← 返回 Skills 市场
745
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install mcp-protocol
功能描述
配置和管理 MCP 服务器，实现 AI 调用外部工具如视觉理解和网络搜索的能力。
安全使用建议
This skill is inconsistent and requires caution. Before installing or running any commands: 1) Do not run curl ... | sh from unknown domains — it can install arbitrary code. 2) Verify the actual tool names and sources (what is 'mcporter', who publishes 'clawhub', and is 'astral.sh' trustworthy). 3) Treat MINIMAX_API_KEY as sensitive: don't paste production keys into an unverified config file; use least-privilege/test credentials or secrets manager. 4) Inspect the MCP packages (minimax-coding-plan-mcp, uvx, etc.) on their official registries/repos and review their code. 5) Prefer running these steps in an isolated environment (VM/container) or decline until the author/source and package provenance are confirmed. 6) Ask the skill author for a homepage/source repo and a clear explanation for why 'clawhub' is installed but 'mcporter' is used. If you cannot verify origins and contents, avoid running the install commands or providing API keys.
功能分析
Type: OpenClaw Skill
Name: mcp-protocol
Version: 1.0.0
The skill is classified as suspicious primarily due to the use of `curl -LsSf https://astral.sh/uv/install.sh | sh` in `SKILL.md`. While `uv` is a legitimate tool, this `curl | sh` pattern is a high-risk practice that executes arbitrary code from a remote source, presenting a significant vulnerability for remote code execution if the source were compromised. Additionally, the skill's configuration involves handling API keys and mentions other MCP packages like `filesystem-mcp` and `github-mcp`, which imply broad system access capabilities that, if misused or exploited via prompt injection against the AI agent, could lead to unauthorized operations.
能力评估
Purpose & Capability
The skill claims to configure/manage MCP servers (plausible), but the instructions require installing 'clawhub' (via npm) while the runtime uses 'mcporter' (npx mcporter) — these names don't match. The SKILL metadata declares no required env vars or config paths, yet the sample config expects MINIMAX_API_KEY, MINIMAX_MCP_BASE_PATH, and MINIMAX_API_HOST. The package/host names and the _meta.json ownerId differ from the registry metadata, and there's no homepage or source URL to verify origins.
Instruction Scope
Runtime instructions tell the user/agent to create ~/.config/mcporter and store API keys in a JSON file, then run npx mcporter commands that will execute external MCP packages. They also instruct running a remote installer (curl | sh) to install 'uvx'. The instructions reference environment variables and a config path not declared in the skill metadata and give the agent broad discretion to install and execute external binaries, which could perform arbitrary filesystem or network actions.
Install Mechanism
There is no formal install spec, but the SKILL.md directs installing software: 'npm install -g clawhub' and 'curl -LsSf https://astral.sh/uv/install.sh | sh'. The latter is a remote install script (curl|sh) from an external domain (astral.sh) — a high-risk pattern because it downloads and executes code from an unverified source. The install target ('clawhub') doesn't obviously match the runtime tool ('mcporter'/'mcporter.json'), increasing incoherence.
Credentials
Metadata lists no required environment variables, but the sample configuration embeds MINIMAX_API_KEY, MINIMAX_MCP_BASE_PATH, and MINIMAX_API_HOST. That means sensitive credentials are expected to be stored in the user's config directory despite not being declared. The skill also suggests MCP packages like filesystem-mcp and github-mcp, which, if used, would legitimately require broader permissions — this is not called out in the metadata.
Persistence & Privilege
The skill is instruction-only and does not set always:true or request autonomous elevation. However, following the instructions will create files in the user's home (~/.config/mcporter) and install global binaries (npm -g) or system-wide tools via a remote installer, producing persistent system changes outside the agent. The skill itself does not declare persistent privileges, but its recommended actions do create persistent artifacts.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install mcp-protocol - 安装完成后，直接呼叫该 Skill 的名称或使用
/mcp-protocol触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
MCP Skill 1.0.0 – Initial Release
- Introduces comprehensive setup and usage instructions for MCP (Model Context Protocol) server.
- Covers installation, configuration, and validation of MCP with `mcporter`.
- Provides sample config for MiniMax server, including visual understanding and web search usage.
- Lists supported MCP packages and troubleshooting tips for common issues.
元数据
常见问题
MCP协议配置 是什么？
配置和管理 MCP 服务器，实现 AI 调用外部工具如视觉理解和网络搜索的能力。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 745 次。
如何安装 MCP协议配置？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install mcp-protocol」即可一键安装，无需额外配置。
MCP协议配置 是免费的吗？
是的，MCP协议配置 完全免费（开源免费），可自由下载、安装和使用。
MCP协议配置 支持哪些平台？
MCP协议配置 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 MCP协议配置？
由 godzff（@godzff）开发并维护，当前版本 v1.0.0。
推荐 Skills