MCP OpenClaw Extensions

io.github.romainsantoli-web由 GitHub 帳號 romainsantoli-web 發布v3.3.0更新於 Oct 24, 2026

138-tool MCP server for AI agent firms: security, A2A, Hebbian memory, fleet mgmt

發布方自己的服務：OpenClaw Direct

已驗證STDIO僅桌面效率與工作流開發者工具安全與監控

概覽

AI 產生的概覽

在本機執行的 Python MCP 伺服器，提供 138 個工具，用來稽核、編排並匯出 AI 代理公司閘道、記憶與交付流程中的工作。

可以做什麼
在 VS Code 內容、工作階段與 Firm 閘道之間推送與拉取，並管理閘道叢集（狀態、新增移除、廣播、同步、列出）。執行安全與設定稽核，涵蓋沙箱、密鑰、驗證、HTTP 標頭、Webhook、外掛及 MCP 規範符合度。管理工作區鎖定、ACP 工作階段、排程工作與可靠性探測。採集、加權並分析 Hebbian 記憶，檢查知識圖譜與 pgvector 設定。編排代理任務 DAG，載入與搜尋技能，並將成果匯出為 GitHub PR、Jira、Linear、Slack 或本機 Markdown。產生市場、法律、選址與供應商研究報告。
適用情境
適合已部署 Firm Gateway 與 VS Code Copilot 代理、希望讓助理稽核其安全狀況、協調代理叢集與工作階段，或把結果轉成工單、PR 與報告的情境。不適用於該生態之外的通用程式開發或資料工作。
執行需求
以本機 Python 程序執行（stdio 傳輸，同時監聽 8012 埠）；需以 pip 安裝相依套件，並在啟動前於 .env 檔填入權杖。預期已有 Firm Gateway 生態與 VS Code 設定。清單未宣告任何憑證。
安裝前請注意
多個工具會寫入或傳送資料：GitHub 草稿 PR、Jira 與 Linear 工單、Slack 摘要、本機檔案、叢集設定同步、排程工作與 A2A 任務。它會讀取設定與憑證檔案以進行稽核，README 稱日誌中的權杖會被遮蔽。AI 生成內容標註需人工複核。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 MCP OpenClaw Extensions，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

firm-mcp-server

Python MCP server (port 8012) that bridges VS Code Copilot agents to the [Firm](https://github.com/the server) Gateway ecosystem. Companion to setup-vs-agent-firm.

Tools (138)

