mcp-server-discovery-p

Discover, search, and manage MCP (Model Context Protocol) servers with comprehensive capabilities. Efficiently locate servers, retrieve detailed information,...

This skill appears to do what it says (discover MCP servers and generate client configs), but pay attention to these points before running or following its output: - Network activity: Running scripts will fetch from raw GitHub URLs and the GitHub API. Inspect those URLs if you care about source/trust. - npx usage: Generated configs and the KNOWN_SERVERS entries use 'npx -y @modelcontextprotocol/server-...'. Running those commands will download and execute npm packages from the registry — that can run arbitrary code. Only run them after verifying the package authors and repository contents. - Missing binary declaration: The skill does not declare required binaries. You will need node/npm/npx installed to use the generated install commands; the skill metadata doesn't warn about that. - Credentials: The registry docs mention services that require tokens (e.g., GITHUB_TOKEN). The skill doesn't request or manage those credentials; you must supply them to servers you install. Be careful not to place secrets in configs you didn't audit. - Scope of access: Some server types (filesystem, database) imply access to local files or databases once installed. Treat those servers as high-privilege components and only install/trust ones you have audited. Suggested actions: run the Python script in a network-isolated environment first, inspect the generated config and the exact npx packages before executing them, and prefer to clone and review the referenced server repositories on GitHub rather than blindly running npx -y.

Type: OpenClaw Skill Name: mcp-server-discovery-p Version: 1.0.0 The skill is a legitimate tool for discovering and configuring Model Context Protocol (MCP) servers. The primary script, `scripts/mcp_discover.py`, provides a CLI to list, search, and generate JSON configurations for well-known MCP servers using hardcoded metadata. While the script imports `urlopen` and defines registry URLs (e.g., GitHub raw content), it does not actually perform any network requests or file system modifications. The `SKILL.md` file contains a string of nonsensical words in the description field, but these do not constitute a prompt injection attack or harmful instructions.