MCP OpenClaw Extensions

io.github.romainsantoli-webPublished by GitHub account romainsantoli-webv3.3.0Updated Oct 24, 2026

138-tool MCP server for AI agent firms: security, A2A, Hebbian memory, fleet mgmt

The publisher's own server: OpenClaw Direct

VerifiedSTDIODesktop onlyProductivity & WorkflowDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local Python MCP server with 138 tools for auditing, orchestrating and exporting work around an AI agent firm's gateway, memory and delivery pipelines.

What you can do
Bridge VS Code context and sessions to a Firm gateway, and manage gateway fleets (status, add, remove, broadcast, sync, list). Run security and configuration audits across sandbox, secrets, auth, headers, webhooks, plugins and MCP spec compliance. Manage ACP sessions, workspace locks, cron scheduling and reliability probes. Harvest, weight and analyze Hebbian memory, and check knowledge graph and pgvector configuration. Orchestrate agent task DAGs, load and search skills, and export deliverables to GitHub PRs, Jira, Linear, Slack or local Markdown. Generate market, legal, location and supplier research reports.
When to use it
Useful if you run a Firm Gateway setup with VS Code Copilot agents and want an assistant to audit its security posture, coordinate agent fleets and sessions, or turn results into tickets, PRs and reports. Not aimed at general-purpose coding or data work outside that ecosystem.
Requirements
Runs locally as a Python process (stdio transport, also served on port 8012); install dependencies with pip and fill in tokens in a .env file before starting. A Firm Gateway ecosystem and VS Code configuration are expected. No credentials are declared in the manifest.
Before you install
Several tools write or send data: draft GitHub PRs, Jira and Linear issues, Slack digests, local files, fleet config syncs, cron schedules and A2A tasks. It reads configuration and credential files to audit them, and the README notes tokens are masked in logs. AI-generated output is flagged as needing human review.

Installation

In SourceWeft

  1. Open MCP OpenClaw Extensions in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

firm-mcp-server

Python MCP server (port 8012) that bridges VS Code Copilot agents to the [Firm](https://github.com/the server) Gateway ecosystem. Companion to setup-vs-agent-firm.

Tools (138)