ModuleToolDescriptionGaps
vs_bridgevs_context_pushPush VS Code context → Firm session—
vs_bridgevs_context_pullPull Firm session state → VS Code—
vs_bridgevs_session_linkAssociate workspace path ↔ session ID—
vs_bridgevs_session_statusBridge health check—
gateway_fleetfirm_gateway_fleet_statusParallel health-check all instances—
gateway_fleetfirm_gateway_fleet_addRegister a Gateway instance—
gateway_fleetfirm_gateway_fleet_removeRemove a Gateway instance—
gateway_fleetfirm_gateway_fleet_broadcastBroadcast to all instances—
gateway_fleetfirm_gateway_fleet_syncSync config+skills to all instances—
gateway_fleetfirm_gateway_fleet_listList instances—
delivery_exportfirm_export_github_prCreate draft PR on GitHub—
delivery_exportfirm_export_jira_ticketCreate Jira ticket (ADF)—
delivery_exportfirm_export_linear_issueCreate Linear issue (GraphQL)—
delivery_exportfirm_export_slack_digestPost Slack digest (Block Kit)—
delivery_exportfirm_export_documentWrite local Markdown deliverable—
delivery_exportfirm_export_autoAuto-route by delivery_format—
security_auditfirm_security_scanScan files for SQL injection + XSS patternsC1
security_auditfirm_sandbox_auditDetect sandbox.mode: off → CRITICALC2
security_auditfirm_session_config_checkDetect ephemeral SESSION_SECRET in .env/composeC3
security_auditfirm_rate_limit_checkDetect Funnel without rate limiter → CRITICALH8
acp_bridgeacp_session_persistPersist ACP session to ~/.firm/acp_sessions.jsonC4
acp_bridgeacp_session_restoreRestore persisted ACP session by run_idC4
acp_bridgeacp_session_list_activeList ACP sessions active in last N hoursC4
acp_bridgefleet_session_inject_envInject env vars to spawned sessions (allowlist)H3
acp_bridgefleet_cron_scheduleSchedule cron with sandbox enforcementH4
acp_bridgefirm_workspace_lockAdvisory file lock with owner tracking (fcntl)H5
acp_bridgefirm_acpx_version_checkACPX plugin version pin (≥0.1.15) + streaming mode check3.1
reliability_probefirm_gateway_probeWS probe with backoff — detects close 1006, returns launchctlH6/H7
reliability_probefirm_doc_sync_checkDetect version drift in docs vs package.jsonM5
reliability_probefirm_channel_auditDetect zombie channel SDK deps (LINE, Baileys…)M1
reliability_probefirm_adr_generateGenerate MADR + commit path for architecture decisionsM6
gateway_hardeningfirm_gateway_auth_checkVerify Gateway auth config — CRITICAL if Funnel without passwordH2
gateway_hardeningfirm_credentials_checkCheck Baileys/channel credential integrity and freshnessM3
gateway_hardeningfirm_webhook_sig_checkVerify HMAC signing secrets for all inbound webhook channelsM4
gateway_hardeningfirm_log_config_checkDetect debug/trace logging and missing redactPatternsM7
gateway_hardeningfirm_workspace_integrity_checkValidate ~/.firm/workspace (AGENTS.md, SOUL.md, staleness)M8
runtime_auditfirm_node_version_checkVerify Node.js ≥ 22.12.0 (CVE-2025-59466, CVE-2026-21636)C5
runtime_auditfirm_secrets_workflow_checkDetect hardcoded secrets in config.json (migrate to firm secrets)C6
runtime_auditfirm_http_headers_checkVerify HTTP security headers (HSTS, X-Content-Type-Options, Referrer-Policy)H9
runtime_auditfirm_nodes_commands_checkDetect dangerous gateway.nodes.allowCommands overrideH10
runtime_auditfirm_trusted_proxy_checkVerify trusted-proxy config coherence (bind + trustedProxies + auth mode)H11
runtime_auditfirm_session_disk_budget_checkVerify session.maintenance.maxDiskBytes / highWaterBytes configuredM15
runtime_auditfirm_dm_allowlist_checkDetect dmPolicy=allowlist with empty allowFrom (fail-closed) across 9 channelsM16
advanced_securityfirm_secrets_lifecycle_checkVerify External Secrets lifecycle (audit/configure/apply/reload)C7
advanced_securityfirm_channel_auth_canon_checkVerify channel auth path canonicalization (encoded traversal)C8
advanced_securityfirm_exec_approval_freeze_checkVerify exec approval plan immutability (symlink cwd rebind)C9
advanced_securityfirm_hook_session_routing_checkVerify hook session-key routing hardeningH12
advanced_securityfirm_config_include_checkVerify $include hardlink escape + file-size guardrailsH13
advanced_securityfirm_config_prototype_checkDetect prototype pollution (proto, constructor, prototype) in configH14
advanced_securityfirm_safe_bins_profile_checkVerify safeBins entries have explicit profilesH15
advanced_securityfirm_group_policy_default_checkVerify group policy default is fail-closed (allowlist)H16
config_migrationfirm_shell_env_checkVerify shell env sanitization (LD_PRELOAD, DYLD_*, ZDOTDIR)H17
config_migrationfirm_plugin_integrity_checkVerify plugin install integrity/pin + drift detectionH18
config_migrationfirm_token_separation_checkVerify hooks.token ≠ gateway.auth.tokenH19
config_migrationfirm_otel_redaction_checkVerify OTEL secret redaction in diagnostics exportM17
config_migrationfirm_rpc_rate_limit_checkVerify control-plane RPC rate limiting configM21
observabilityfirm_observability_pipelineIngest JSONL traces into SQLite for offline analysisT1
observabilityfirm_ci_pipeline_checkValidate CI workflow completeness (lint, test, secrets)T6
memory_auditfirm_pgvector_memory_checkVerify pgvector config (HNSW index, dimensions, distance metrics)T3
memory_auditfirm_knowledge_graph_checkAudit knowledge graph integrity (orphan nodes, cycles, TTL)T9
agent_orchestrationfirm_agent_team_orchestrateTask DAG execution with topological sort + parallel layersT4
agent_orchestrationfirm_agent_team_statusCheck orchestration status by ID or list allT4
i18n_auditfirm_i18n_auditScan locale files for missing keys, empty values, interpolation mismatchesT5
skill_loaderfirm_skill_lazy_loaderLazy-load SKILL.md metadata (YAML front-matter, 5min cache)T7
skill_loaderfirm_skill_searchKeyword/tag search across cached skills with relevance scoringT7
n8n_bridgefirm_n8n_workflow_exportExport agent pipeline as n8n-compatible workflow JSONT8
n8n_bridgefirm_n8n_workflow_importValidate & import n8n workflow JSON into workspaceT8
browser_auditfirm_browser_context_checkValidate Playwright/Puppeteer headless config for agentsT10
