MCP OpenClaw Extensions

io.github.romainsantoli-web由 GitHub 账号 romainsantoli-web 发布v3.3.0更新于 Oct 24, 2026

138-tool MCP server for AI agent firms: security, A2A, Hebbian memory, fleet mgmt

发布方自己的服务：OpenClaw Direct

已验证STDIO仅桌面效率与工作流开发者工具安全与监控

概览

AI 生成的概览

本地运行的 Python MCP 服务器，提供 138 个工具，用于审计、编排并导出 AI 代理公司网关、记忆与交付流程中的工作。

可以做什么
在 VS Code 上下文、会话与 Firm 网关之间推送和拉取，并管理网关集群（状态、增删、广播、同步、列表）。执行安全与配置审计，覆盖沙箱、密钥、认证、HTTP 头、Webhook、插件及 MCP 规范符合性。管理 ACP 会话、工作区锁、定时任务与可靠性探测。采集、加权并分析 Hebbian 记忆，检查知识图谱与 pgvector 配置。编排代理任务 DAG，加载和搜索技能，并将成果导出为 GitHub PR、Jira、Linear、Slack 或本地 Markdown。生成市场、法律、选址与供应商研究报告。
适用场景
适合已部署 Firm Gateway 与 VS Code Copilot 代理、希望让助手审计其安全状况、协调代理集群与会话，或把结果转成工单、PR 和报告的场景。不面向该生态之外的通用编码或数据工作。
运行要求
以本地 Python 进程运行（stdio 传输，同时监听 8012 端口）；需用 pip 安装依赖，并在启动前于 .env 文件中填写令牌。预期已有 Firm Gateway 生态与 VS Code 配置。清单未声明任何凭据。
安装前请注意
多个工具会写入或发送数据：GitHub 草稿 PR、Jira 与 Linear 工单、Slack 摘要、本地文件、集群配置同步、定时任务和 A2A 任务。它会读取配置与凭据文件以进行审计，README 称日志中令牌会被掩码。AI 生成内容标注需人工复核。

安装

在 SourceWeft 中

  1. 打开 控制台中的 MCP OpenClaw Extensions，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

firm-mcp-server

Python MCP server (port 8012) that bridges VS Code Copilot agents to the [Firm](https://github.com/the server) Gateway ecosystem. Companion to setup-vs-agent-firm.

Tools (138)

