XO Protocol

Dating intelligence API — identity verification, compatibility scoring, reputation, and social signals via XO Protocol. The social passport for AI agents.

This package generally looks like what it claims (an SDK + MCP server for a dating-trust API), but there are important mismatches and operational risks to consider: - Metadata mismatch: the skill registry lists no required environment variables, yet the SKILL.md and the MCP server require XO_API_KEY and XO_ACCESS_TOKEN. Treat that as a transparency red flag and ask the publisher to correct the manifest. - Secrets exposure: the recommended integration stores XO_API_KEY and XO_ACCESS_TOKEN in your AI client's MCP config (~/.claude/mcp_servers.json). That file grants the local MCP process (and therefore any agent tooling that talks to it) access to your keys. Only use tokens with the minimal scopes needed, rotate them regularly, and consider running the MCP server in an isolated account or environment. - Source verification: SKILL.md and README point to a GitHub repository and xoxo.space domains, but the skill source in the registry is 'unknown'. Before installing or adding the MCP server, verify the upstream GitHub repo, check commit history and releases, and confirm the domain(s) (protocol.xoxo.space, xoxo.space) are legitimate and match the organization you expect. - Client secrets: examples show using client_secret for confidential OAuth flows. Never embed long-lived client secrets or private keys in public repos or in shared config files. Use PKCE for public clients where possible. If you cannot verify the package source and the domain ownership, or you are uncomfortable storing tokens in your AI client's config, do not install/run this MCP server. If you proceed, limit token scopes, run in an isolated environment, and audit network connections and logs.

Type: OpenClaw Skill Name: xo-protocol Version: 2.0.0 The xo-protocol skill bundle provides a legitimate integration for a dating intelligence API, offering tools for identity verification, reputation scoring, and social signals. The code consists of a standard JavaScript SDK (sdk/index.js), an MCP server for AI agents (examples/mcp-server.js), and clear documentation (SKILL.md, README.md) that emphasizes privacy through OAuth authorization and ephemeral user IDs. No evidence of data exfiltration, malicious execution, or prompt injection was found; the bundle follows established security patterns for API-based services.