ModuleToolDescriptionGaps
vs_bridgevs_context_pushPush VS Code context → Firm session—
vs_bridgevs_context_pullPull Firm session state → VS Code—
vs_bridgevs_session_linkAssociate workspace path ↔ session ID—
vs_bridgevs_session_statusBridge health check—
gateway_fleetfirm_gateway_fleet_statusParallel health-check all instances—
gateway_fleetfirm_gateway_fleet_addRegister a Gateway instance—
gateway_fleetfirm_gateway_fleet_removeRemove a Gateway instance—
gateway_fleetfirm_gateway_fleet_broadcastBroadcast to all instances—
gateway_fleetfirm_gateway_fleet_syncSync config+skills to all instances—
gateway_fleetfirm_gateway_fleet_listList instances—
delivery_exportfirm_export_github_prCreate draft PR on GitHub—
delivery_exportfirm_export_jira_ticketCreate Jira ticket (ADF)—
delivery_exportfirm_export_linear_issueCreate Linear issue (GraphQL)—
delivery_exportfirm_export_slack_digestPost Slack digest (Block Kit)—
delivery_exportfirm_export_documentWrite local Markdown deliverable—
delivery_exportfirm_export_autoAuto-route by delivery_format—
security_auditfirm_security_scanScan files for SQL injection + XSS patternsC1
security_auditfirm_sandbox_auditDetect sandbox.mode: off → CRITICALC2
security_auditfirm_session_config_checkDetect ephemeral SESSION_SECRET in .env/composeC3
security_auditfirm_rate_limit_checkDetect Funnel without rate limiter → CRITICALH8
acp_bridgeacp_session_persistPersist ACP session to ~/.firm/acp_sessions.jsonC4
acp_bridgeacp_session_restoreRestore persisted ACP session by run_idC4
acp_bridgeacp_session_list_activeList ACP sessions active in last N hoursC4
acp_bridgefleet_session_inject_envInject env vars to spawned sessions (allowlist)H3
acp_bridgefleet_cron_scheduleSchedule cron with sandbox enforcementH4
acp_bridgefirm_workspace_lockAdvisory file lock with owner tracking (fcntl)H5
acp_bridgefirm_acpx_version_checkACPX plugin version pin (≥0.1.15) + streaming mode check3.1
reliability_probefirm_gateway_probeWS probe with backoff — detects close 1006, returns launchctlH6/H7
reliability_probefirm_doc_sync_checkDetect version drift in docs vs package.jsonM5
reliability_probefirm_channel_auditDetect zombie channel SDK deps (LINE, Baileys…)M1
reliability_probefirm_adr_generateGenerate MADR + commit path for architecture decisionsM6
gateway_hardeningfirm_gateway_auth_checkVerify Gateway auth config — CRITICAL if Funnel without passwordH2
gateway_hardeningfirm_credentials_checkCheck Baileys/channel credential integrity and freshnessM3
gateway_hardeningfirm_webhook_sig_checkVerify HMAC signing secrets for all inbound webhook channelsM4
gateway_hardeningfirm_log_config_checkDetect debug/trace logging and missing redactPatternsM7
gateway_hardeningfirm_workspace_integrity_checkValidate ~/.firm/workspace (AGENTS.md, SOUL.md, staleness)M8
runtime_auditfirm_node_version_checkVerify Node.js ≥ 22.12.0 (CVE-2025-59466, CVE-2026-21636)C5
runtime_auditfirm_secrets_workflow_checkDetect hardcoded secrets in config.json (migrate to firm secrets)C6
runtime_auditfirm_http_headers_checkVerify HTTP security headers (HSTS, X-Content-Type-Options, Referrer-Policy)H9
runtime_auditfirm_nodes_commands_checkDetect dangerous gateway.nodes.allowCommands overrideH10
runtime_auditfirm_trusted_proxy_checkVerify trusted-proxy config coherence (bind + trustedProxies + auth mode)H11
runtime_auditfirm_session_disk_budget_checkVerify session.maintenance.maxDiskBytes / highWaterBytes configuredM15
runtime_auditfirm_dm_allowlist_checkDetect dmPolicy=allowlist with empty allowFrom (fail-closed) across 9 channelsM16
advanced_securityfirm_secrets_lifecycle_checkVerify External Secrets lifecycle (audit/configure/apply/reload)C7
advanced_securityfirm_channel_auth_canon_checkVerify channel auth path canonicalization (encoded traversal)C8
advanced_securityfirm_exec_approval_freeze_checkVerify exec approval plan immutability (symlink cwd rebind)C9
advanced_securityfirm_hook_session_routing_checkVerify hook session-key routing hardeningH12