ModuleToolDescriptionGaps
vs_bridgevs_context_pushPush VS Code context → Firm session—
vs_bridgevs_context_pullPull Firm session state → VS Code—
vs_bridgevs_session_linkAssociate workspace path ↔ session ID—
vs_bridgevs_session_statusBridge health check—
gateway_fleetfirm_gateway_fleet_statusParallel health-check all instances—
gateway_fleetfirm_gateway_fleet_addRegister a Gateway instance—
gateway_fleetfirm_gateway_fleet_removeRemove a Gateway instance—
gateway_fleetfirm_gateway_fleet_broadcastBroadcast to all instances—
gateway_fleetfirm_gateway_fleet_syncSync config+skills to all instances—
gateway_fleetfirm_gateway_fleet_listList instances—
delivery_exportfirm_export_github_prCreate draft PR on GitHub—
delivery_exportfirm_export_jira_ticketCreate Jira ticket (ADF)—
delivery_exportfirm_export_linear_issueCreate Linear issue (GraphQL)—
delivery_exportfirm_export_slack_digestPost Slack digest (Block Kit)—
delivery_exportfirm_export_documentWrite local Markdown deliverable—
delivery_exportfirm_export_autoAuto-route by delivery_format—
security_auditfirm_security_scanScan files for SQL injection + XSS patternsC1
security_auditfirm_sandbox_auditDetect sandbox.mode: off → CRITICALC2
security_auditfirm_session_config_checkDetect ephemeral SESSION_SECRET in .env/composeC3
security_auditfirm_rate_limit_checkDetect Funnel without rate limiter → CRITICALH8
acp_bridgeacp_session_persistPersist ACP session to ~/.firm/acp_sessions.jsonC4
acp_bridgeacp_session_restoreRestore persisted ACP session by run_idC4
acp_bridgeacp_session_list_activeList ACP sessions active in last N hoursC4
acp_bridgefleet_session_inject_envInject env vars to spawned sessions (allowlist)H3
acp_bridgefleet_cron_scheduleSchedule cron with sandbox enforcementH4
acp_bridgefirm_workspace_lockAdvisory file lock with owner tracking (fcntl)H5
acp_bridgefirm_acpx_version_checkACPX plugin version pin (≥0.1.15) + streaming mode check3.1
reliability_probefirm_gateway_probeWS probe with backoff — detects close 1006, returns launchctlH6/H7
reliability_probefirm_doc_sync_checkDetect version drift in docs vs package.jsonM5
reliability_probefirm_channel_auditDetect zombie channel SDK deps (LINE, Baileys…)M1
reliability_probefirm_adr_generateGenerate MADR + commit path for architecture decisionsM6
gateway_hardeningfirm_gateway_auth_checkVerify Gateway auth config — CRITICAL if Funnel without passwordH2
gateway_hardeningfirm_credentials_checkCheck Baileys/channel credential integrity and freshnessM3
gateway_hardeningfirm_webhook_sig_checkVerify HMAC signing secrets for all inbound webhook channelsM4
gateway_hardeningfirm_log_config_checkDetect debug/trace logging and missing redactPatternsM7
gateway_hardeningfirm_workspace_integrity_checkValidate ~/.firm/workspace (AGENTS.md, SOUL.md, staleness)M8
runtime_auditfirm_node_version_checkVerify Node.js ≥ 22.12.0 (CVE-2025-59466, CVE-2026-21636)C5
runtime_auditfirm_secrets_workflow_checkDetect hardcoded secrets in config.json (migrate to firm secrets)C6
runtime_auditfirm_http_headers_checkVerify HTTP security headers (HSTS, X-Content-Type-Options, Referrer-Policy)H9
runtime_auditfirm_nodes_commands_checkDetect dangerous gateway.nodes.allowCommands overrideH10
runtime_auditfirm_trusted_proxy_checkVerify trusted-proxy config coherence (bind + trustedProxies + auth mode)H11
runtime_auditfirm_session_disk_budget_checkVerify session.maintenance.maxDiskBytes / highWaterBytes configuredM15
runtime_auditfirm_dm_allowlist_checkDetect dmPolicy=allowlist with empty allowFrom (fail-closed) across 9 channelsM16
advanced_securityfirm_secrets_lifecycle_checkVerify External Secrets lifecycle (audit/configure/apply/reload)C7
advanced_securityfirm_channel_auth_canon_checkVerify channel auth path canonicalization (encoded traversal)C8
advanced_securityfirm_exec_approval_freeze_checkVerify exec approval plan immutability (symlink cwd rebind)C9
advanced_securityfirm_hook_session_routing_checkVerify hook session-key routing hardeningH12
advanced_securityfirm_config_include_checkVerify $include hardlink escape + file-size guardrailsH13
advanced_securityfirm_config_prototype_checkDetect prototype pollution (proto, constructor, prototype) in configH14
advanced_securityfirm_safe_bins_profile_checkVerify safeBins entries have explicit profilesH15
advanced_securityfirm_group_policy_default_checkVerify group policy default is fail-closed (allowlist)H16
config_migrationfirm_shell_env_checkVerify shell env sanitization (LD_PRELOAD, DYLD_*, ZDOTDIR)H17
config_migrationfirm_plugin_integrity_checkVerify plugin install integrity/pin + drift detectionH18
config_migrationfirm_token_separation_checkVerify hooks.token ≠ gateway.auth.tokenH19
config_migrationfirm_otel_redaction_checkVerify OTEL secret redaction in diagnostics exportM17
config_migrationfirm_rpc_rate_limit_checkVerify control-plane RPC rate limiting configM21
observabilityfirm_observability_pipelineIngest JSONL traces into SQLite for offline analysisT1
observabilityfirm_ci_pipeline_checkValidate CI workflow completeness (lint, test, secrets)T6
memory_auditfirm_pgvector_memory_checkVerify pgvector config (HNSW index, dimensions, distance metrics)T3
memory_auditfirm_knowledge_graph_checkAudit knowledge graph integrity (orphan nodes, cycles, TTL)T9
agent_orchestrationfirm_agent_team_orchestrateTask DAG execution with topological sort + parallel layersT4
agent_orchestrationfirm_agent_team_statusCheck orchestration status by ID or list allT4
i18n_auditfirm_i18n_auditScan locale files for missing keys, empty values, interpolation mismatchesT5
skill_loaderfirm_skill_lazy_loaderLazy-load SKILL.md metadata (YAML front-matter, 5min cache)T7
skill_loaderfirm_skill_searchKeyword/tag search across cached skills with relevance scoringT7
n8n_bridgefirm_n8n_workflow_exportExport agent pipeline as n8n-compatible workflow JSONT8
n8n_bridgefirm_n8n_workflow_importValidate & import n8n workflow JSON into workspaceT8
browser_auditfirm_browser_context_checkValidate Playwright/Puppeteer headless config for agentsT10