hebbian_memoryfirm_hebbian_harvestIngest JSONL session logs → SQLite (PII stripped) — CDC §4.1—
hebbian_memoryfirm_hebbian_weight_updateCompute/apply Hebbian weight updates on Layer 2 — CDC §4.3—
hebbian_memoryfirm_hebbian_analyzeCo-activation pattern analysis (Jaccard similarity) — CDC §4.3—
hebbian_memoryfirm_hebbian_statusDashboard: weights, atrophy, promotions — CDC §7—
hebbian_memoryfirm_hebbian_layer_validateValidate 4-layer Claude.md structure — CDC §3.3—
hebbian_memoryfirm_hebbian_pii_checkAudit PII stripping config — CDC §5.2—
hebbian_memoryfirm_hebbian_decay_config_checkValidate learning rate, decay, thresholds — CDC §4.3—
hebbian_memoryfirm_hebbian_drift_checkCosine similarity drift detection vs baseline — CDC §5.1—
a2a_bridgefirm_a2a_card_generateGenerate agent-card.json from SOUL.md (RC v1.0)G1
a2a_bridgefirm_a2a_card_validateValidate A2A Agent Card against RC v1.0 specG2
a2a_bridgefirm_a2a_task_sendSend message/task to an A2A agent (SendMessage)G3
a2a_bridgefirm_a2a_task_statusGet task status or list tasks (RC v1.0)G4
a2a_bridgefirm_a2a_cancel_taskCancel a running A2A task (CancelTask)G5
a2a_bridgefirm_a2a_subscribe_taskSubscribe to task updates via SSEG6
a2a_bridgefirm_a2a_push_configCRUD for push notification webhooks (RC v1.0)G7
a2a_bridgefirm_a2a_discoveryDiscover agents via Agent Cards or SOUL.md scanG8
platform_auditfirm_secrets_v2_auditAudit Firm secrets v2 lifecycle (2026.2+)G9
platform_auditfirm_agent_routing_checkValidate agent routing bindingsG10
platform_auditfirm_voice_security_checkTTS/voice channel security auditG11
platform_auditfirm_trust_model_checkValidate trust model and multi-user heuristicsG12
platform_auditfirm_autoupdate_checkSelf-update supply chain integrity checkG13
platform_auditfirm_plugin_sdk_checkPlugin SDK integrity validationG14
platform_auditfirm_content_boundary_checkContent boundary & anti-prompt-injection auditG15
platform_auditfirm_sqlite_vec_checkSQLite-vec memory backend validationG16
platform_auditfirm_adaptive_thinking_checkClaude 4.6 adaptive thinking configuration check3.1
ecosystem_auditfirm_mcp_firewall_checkMCP Gateway firewall policy auditG17
ecosystem_auditfirm_rag_pipeline_checkRAG pipeline health & config auditG18
ecosystem_auditfirm_sandbox_exec_checkSandbox execution isolation auditG19
ecosystem_auditfirm_context_health_checkContext rot / cognitive health detectionG20
ecosystem_auditfirm_provenance_trackerCryptographic audit trail / provenance trackingG21
ecosystem_auditfirm_cost_analyticsUsage/cost tracking and analysisG22
ecosystem_auditfirm_token_budget_optimizerToken optimization analysisG23
spec_compliancefirm_elicitation_auditAudit MCP elicitation capability complianceS4
spec_compliancefirm_tasks_auditAudit MCP Tasks capability complianceS5
spec_compliancefirm_resources_prompts_auditAudit MCP Resources & Prompts complianceS6
spec_compliancefirm_audio_content_auditAudit MCP audio content supportH3
spec_compliancefirm_json_schema_dialect_checkAudit JSON Schema dialect complianceH5
spec_compliancefirm_sse_transport_auditAudit Streamable HTTP / SSE transportH6
spec_compliancefirm_icon_metadata_auditAudit icon metadata supportH7
prompt_securityfirm_prompt_injection_checkScan text for 16 injection/jailbreak patternsH2
prompt_securityfirm_prompt_injection_batchBatch scan multiple texts for injection patternsH2
auth_compliancefirm_oauth_oidc_auditAudit OAuth 2.1 / OIDC Discovery complianceH4
auth_compliancefirm_token_scope_checkCheck OAuth scopes restrict tool access properlyH4
compliance_mediumfirm_tool_deprecation_auditAudit tool deprecation lifecycleM1
compliance_mediumfirm_circuit_breaker_auditAudit circuit breaker / resilience configM2
compliance_mediumfirm_gdpr_residency_auditAudit GDPR compliance and data residencyM3
compliance_mediumfirm_agent_identity_auditAudit agent DID (decentralized identity)M4
compliance_mediumfirm_model_routing_auditAudit multi-model routing and fallback chainM5
compliance_mediumfirm_resource_links_auditAudit MCP resource links in tool resultsM6
market_researchfirm_market_competitive_analysisFull competitive landscape analysis (feature matrix, SWOT, positioning)—
market_researchfirm_market_sizingTAM/SAM/SOM market sizing (top-down + bottom-up)—
market_researchfirm_market_financial_benchmarkFinancial benchmarking — unit economics, pricing, revenue—
market_researchfirm_market_web_researchStructured web research & OSINT intelligence gathering—
market_researchfirm_market_report_generateProfessional Markdown market research report generator—
market_researchfirm_market_research_monitorContinuous competitive monitoring (add/remove/update/status)—
legal_statusfirm_legal_status_compareCompare legal forms (SAS, SARL, EURL…) on multi-criteria grid—
legal_statusfirm_legal_tax_simulateSimulate IS/IR tax burden per legal form—
legal_statusfirm_legal_social_protectionAnalyze social protection by dirigeant status—
legal_statusfirm_legal_governance_auditAudit governance clauses & shareholder pacts—
legal_statusfirm_legal_creation_checklistStep-by-step company creation checklist—
location_strategyfirm_location_geo_analysisGeo-economic attractiveness analysis by zone—
location_strategyfirm_location_real_estateReal estate market scan (buy/rent/coworking)—
location_strategyfirm_location_site_scoreMulti-criteria site scoring (20 criteria)—
location_strategyfirm_location_incentivesMap tax incentives & public aids by zone—
location_strategyfirm_location_tco_simulateTotal cost of occupancy simulation over N years—
supplier_managementfirm_supplier_searchSearch & filter suppliers by category/region/certification—
supplier_managementfirm_supplier_evaluateMulti-criteria supplier evaluation (15 criteria)—
supplier_managementfirm_supplier_tco_analyzeSupplier TCO analysis (direct + indirect + hidden costs)—
supplier_managementfirm_supplier_contract_checkContract clause compliance audit (14 mandatory clauses)—
supplier_managementfirm_supplier_risk_monitorSupplier risk monitoring (add/remove/update/status)—