advanced_securityfirm_config_include_checkVerify $include hardlink escape + file-size guardrailsH13
advanced_securityfirm_config_prototype_checkDetect prototype pollution (proto, constructor, prototype) in configH14
advanced_securityfirm_safe_bins_profile_checkVerify safeBins entries have explicit profilesH15
advanced_securityfirm_group_policy_default_checkVerify group policy default is fail-closed (allowlist)H16
config_migrationfirm_shell_env_checkVerify shell env sanitization (LD_PRELOAD, DYLD_*, ZDOTDIR)H17
config_migrationfirm_plugin_integrity_checkVerify plugin install integrity/pin + drift detectionH18
config_migrationfirm_token_separation_checkVerify hooks.token ≠ gateway.auth.tokenH19
config_migrationfirm_otel_redaction_checkVerify OTEL secret redaction in diagnostics exportM17
config_migrationfirm_rpc_rate_limit_checkVerify control-plane RPC rate limiting configM21
observabilityfirm_observability_pipelineIngest JSONL traces into SQLite for offline analysisT1
observabilityfirm_ci_pipeline_checkValidate CI workflow completeness (lint, test, secrets)T6
memory_auditfirm_pgvector_memory_checkVerify pgvector config (HNSW index, dimensions, distance metrics)T3
memory_auditfirm_knowledge_graph_checkAudit knowledge graph integrity (orphan nodes, cycles, TTL)T9
agent_orchestrationfirm_agent_team_orchestrateTask DAG execution with topological sort + parallel layersT4
agent_orchestrationfirm_agent_team_statusCheck orchestration status by ID or list allT4
i18n_auditfirm_i18n_auditScan locale files for missing keys, empty values, interpolation mismatchesT5
skill_loaderfirm_skill_lazy_loaderLazy-load SKILL.md metadata (YAML front-matter, 5min cache)T7
skill_loaderfirm_skill_searchKeyword/tag search across cached skills with relevance scoringT7
n8n_bridgefirm_n8n_workflow_exportExport agent pipeline as n8n-compatible workflow JSONT8
n8n_bridgefirm_n8n_workflow_importValidate & import n8n workflow JSON into workspaceT8
browser_auditfirm_browser_context_checkValidate Playwright/Puppeteer headless config for agentsT10
hebbian_memoryfirm_hebbian_harvestIngest JSONL session logs → SQLite (PII stripped) — CDC §4.1—
hebbian_memoryfirm_hebbian_weight_updateCompute/apply Hebbian weight updates on Layer 2 — CDC §4.3—
hebbian_memoryfirm_hebbian_analyzeCo-activation pattern analysis (Jaccard similarity) — CDC §4.3—
hebbian_memoryfirm_hebbian_statusDashboard: weights, atrophy, promotions — CDC §7—
hebbian_memoryfirm_hebbian_layer_validateValidate 4-layer Claude.md structure — CDC §3.3—
hebbian_memoryfirm_hebbian_pii_checkAudit PII stripping config — CDC §5.2—
hebbian_memoryfirm_hebbian_decay_config_checkValidate learning rate, decay, thresholds — CDC §4.3—
hebbian_memoryfirm_hebbian_drift_checkCosine similarity drift detection vs baseline — CDC §5.1—
a2a_bridgefirm_a2a_card_generateGenerate agent-card.json from SOUL.md (RC v1.0)G1
a2a_bridgefirm_a2a_card_validateValidate A2A Agent Card against RC v1.0 specG2
a2a_bridgefirm_a2a_task_sendSend message/task to an A2A agent (SendMessage)G3
a2a_bridgefirm_a2a_task_statusGet task status or list tasks (RC v1.0)G4
a2a_bridgefirm_a2a_cancel_taskCancel a running A2A task (CancelTask)G5
a2a_bridgefirm_a2a_subscribe_taskSubscribe to task updates via SSEG6
a2a_bridgefirm_a2a_push_configCRUD for push notification webhooks (RC v1.0)G7
a2a_bridgefirm_a2a_discoveryDiscover agents via Agent Cards or SOUL.md scanG8
platform_auditfirm_secrets_v2_auditAudit Firm secrets v2 lifecycle (2026.2+)G9
platform_auditfirm_agent_routing_checkValidate agent routing bindingsG10
platform_auditfirm_voice_security_checkTTS/voice channel security auditG11
platform_auditfirm_trust_model_checkValidate trust model and multi-user heuristicsG12
platform_auditfirm_autoupdate_checkSelf-update supply chain integrity checkG13
platform_auditfirm_plugin_sdk_checkPlugin SDK integrity validationG14
platform_auditfirm_content_boundary_checkContent boundary & anti-prompt-injection auditG15
platform_auditfirm_sqlite_vec_checkSQLite-vec memory backend validationG16