hebbian_memoryfirm_hebbian_harvestIngest JSONL session logs → SQLite (PII stripped) — CDC §4.1—
hebbian_memoryfirm_hebbian_weight_updateCompute/apply Hebbian weight updates on Layer 2 — CDC §4.3—
hebbian_memoryfirm_hebbian_analyzeCo-activation pattern analysis (Jaccard similarity) — CDC §4.3—
hebbian_memoryfirm_hebbian_statusDashboard: weights, atrophy, promotions — CDC §7—
hebbian_memoryfirm_hebbian_layer_validateValidate 4-layer Claude.md structure — CDC §3.3—
hebbian_memoryfirm_hebbian_pii_checkAudit PII stripping config — CDC §5.2—
hebbian_memoryfirm_hebbian_decay_config_checkValidate learning rate, decay, thresholds — CDC §4.3—
hebbian_memoryfirm_hebbian_drift_checkCosine similarity drift detection vs baseline — CDC §5.1—
a2a_bridgefirm_a2a_card_generateGenerate agent-card.json from SOUL.md (RC v1.0)G1
a2a_bridgefirm_a2a_card_validateValidate A2A Agent Card against RC v1.0 specG2
a2a_bridgefirm_a2a_task_sendSend message/task to an A2A agent (SendMessage)G3
a2a_bridgefirm_a2a_task_statusGet task status or list tasks (RC v1.0)G4
a2a_bridgefirm_a2a_cancel_taskCancel a running A2A task (CancelTask)G5
a2a_bridgefirm_a2a_subscribe_taskSubscribe to task updates via SSEG6
a2a_bridgefirm_a2a_push_configCRUD for push notification webhooks (RC v1.0)G7
a2a_bridgefirm_a2a_discoveryDiscover agents via Agent Cards or SOUL.md scanG8
platform_auditfirm_secrets_v2_auditAudit Firm secrets v2 lifecycle (2026.2+)G9
platform_auditfirm_agent_routing_checkValidate agent routing bindingsG10
platform_auditfirm_voice_security_checkTTS/voice channel security auditG11
platform_auditfirm_trust_model_checkValidate trust model and multi-user heuristicsG12
platform_auditfirm_autoupdate_checkSelf-update supply chain integrity checkG13
platform_auditfirm_plugin_sdk_checkPlugin SDK integrity validationG14
platform_auditfirm_content_boundary_checkContent boundary & anti-prompt-injection auditG15
platform_auditfirm_sqlite_vec_checkSQLite-vec memory backend validationG16
platform_auditfirm_adaptive_thinking_checkClaude 4.6 adaptive thinking configuration check3.1
ecosystem_auditfirm_mcp_firewall_checkMCP Gateway firewall policy auditG17
ecosystem_auditfirm_rag_pipeline_checkRAG pipeline health & config auditG18
ecosystem_auditfirm_sandbox_exec_checkSandbox execution isolation auditG19
ecosystem_auditfirm_context_health_checkContext rot / cognitive health detectionG20
ecosystem_auditfirm_provenance_trackerCryptographic audit trail / provenance trackingG21
ecosystem_auditfirm_cost_analyticsUsage/cost tracking and analysisG22
ecosystem_auditfirm_token_budget_optimizerToken optimization analysisG23
spec_compliancefirm_elicitation_auditAudit MCP elicitation capability complianceS4
spec_compliancefirm_tasks_auditAudit MCP Tasks capability complianceS5
spec_compliancefirm_resources_prompts_auditAudit MCP Resources & Prompts complianceS6
spec_compliancefirm_audio_content_auditAudit MCP audio content supportH3
spec_compliancefirm_json_schema_dialect_checkAudit JSON Schema dialect complianceH5
spec_compliancefirm_sse_transport_auditAudit Streamable HTTP / SSE transportH6
spec_compliancefirm_icon_metadata_auditAudit icon metadata supportH7
prompt_securityfirm_prompt_injection_checkScan text for 16 injection/jailbreak patternsH2
prompt_securityfirm_prompt_injection_batchBatch scan multiple texts for injection patternsH2
auth_compliancefirm_oauth_oidc_auditAudit OAuth 2.1 / OIDC Discovery complianceH4
auth_compliancefirm_token_scope_checkCheck OAuth scopes restrict tool access properlyH4
compliance_mediumfirm_tool_deprecation_auditAudit tool deprecation lifecycleM1
compliance_mediumfirm_circuit_breaker_auditAudit circuit breaker / resilience configM2
compliance_mediumfirm_gdpr_residency_auditAudit GDPR compliance and data residencyM3
compliance_mediumfirm_agent_identity_auditAudit agent DID (decentralized identity)M4
compliance_mediumfirm_model_routing_auditAudit multi-model routing and fallback chainM5
compliance_mediumfirm_resource_links_auditAudit MCP resource links in tool resultsM6
market_researchfirm_market_competitive_analysisFull competitive landscape analysis (feature matrix, SWOT, positioning)—
market_researchfirm_market_sizingTAM/SAM/SOM market sizing (top-down + bottom-up)—
market_researchfirm_market_financial_benchmarkFinancial benchmarking — unit economics, pricing, revenue—
market_researchfirm_market_web_researchStructured web research & OSINT intelligence gathering—
market_researchfirm_market_report_generateProfessional Markdown market research report generator—
market_researchfirm_market_research_monitorContinuous competitive monitoring (add/remove/update/status)—
legal_statusfirm_legal_status_compareCompare legal forms (SAS, SARL, EURL…) on multi-criteria grid—
legal_statusfirm_legal_tax_simulateSimulate IS/IR tax burden per legal form—
legal_statusfirm_legal_social_protectionAnalyze social protection by dirigeant status—
legal_statusfirm_legal_governance_auditAudit governance clauses & shareholder pacts—
legal_statusfirm_legal_creation_checklistStep-by-step company creation checklist—
location_strategyfirm_location_geo_analysisGeo-economic attractiveness analysis by zone—
location_strategyfirm_location_real_estateReal estate market scan (buy/rent/coworking)—
location_strategyfirm_location_site_scoreMulti-criteria site scoring (20 criteria)—
location_strategyfirm_location_incentivesMap tax incentives & public aids by zone—
location_strategyfirm_location_tco_simulateTotal cost of occupancy simulation over N years—
supplier_managementfirm_supplier_searchSearch & filter suppliers by category/region/certification—
supplier_managementfirm_supplier_evaluateMulti-criteria supplier evaluation (15 criteria)—
supplier_managementfirm_supplier_tco_analyzeSupplier TCO analysis (direct + indirect + hidden costs)—
supplier_managementfirm_supplier_contract_checkContract clause compliance audit (14 mandatory clauses)—
supplier_managementfirm_supplier_risk_monitorSupplier risk monitoring (add/remove/update/status)—