Quick start

bash
python3 -m venv .venv && source .venv/bin/activatepip install -r requirements.txtcp .env.example .env   # fill in tokensbash scripts/start.sh

Add to VS Code settings.json:

json
"mcp.servers": {  "firm-extensions": { "url": "http://127.0.0.1:8012/mcp" }}

Scripts

bash
bash scripts/start.sh    # start in backgroundbash scripts/stop.sh     # graceful stopbash scripts/status.sh   # PID + HTTP + tool count

Tests

bash
pip install -r requirements-dev.txtpython -m pytest tests/test_smoke.py -v

2272 tests (1961 unit + 311 integration), 94.6% coverage, covering:

  • Server starts and answers ping
  • initialize returns correct capabilities + __version__
  • All 115 tools registered with valid inputSchema
  • vs_context_push degrades gracefully without Gateway
  • firm_export_document writes local file
  • Unknown method returns JSON-RPC error -32601
  • Unknown tool returns descriptive error
  • Timing-safe auth (I21), SQL injection guard (I24), session_id regex (I41)
  • ConfigPathInput traversal blocking across all 21 config-path models (I27)
  • Health/healthz endpoints return correct tool count + version (I35)
  • Shared config_helpers: load_config, get_nested, mask_secret (I25)
  • Hebbian memory: harvest PII stripping, weight update dry-run, layer validation, drift detection, Pydantic traversal guards