platform_auditfirm_adaptive_thinking_checkClaude 4.6 adaptive thinking configuration check3.1
ecosystem_auditfirm_mcp_firewall_checkMCP Gateway firewall policy auditG17
ecosystem_auditfirm_rag_pipeline_checkRAG pipeline health & config auditG18
ecosystem_auditfirm_sandbox_exec_checkSandbox execution isolation auditG19
ecosystem_auditfirm_context_health_checkContext rot / cognitive health detectionG20
ecosystem_auditfirm_provenance_trackerCryptographic audit trail / provenance trackingG21
ecosystem_auditfirm_cost_analyticsUsage/cost tracking and analysisG22
ecosystem_auditfirm_token_budget_optimizerToken optimization analysisG23
spec_compliancefirm_elicitation_auditAudit MCP elicitation capability complianceS4
spec_compliancefirm_tasks_auditAudit MCP Tasks capability complianceS5
spec_compliancefirm_resources_prompts_auditAudit MCP Resources & Prompts complianceS6
spec_compliancefirm_audio_content_auditAudit MCP audio content supportH3
spec_compliancefirm_json_schema_dialect_checkAudit JSON Schema dialect complianceH5
spec_compliancefirm_sse_transport_auditAudit Streamable HTTP / SSE transportH6
spec_compliancefirm_icon_metadata_auditAudit icon metadata supportH7
prompt_securityfirm_prompt_injection_checkScan text for 16 injection/jailbreak patternsH2
prompt_securityfirm_prompt_injection_batchBatch scan multiple texts for injection patternsH2
auth_compliancefirm_oauth_oidc_auditAudit OAuth 2.1 / OIDC Discovery complianceH4
auth_compliancefirm_token_scope_checkCheck OAuth scopes restrict tool access properlyH4
compliance_mediumfirm_tool_deprecation_auditAudit tool deprecation lifecycleM1
compliance_mediumfirm_circuit_breaker_auditAudit circuit breaker / resilience configM2
compliance_mediumfirm_gdpr_residency_auditAudit GDPR compliance and data residencyM3
compliance_mediumfirm_agent_identity_auditAudit agent DID (decentralized identity)M4
compliance_mediumfirm_model_routing_auditAudit multi-model routing and fallback chainM5
compliance_mediumfirm_resource_links_auditAudit MCP resource links in tool resultsM6
market_researchfirm_market_competitive_analysisFull competitive landscape analysis (feature matrix, SWOT, positioning)—
market_researchfirm_market_sizingTAM/SAM/SOM market sizing (top-down + bottom-up)—
market_researchfirm_market_financial_benchmarkFinancial benchmarking — unit economics, pricing, revenue—
market_researchfirm_market_web_researchStructured web research & OSINT intelligence gathering—
market_researchfirm_market_report_generateProfessional Markdown market research report generator—
market_researchfirm_market_research_monitorContinuous competitive monitoring (add/remove/update/status)—
legal_statusfirm_legal_status_compareCompare legal forms (SAS, SARL, EURL…) on multi-criteria grid—
legal_statusfirm_legal_tax_simulateSimulate IS/IR tax burden per legal form—
legal_statusfirm_legal_social_protectionAnalyze social protection by dirigeant status—
legal_statusfirm_legal_governance_auditAudit governance clauses & shareholder pacts—
legal_statusfirm_legal_creation_checklistStep-by-step company creation checklist—
location_strategyfirm_location_geo_analysisGeo-economic attractiveness analysis by zone—
location_strategyfirm_location_real_estateReal estate market scan (buy/rent/coworking)—
location_strategyfirm_location_site_scoreMulti-criteria site scoring (20 criteria)—
location_strategyfirm_location_incentivesMap tax incentives & public aids by zone—
location_strategyfirm_location_tco_simulateTotal cost of occupancy simulation over N years—
supplier_managementfirm_supplier_searchSearch & filter suppliers by category/region/certification—
supplier_managementfirm_supplier_evaluateMulti-criteria supplier evaluation (15 criteria)—
supplier_managementfirm_supplier_tco_analyzeSupplier TCO analysis (direct + indirect + hidden costs)—
supplier_managementfirm_supplier_contract_checkContract clause compliance audit (14 mandatory clauses)—
supplier_managementfirm_supplier_risk_monitorSupplier risk monitoring (add/remove/update/status)—