Quick start

bash
python3 -m venv .venv && source .venv/bin/activatepip install -r requirements.txtcp .env.example .env   # fill in tokensbash scripts/start.sh

Add to VS Code settings.json:

json
"mcp.servers": {  "firm-extensions": { "url": "http://127.0.0.1:8012/mcp" }}

Scripts

bash
bash scripts/start.sh    # start in backgroundbash scripts/stop.sh     # graceful stopbash scripts/status.sh   # PID + HTTP + tool count

Tests

bash
pip install -r requirements-dev.txtpython -m pytest tests/test_smoke.py -v

2272 tests (1961 unit + 311 integration), 94.6% coverage, covering:

  • Server starts and answers ping
  • initialize returns correct capabilities + __version__
  • All 115 tools registered with valid inputSchema
  • vs_context_push degrades gracefully without Gateway
  • firm_export_document writes local file
  • Unknown method returns JSON-RPC error -32601
  • Unknown tool returns descriptive error
  • Timing-safe auth (I21), SQL injection guard (I24), session_id regex (I41)
  • ConfigPathInput traversal blocking across all 21 config-path models (I27)
  • Health/healthz endpoints return correct tool count + version (I35)
  • Shared config_helpers: load_config, get_nested, mask_secret (I25)
  • Hebbian memory: harvest PII stripping, weight update dry-run, layer validation, drift detection, Pydantic traversal guards

