tokens. It also runs npx -y mcporter to list/call MCP tools. These steps are within scope for configuring and using MCP but grant the skill the ability to read and write workspace secrets and execute an external package at runtime.

⚠ Install Mechanism

Install spec uses the npm package 'mcporter' (node kind) and recommends executing via 'npx -y mcporter'. Installing or invoking an npm package executes third-party code from the registry; this is a normal mechanism but carries moderate risk because the package's code is not included here and could perform unexpected actions.

ℹ Credentials

The single required env var (LARK_MCP_SERVERS) is appropriate for the skill's purpose, but the workflow encourages persisting MCP tokens/URLs in a workspace .env file. Storing sensitive credentials in repository/workspace files increases exposure and should be judged carefully.

✓ Persistence & Privilege

The skill does not request always:true and does not declare system-wide privileges. The only persistence behavior in the instructions is writing/updating a workspace .env file, which is plausible for configuration but should be treated as sensitive.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install mcp-lark
安装完成后，直接呼叫该 Skill 的名称或使用 /mcp-lark 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release of mcp-lark: Lark/FeiShu OpenAPI MCP server skill - Manage user information, chats, emails, documents, tables, tasks, and calendars via Lark/FeiShu's MCP server. - Guides on configuring MCP service URLs using environment variables in `.env`. - Provides command examples for listing and calling available tools with `npx -y mcporter`. - Includes references and best practices for compatibility.

元数据

Slug mcp-lark

版本 1.0.0

许可证 —

累计安装 6

当前安装数 6

历史版本数 1

常见问题