Quick start

bash
python3 -m venv .venv && source .venv/bin/activatepip install -r requirements.txtcp .env.example .env   # fill in tokensbash scripts/start.sh

Add to VS Code settings.json:

json
"mcp.servers": {  "firm-extensions": { "url": "http://127.0.0.1:8012/mcp" }}

Scripts

bash
bash scripts/start.sh    # start in backgroundbash scripts/stop.sh     # graceful stopbash scripts/status.sh   # PID + HTTP + tool count

Tests

bash
pip install -r requirements-dev.txtpython -m pytest tests/test_smoke.py -v

2272 tests (1961 unit + 311 integration), 94.6% coverage, covering:

  • Server starts and answers ping
  • initialize returns correct capabilities + __version__
  • All 115 tools registered with valid inputSchema
  • vs_context_push degrades gracefully without Gateway
  • firm_export_document writes local file
  • Unknown method returns JSON-RPC error -32601
  • Unknown tool returns descriptive error
  • Timing-safe auth (I21), SQL injection guard (I24), session_id regex (I41)
  • ConfigPathInput traversal blocking across all 21 config-path models (I27)
  • Health/healthz endpoints return correct tool count + version (I35)
  • Shared config_helpers: load_config, get_nested, mask_secret (I25)
  • Hebbian memory: harvest PII stripping, weight update dry-run, layer validation, drift detection, Pydantic traversal guards

Security

  • Auth: timing-safe hmac.compare_digest on Bearer token — no timing side-channel (I21)
  • Request limit: client_max_size=2MB on aiohttp Application (I22)
  • Tool timeout: asyncio.wait_for with TOOL_TIMEOUT_S (default 120s) on all async tool calls (I23)
  • SQL injection guard: table_name validated by Pydantic regex ^[a-zA-Z_][a-zA-Z0-9_]{0,127}$ + runtime whitelist in handler (I24)
  • Session ID regex: ^[a-zA-Z0-9_\-:.]+$ on all session_id fields — no injection (I41)
  • Centralized version: __version__ in main.py — single source of truth (I37)
  • DRY helpers: config_helpers.py — shared load_config, get_nested, mask_secret (I25)
  • ConfigPathInput base: 21 models inherit traversal guard from single base class (I27)
  • Hebbian PII stripping: 9 regex patterns (email, phone, IP, API keys, SSN, JWT, AWS keys) applied before any session storage — CDC §5.2
  • Hebbian drift detection: TF-IDF cosine similarity vs baseline (no external API) — CDC §5.1
  • Hebbian weight caps: auto-update capped at 0.95, atrophy floor at 0.0, dry_run=True default — CDC §4.3
  • GitHub PRs always created as drafts with needs-review label
  • Tokens masked in logs (last 4 chars only) via mask_secret()
  • Context capped at 32 KB per WS payload
  • fleet.json and acp_sessions.json written atomically (os.replace)
  • Workspace lock via fcntl.LOCK_EX | LOCK_NB (advisory, crash-safe)
  • fleet_session_inject_env: allowlist regex — only known provider keys accepted
  • fleet_cron_schedule: command allowlist regex + blocklist (rm, dd, mkfs…)
  • Path traversal guard (..) on all file-path Pydantic fields
  • All AI outputs carry human-review disclaimer

Gap coverage (Firm audit)