Security

  • Auth: timing-safe hmac.compare_digest on Bearer token — no timing side-channel (I21)
  • Request limit: client_max_size=2MB on aiohttp Application (I22)
  • Tool timeout: asyncio.wait_for with TOOL_TIMEOUT_S (default 120s) on all async tool calls (I23)
  • SQL injection guard: table_name validated by Pydantic regex ^[a-zA-Z_][a-zA-Z0-9_]{0,127}$ + runtime whitelist in handler (I24)
  • Session ID regex: ^[a-zA-Z0-9_\-:.]+$ on all session_id fields — no injection (I41)
  • Centralized version: __version__ in main.py — single source of truth (I37)
  • DRY helpers: config_helpers.py — shared load_config, get_nested, mask_secret (I25)
  • ConfigPathInput base: 21 models inherit traversal guard from single base class (I27)
  • Hebbian PII stripping: 9 regex patterns (email, phone, IP, API keys, SSN, JWT, AWS keys) applied before any session storage — CDC §5.2
  • Hebbian drift detection: TF-IDF cosine similarity vs baseline (no external API) — CDC §5.1
  • Hebbian weight caps: auto-update capped at 0.95, atrophy floor at 0.0, dry_run=True default — CDC §4.3
  • GitHub PRs always created as drafts with needs-review label
  • Tokens masked in logs (last 4 chars only) via mask_secret()
  • Context capped at 32 KB per WS payload
  • fleet.json and acp_sessions.json written atomically (os.replace)
  • Workspace lock via fcntl.LOCK_EX | LOCK_NB (advisory, crash-safe)
  • fleet_session_inject_env: allowlist regex — only known provider keys accepted
  • fleet_cron_schedule: command allowlist regex + blocklist (rm, dd, mkfs…)
  • Path traversal guard (..) on all file-path Pydantic fields
  • All AI outputs carry human-review disclaimer

Gap coverage (Firm audit)

