Otto Travel Local

OpenClaw plugin for Otto Travel — search, compare, and book flights and hotels via Otto's MCP endpoint.

This plugin appears to do what it says: it connects to the configured Otto MCP endpoint, runs an OAuth device flow, stores tokens at ~/.openclaw/.otto-tokens.json (0600), and dynamically registers tools. Before installing: (1) Confirm you trust the MCP server URL (default https://api.ottotheagent.com/mcp) — changing it to an untrusted host would let the plugin contact that host and store credentials for it; (2) review the repository/source (package.json points to a GitHub repo) if you want provenance assurance; (3) be aware the plugin depends on the @modelcontextprotocol/sdk and its npm deps (normal for MCP clients); (4) the bundle includes TypeScript source (index.ts) and expects the OpenClaw runtime to load/compile TS — verify your runtime supports this. If any of these are unclear or you don't trust the server URL, do not install.

Type: OpenClaw Skill Name: otto-travel-local Version: 1.0.0 The plugin is a standard implementation of a Model Context Protocol (MCP) client for travel services (Otto Travel). It uses a legitimate OAuth 2.1 Device Authorization Grant flow for authentication and follows security best practices by storing access tokens locally with restricted file permissions (0600) in `~/.openclaw/.otto-tokens.json`. The code logic in `index.ts`, `src/auth.ts`, and `src/mcp-client.ts` is transparent, aligns with the stated purpose, and contains no evidence of data exfiltration, malicious execution, or prompt injection.