IDSeverityDescriptionCoverage
C1CRITICALSQL injection in API endpointsfirm_security_scan
C2CRITICALSandbox disabled (mode: off)firm_sandbox_audit
C3CRITICALSESSION_SECRET ephemeral / in configfirm_session_config_check
C4CRITICALACP sessions lost on restart (in-memory)acp_session_persist/restore
H1HIGH@buape/carbon frozen at 0.0.0-betafirm_adr_generate + CTO SOUL.md
H2HIGHGateway Funnel without auth.mode=passwordfirm_gateway_auth_check
H3HIGHSpawned sessions get no env varsfleet_session_inject_env
H4HIGHCron not blocked in sandboxfleet_cron_schedule
H5HIGHRace condition on workspace lockfirm_workspace_lock
H6HIGHGateway silently drops on macOS sleepfirm_gateway_probe
H7HIGHWS close code 1006 not handledfirm_gateway_probe
H8HIGHNo rate limiting on Tailscale Funnelfirm_rate_limit_check
M1MEDIUM@line/bot-sdk zombie dependencyfirm_channel_audit
M2MEDIUMTest coverage threshold 70%factory 80% threshold + CTO SOUL.md
M3MEDIUMBaileys creds.json no integrity/age checkfirm_credentials_check
M4MEDIUMWebhook HMAC signature verification missingfirm_webhook_sig_check
M5MEDIUMDocs version stale vs package.jsonfirm_doc_sync_check
M6MEDIUMNo ADRs for architecture decisionsfirm_adr_generate
M7MEDIUMLogging verbose / no redactPatternsfirm_log_config_check
M8MEDIUM~/.firm/workspace integrity uncheckedfirm_workspace_integrity_check
C5CRITICALNode.js < 22.12.0 (CVE-2025-59466, CVE-2026-21636)firm_node_version_check
C6CRITICALHardcoded secrets in config.json (no secrets workflow)firm_secrets_workflow_check
H9HIGHHTTP security headers absent (HSTS, X-Content-Type-Options)firm_http_headers_check
H10HIGHgateway.nodes.allowCommands dangerous overridefirm_nodes_commands_check
H11HIGHTrusted-proxy misconfigured (bind+proxies+auth mode)firm_trusted_proxy_check
M15MEDIUMSession disk budget not configured (maxDiskBytes)firm_session_disk_budget_check
M16MEDIUMdmPolicy=allowlist with empty allowFrom (fail-open)firm_dm_allowlist_check
C7CRITICALExternal Secrets lifecycle not validated (inline creds)firm_secrets_lifecycle_check
C8CRITICALPlugin channel HTTP auth bypass (path canonicalization)firm_channel_auth_canon_check
C9CRITICALExec approval plan mutability (symlink cwd rebind)firm_exec_approval_freeze_check
H12HIGHHook session-key routing unrestrictedfirm_hook_session_routing_check
H13HIGHConfig $include hardlink escape + file-sizefirm_config_include_check
H14HIGHPrototype pollution in config mergefirm_config_prototype_check
H15HIGHSafeBins without explicit profile = unrestricted interpreterfirm_safe_bins_profile_check
H16HIGHGroup policy default not fail-closedfirm_group_policy_default_check
H17HIGHShell env not sanitized (LD_PRELOAD, DYLD_*)firm_shell_env_check
H18HIGHPlugin install integrity/pin not trackedfirm_plugin_integrity_check
H19HIGHhooks.token = gateway.auth.token (reuse)firm_token_separation_check
M17MEDIUMOTEL secret redaction missing in diagnosticsfirm_otel_redaction_check
M21MEDIUMControl-plane RPC rate limiting absentfirm_rpc_rate_limit_check
T1TOOLNo observability pipeline for JSONL tracesfirm_observability_pipeline
T3TOOLpgvector memory config uncheckedfirm_pgvector_memory_check
T4TOOLNo parallel agent orchestration (task DAG)firm_agent_team_orchestrate
T5TOOLNo i18n/localization auditfirm_i18n_audit
T6TOOLNo CI pipeline completeness checkfirm_ci_pipeline_check
T7TOOLSkills loaded eagerly (no lazy loading)firm_skill_lazy_loader + firm_skill_search
T8TOOLNo n8n workflow automation bridgefirm_n8n_workflow_export + firm_n8n_workflow_import
T9TOOLKnowledge graph integrity uncheckedfirm_knowledge_graph_check
T10TOOLBrowser automation config uncheckedfirm_browser_context_check

⚠️ Contenu généré par IA — validation humaine requise avant utilisation.

Source: README.md at commit 9c8f848

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v3.3.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.

Other Openclaw integrations

OpenClaw Direct

direct.openclawOfficial publisher

A remote MCP endpoint that lets an assistant deploy, monitor and manage OpenClaw AI assistants through natural language.

Streamable HTTPWeb executableAuth
Cloud & InfrastructureCredential requiredOct 25, 2026

OpenClaw MCP Ecosystem

Published by GitHub account yedanyagamiai-cmd

A remote Cloudflare Workers endpoint advertising a bundle of nine MCP servers covering security scanning, knowledge graph, compliance, finance, memory…

Streamable HTTPWeb executable
Knowledge & MemoryNot indexed yetOct 27, 2026

Openclaw Upgrade Orchestrator Mcp

Published by GitHub account temurkhan13

A local MCP server for AI runtime upgrade safety, offering snapshot diff and fingerprint checks to detect provider-side regressions.

STDIODesktop only
Developer ToolsNot validated yetOct 24, 2026

Openclaw Skill Vetter Mcp

Published by GitHub account temurkhan13

A local MCP server that lets an assistant vet third-party AI agent extensions and agent-configuration files such as AGENTS.md, .cursor/rules and CLAUDE.md.

STDIODesktop only
Developer ToolsNot validated yetOct 24, 2026

Openclaw Output Vetter Mcp

Published by GitHub account temurkhan13

Local MCP server that checks AI agent claims against reality, with inline grounding checks, swallowed-exception detection and transcript review.

STDIODesktop only
AI & MLNot validated yetOct 27, 2026