IDSeverityDescriptionCoverage
C1CRITICALSQL injection in API endpointsfirm_security_scan
C2CRITICALSandbox disabled (mode: off)firm_sandbox_audit
C3CRITICALSESSION_SECRET ephemeral / in configfirm_session_config_check
C4CRITICALACP sessions lost on restart (in-memory)acp_session_persist/restore
H1HIGH@buape/carbon frozen at 0.0.0-betafirm_adr_generate + CTO SOUL.md
H2HIGHGateway Funnel without auth.mode=passwordfirm_gateway_auth_check
H3HIGHSpawned sessions get no env varsfleet_session_inject_env
H4HIGHCron not blocked in sandboxfleet_cron_schedule
H5HIGHRace condition on workspace lockfirm_workspace_lock
H6HIGHGateway silently drops on macOS sleepfirm_gateway_probe
H7HIGHWS close code 1006 not handledfirm_gateway_probe
H8HIGHNo rate limiting on Tailscale Funnelfirm_rate_limit_check
M1MEDIUM@line/bot-sdk zombie dependencyfirm_channel_audit
M2MEDIUMTest coverage threshold 70%factory 80% threshold + CTO SOUL.md
M3MEDIUMBaileys creds.json no integrity/age checkfirm_credentials_check
M4MEDIUMWebhook HMAC signature verification missingfirm_webhook_sig_check
M5MEDIUMDocs version stale vs package.jsonfirm_doc_sync_check
M6MEDIUMNo ADRs for architecture decisionsfirm_adr_generate
M7MEDIUMLogging verbose / no redactPatternsfirm_log_config_check
M8MEDIUM~/.firm/workspace integrity uncheckedfirm_workspace_integrity_check
C5CRITICALNode.js < 22.12.0 (CVE-2025-59466, CVE-2026-21636)firm_node_version_check
C6CRITICALHardcoded secrets in config.json (no secrets workflow)firm_secrets_workflow_check
H9HIGHHTTP security headers absent (HSTS, X-Content-Type-Options)firm_http_headers_check
H10HIGHgateway.nodes.allowCommands dangerous overridefirm_nodes_commands_check
H11HIGHTrusted-proxy misconfigured (bind+proxies+auth mode)firm_trusted_proxy_check
M15MEDIUMSession disk budget not configured (maxDiskBytes)firm_session_disk_budget_check
M16MEDIUMdmPolicy=allowlist with empty allowFrom (fail-open)firm_dm_allowlist_check
C7CRITICALExternal Secrets lifecycle not validated (inline creds)firm_secrets_lifecycle_check
C8CRITICALPlugin channel HTTP auth bypass (path canonicalization)firm_channel_auth_canon_check
C9CRITICALExec approval plan mutability (symlink cwd rebind)firm_exec_approval_freeze_check
H12HIGHHook session-key routing unrestrictedfirm_hook_session_routing_check
H13HIGHConfig $include hardlink escape + file-sizefirm_config_include_check
H14HIGHPrototype pollution in config mergefirm_config_prototype_check
H15HIGHSafeBins without explicit profile = unrestricted interpreterfirm_safe_bins_profile_check
H16HIGHGroup policy default not fail-closedfirm_group_policy_default_check
H17HIGHShell env not sanitized (LD_PRELOAD, DYLD_*)firm_shell_env_check
H18HIGHPlugin install integrity/pin not trackedfirm_plugin_integrity_check
H19HIGHhooks.token = gateway.auth.token (reuse)firm_token_separation_check
M17MEDIUMOTEL secret redaction missing in diagnosticsfirm_otel_redaction_check
M21MEDIUMControl-plane RPC rate limiting absentfirm_rpc_rate_limit_check
T1TOOLNo observability pipeline for JSONL tracesfirm_observability_pipeline
T3TOOLpgvector memory config uncheckedfirm_pgvector_memory_check
T4TOOLNo parallel agent orchestration (task DAG)firm_agent_team_orchestrate
T5TOOLNo i18n/localization auditfirm_i18n_audit
T6TOOLNo CI pipeline completeness checkfirm_ci_pipeline_check
T7TOOLSkills loaded eagerly (no lazy loading)firm_skill_lazy_loader + firm_skill_search
T8TOOLNo n8n workflow automation bridgefirm_n8n_workflow_export + firm_n8n_workflow_import
T9TOOLKnowledge graph integrity uncheckedfirm_knowledge_graph_check
T10TOOLBrowser automation config uncheckedfirm_browser_context_check

⚠️ Contenu généré par IA — validation humaine requise avant utilisation.

来源：README.md，提交 9c8f848

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v3.3.0最新Sep 16, 2026

评分

已满足适用检查项的 40%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。

其他 Openclaw 集成

OpenClaw Direct

direct.openclaw官方发布者

一个远程 MCP 端点，让助手用自然语言部署、监控和管理 OpenClaw AI 助手。

Streamable HTTP可网页运行鉴权
云端与基础设施需要凭据Oct 25, 2026

OpenClaw MCP Ecosystem

由 GitHub 账号 yedanyagamiai-cmd 发布

一个部署在 Cloudflare Workers 上的远程端点，宣称捆绑九个 MCP 服务器，涵盖安全扫描、知识图谱、合规、金融、记忆、分析等。

Streamable HTTP可网页运行
知识与记忆尚未收录Oct 27, 2026

Openclaw Upgrade Orchestrator Mcp

由 GitHub 账号 temurkhan13 发布

一个本地 MCP 服务器，用于 AI 运行时升级安全，通过快照对比和指纹检测供应商侧的回归问题。

STDIO仅桌面
开发者工具尚未验证Oct 24, 2026

Openclaw Skill Vetter Mcp

由 GitHub 账号 temurkhan13 发布

一个本地 MCP 服务器，让助手审查第三方 AI 代理扩展以及 AGENTS.md、.cursor/rules、CLAUDE.md 等代理配置文件。

STDIO仅桌面
开发者工具尚未验证Oct 24, 2026

Openclaw Output Vetter Mcp

由 GitHub 账号 temurkhan13 发布

本地 MCP 服务器，用于核对 AI 代理的说法是否属实，提供内联依据检查、异常吞没检测和对话记录审查。

STDIO仅桌面
AI 与机器学习尚未验证Oct 27, 2026