Security

  • Auth: timing-safe hmac.compare_digest on Bearer token — no timing side-channel (I21)
  • Request limit: client_max_size=2MB on aiohttp Application (I22)
  • Tool timeout: asyncio.wait_for with TOOL_TIMEOUT_S (default 120s) on all async tool calls (I23)
  • SQL injection guard: table_name validated by Pydantic regex ^[a-zA-Z_][a-zA-Z0-9_]{0,127}$ + runtime whitelist in handler (I24)
  • Session ID regex: ^[a-zA-Z0-9_\-:.]+$ on all session_id fields — no injection (I41)
  • Centralized version: __version__ in main.py — single source of truth (I37)
  • DRY helpers: config_helpers.py — shared load_config, get_nested, mask_secret (I25)
  • ConfigPathInput base: 21 models inherit traversal guard from single base class (I27)
  • Hebbian PII stripping: 9 regex patterns (email, phone, IP, API keys, SSN, JWT, AWS keys) applied before any session storage — CDC §5.2
  • Hebbian drift detection: TF-IDF cosine similarity vs baseline (no external API) — CDC §5.1
  • Hebbian weight caps: auto-update capped at 0.95, atrophy floor at 0.0, dry_run=True default — CDC §4.3
  • GitHub PRs always created as drafts with needs-review label
  • Tokens masked in logs (last 4 chars only) via mask_secret()
  • Context capped at 32 KB per WS payload
  • fleet.json and acp_sessions.json written atomically (os.replace)
  • Workspace lock via fcntl.LOCK_EX | LOCK_NB (advisory, crash-safe)
  • fleet_session_inject_env: allowlist regex — only known provider keys accepted
  • fleet_cron_schedule: command allowlist regex + blocklist (rm, dd, mkfs…)
  • Path traversal guard (..) on all file-path Pydantic fields
  • All AI outputs carry human-review disclaimer

Gap coverage (Firm audit)

IDSeverityDescriptionCoverage
C1CRITICALSQL injection in API endpointsfirm_security_scan
C2CRITICALSandbox disabled (mode: off)firm_sandbox_audit
C3CRITICALSESSION_SECRET ephemeral / in configfirm_session_config_check
C4CRITICALACP sessions lost on restart (in-memory)acp_session_persist/restore
H1HIGH@buape/carbon frozen at 0.0.0-betafirm_adr_generate + CTO SOUL.md
H2HIGHGateway Funnel without auth.mode=passwordfirm_gateway_auth_check
H3HIGHSpawned sessions get no env varsfleet_session_inject_env
H4HIGHCron not blocked in sandboxfleet_cron_schedule
H5HIGHRace condition on workspace lockfirm_workspace_lock
H6HIGHGateway silently drops on macOS sleepfirm_gateway_probe
H7HIGHWS close code 1006 not handledfirm_gateway_probe
H8HIGHNo rate limiting on Tailscale Funnelfirm_rate_limit_check
M1MEDIUM@line/bot-sdk zombie dependencyfirm_channel_audit
M2MEDIUMTest coverage threshold 70%factory 80% threshold + CTO SOUL.md
M3MEDIUMBaileys creds.json no integrity/age checkfirm_credentials_check
M4MEDIUMWebhook HMAC signature verification missingfirm_webhook_sig_check
M5MEDIUMDocs version stale vs package.jsonfirm_doc_sync_check
M6MEDIUMNo ADRs for architecture decisionsfirm_adr_generate
M7MEDIUMLogging verbose / no redactPatternsfirm_log_config_check
M8MEDIUM~/.firm/workspace integrity uncheckedfirm_workspace_integrity_check
C5CRITICALNode.js < 22.12.0 (CVE-2025-59466, CVE-2026-21636)firm_node_version_check
C6CRITICALHardcoded secrets in config.json (no secrets workflow)firm_secrets_workflow_check
H9HIGHHTTP security headers absent (HSTS, X-Content-Type-Options)firm_http_headers_check
H10HIGHgateway.nodes.allowCommands dangerous overridefirm_nodes_commands_check
H11HIGHTrusted-proxy misconfigured (bind+proxies+auth mode)firm_trusted_proxy_check
M15MEDIUMSession disk budget not configured (maxDiskBytes)firm_session_disk_budget_check
M16MEDIUMdmPolicy=allowlist with empty allowFrom (fail-open)firm_dm_allowlist_check
C7CRITICALExternal Secrets lifecycle not validated (inline creds)firm_secrets_lifecycle_check
C8CRITICALPlugin channel HTTP auth bypass (path canonicalization)firm_channel_auth_canon_check
C9CRITICALExec approval plan mutability (symlink cwd rebind)firm_exec_approval_freeze_check
H12HIGHHook session-key routing unrestrictedfirm_hook_session_routing_check
H13HIGHConfig $include hardlink escape + file-sizefirm_config_include_check
H14HIGHPrototype pollution in config mergefirm_config_prototype_check
H15HIGHSafeBins without explicit profile = unrestricted interpreterfirm_safe_bins_profile_check
H16HIGHGroup policy default not fail-closedfirm_group_policy_default_check
H17HIGHShell env not sanitized (LD_PRELOAD, DYLD_*)firm_shell_env_check
H18HIGHPlugin install integrity/pin not trackedfirm_plugin_integrity_check
H19HIGHhooks.token = gateway.auth.token (reuse)firm_token_separation_check
M17MEDIUMOTEL secret redaction missing in diagnosticsfirm_otel_redaction_check
M21MEDIUMControl-plane RPC rate limiting absentfirm_rpc_rate_limit_check
T1TOOLNo observability pipeline for JSONL tracesfirm_observability_pipeline
T3TOOLpgvector memory config uncheckedfirm_pgvector_memory_check
T4TOOLNo parallel agent orchestration (task DAG)firm_agent_team_orchestrate
T5TOOLNo i18n/localization auditfirm_i18n_audit
T6TOOLNo CI pipeline completeness checkfirm_ci_pipeline_check
T7TOOLSkills loaded eagerly (no lazy loading)firm_skill_lazy_loader + firm_skill_search
T8TOOLNo n8n workflow automation bridgefirm_n8n_workflow_export + firm_n8n_workflow_import
T9TOOLKnowledge graph integrity uncheckedfirm_knowledge_graph_check
T10TOOLBrowser automation config uncheckedfirm_browser_context_check

⚠️ Contenu généré par IA — validation humaine requise avant utilisation.

來源：README.md，提交 9c8f848

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v3.3.0最新Sep 16, 2026

評分

已滿足適用檢查項的 40%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。

其他 Openclaw 整合

OpenClaw Direct

direct.openclaw官方發布者

一個遠端 MCP 端點，讓助理用自然語言部署、監控與管理 OpenClaw AI 助理。

Streamable HTTP可網頁執行驗證方式
雲端與基礎設施需要憑證Oct 25, 2026

OpenClaw MCP Ecosystem

由 GitHub 帳號 yedanyagamiai-cmd 發布

一個部署在 Cloudflare Workers 上的遠端端點，宣稱捆綁九個 MCP 伺服器，涵蓋安全掃描、知識圖譜、合規、金融、記憶、分析等。

Streamable HTTP可網頁執行
知識與記憶尚未收錄Oct 27, 2026

Openclaw Upgrade Orchestrator Mcp

由 GitHub 帳號 temurkhan13 發布

一個本機 MCP 伺服器，用於 AI 執行環境升級安全，透過快照比對與指紋偵測供應商端的回歸問題。

STDIO僅桌面
開發者工具尚未驗證Oct 24, 2026

Openclaw Skill Vetter Mcp

由 GitHub 帳號 temurkhan13 發布

一個本機 MCP 伺服器，讓助理審查第三方 AI 代理擴充套件，以及 AGENTS.md、.cursor/rules、CLAUDE.md 等代理設定檔。

STDIO僅桌面
開發者工具尚未驗證Oct 24, 2026

Openclaw Output Vetter Mcp

由 GitHub 帳號 temurkhan13 發布

本機 MCP 伺服器，用來核對 AI 代理的說法是否屬實，提供內嵌依據檢查、例外被吞掉偵測與對話紀錄審查。

STDIO僅桌面
AI 與機器學習尚未驗證Oct 27, 2026