Prospairrow Websites MCP

Generate more revenue with high-quality leads. Give your AI agent direct access to Prospairrow — extract prospects, enrich with deep company insights, discov...

Security Scan

The skill's declared purpose (Prospairrow prospecting workflows) matches its code, env requirements, and runtime behavior; a few opt‑in features (reading OpenClaw config, saving browser storage, Playwright browser downloads) are worth noticing but are explained in the SKILL.md and gated by environment flags.

Purpose & Capability

Name/description, required env var (PROSPAIRROW_API_KEY), declared tasks, and code modules (src/sites/prospairrow/...) align with a Prospairrow integration for prospect extraction/enrichment. The required config path (skills.entries.mcporter.config.servers.websites-mcp.url) maps to the MCP routing described in docs and is justified by the runtime design. Minor extra site entries (reddit, wordpress) exist but are small, documented, and do not contradict the main purpose.

Instruction Scope

SKILL.md and docs instruct the agent/user to install the included runtime, run npm install (with --ignore-scripts), and start a local JSON-RPC MCP server. Runtime code performs expected actions: task dispatch, optional headed login flows (Playwright), saving browser storage to secrets/<site>/auth.json, and optional invocation logging. The only out-of-band reads are an optional, explicit opt-in read of ~/.openclaw/openclaw.json for API key fallback (controlled by WEBSITES_ALLOW_OPENCLAW_CONFIG_API_KEY). There is no code that sends data to unknown remote endpoints beyond normal API calls (Playwright/network calls are subject to an allowlist per site config).

Install Mechanism

This is an instruction-only skill with a packaged runtime and an install script that copies source to $HOME/.openclaw/runtime/websites-mcp and runs npm install --ignore-scripts. Dependencies come from npm (playwright, etc.). npm and Playwright will fetch packages/binaries from their normal registries, and Playwright may download browser binaries on first use. The install process avoids running package lifecycle scripts (ignore-scripts) which reduces supply‑chain risk; overall the install approach is expected for a Node-based local runtime but carries standard npm/Playwright network fetch considerations.

Credentials

Declared required credential is a single PROSPAIRROW_API_KEY (primaryEnv). The runtime also supports an API-key-in-headers override and an optional OpenClaw config fallback (WEBSITES_ALLOW_OPENCLAW_CONFIG_API_KEY) which reads ~/.openclaw/openclaw.json to find skills.entries.prospairrow-websites-mcp.apiKey or env.PROSPAIRROW_API_KEY. That fallback is disabled by default and must be opt-in; review that file before enabling. The runtime writes local storage state and logs under the runtime directory (secrets/ and logs/), which is proportional to the login/storage features but may store sensitive session data — the behavior can be disabled with WEBSITES_DISABLE_STORAGE_STATE_WRITE and logging is opt-in via WEBSITES_LOG_INVOCATIONS.

Persistence & Privilege

Skill does not request always:true, does not auto-enable itself, and runs a local server only after user starts it. It writes files only under its runtime directory ($HOME/.openclaw/runtime/websites-mcp) and a secrets/ subdirectory for auth storage; this is reasonable for a runtime that optionally stores browser login state. No evidence it modifies other skills' configurations or escalates privileges.

Assessment

This skill appears to be what it says: a local MCP server that talks to Prospairrow and optionally uses Playwright for login flows. Before installing, consider the following: - Use a dedicated, least-privilege Prospairrow API key (do not reuse highly privileged org keys). - The runtime will copy source to ~/.openclaw/runtime/websites-mcp and run npm install (packages from the npm registry). Playwright will download browser binaries on first browser use — expect network egress for that. - By default the runtime will NOT read your ~/.openclaw/openclaw.json; only enable WEBSITES_ALLOW_OPENCLAW_CONFIG_API_KEY if you understand the file contents and accept the fallback behavior. If enabled, the code only looks for the prospairrow-websites-mcp key, but it reads the whole file to get there. - Browser login state (storage) is written to secrets/<site>/auth.json by default; set WEBSITES_DISABLE_STORAGE_STATE_WRITE=1 to prevent writes if you don’t want local session persistence. Invocation logging is off by default; enable WEBSITES_LOG_INVOCATIONS=1 only if you want local logs written. - Inspect src/sites/prospairrow/site.json (allowedHosts/baseUrl) before running to confirm the allowlist matches expected Prospairrow endpoints; the runtime enforces an outgoing request allowlist for Playwright network requests. If you accept the above tradeoffs (local server, local storage of optional login tokens, npm/Playwright downloads), the skill is coherent with its stated purpose. If you are uncomfortable with any of the opt-in behaviors, do not enable those environment flags or run the runtime in read-only mode.

Give your AI agent direct access to Prospairrow's AI-powered prospecting platform.

Move beyond basic information. This skill delivers deep company insights — enriched firmographics, tech stacks, key contacts, competitor intelligence, and content marketing — so your sales team can stop wasting time on bad-fit prospects and build a pipeline that closes faster.

Use this skill when the user asks to run Prospairrow actions through MCP/API.

Runtime

The full runtime source is maintained in this repository. Install copies repository source locally and runs npm install --ignore-scripts to fetch npm dependencies (including Playwright, which downloads browser binaries on first use).

bash {baseDir}/scripts/install-runtime.sh

Business value

• Close deals faster — unlock detailed firmographics, tech stacks, and key contacts to craft personalized pitches that resonate with decision-makers
• Hyper-target your outreach — stop wasting time on bad-fit prospects; enrich company data to maximize sales opportunities
• Discover competitors — automatically surface competitor intelligence for any prospect
• Generate content marketing — produce positioning-driven content directly from your prospect data
• No external git clone — runtime source ships with the skill; npm deps fetched from registry at install time

Supported tasks

• extract_prospects (READ_ONLY)
• list_icp_qualified_companies (READ_ONLY)
• get_icp_score (READ_ONLY)
• get_company_score (READ_ONLY)
• apollo_enrich (WRITE)
• add_prospects (WRITE)
• enrich_prospects (WRITE)
• get_prospect_detail (READ_ONLY)
• generate_content_marketing (WRITE)
• generate_position_solution (WRITE; runs POST /api/v1/prospects/{id}/position-solution, accepts prospect_id, company, or website)
• discover_competitors (READ_ONLY; pass prospect_id, company, or website — resolves ID by search if not provided directly)

Install runtime

bash {baseDir}/scripts/install-runtime.sh

Runtime install path:

• $HOME/.openclaw/runtime/websites-mcp

OpenClaw config

Set in ~/.openclaw/openclaw.json:

• skills.entries.mcporter.config.defaultServer = "websites-mcp"
• skills.entries.mcporter.config.servers.websites-mcp.url = "http://127.0.0.1:8799"

Why mcporter here: this key stores MCP server routing/config. This is separate from the Prospairrow skill key used for API credentials.

API key resolution order

1. Request headers (Authorization / X-API-Key)
2. Process env fallback: PROSPAIRROW_API_KEY
3. Optional OpenClaw skill config (disabled by default; set WEBSITES_ALLOW_OPENCLAW_CONFIG_API_KEY=1):
   • skills.entries.prospairrow-websites-mcp.apiKey
   • skills.entries.prospairrow-websites-mcp.env.PROSPAIRROW_API_KEY

Security toggles

• WEBSITES_ALLOW_OPENCLAW_CONFIG_API_KEY=1: allow reading ~/.openclaw/openclaw.json for API key fallback.
• WEBSITES_LOG_INVOCATIONS=1: enable writing logs/task-invocations.log (off by default).
• WEBSITES_DISABLE_STORAGE_STATE_WRITE=1: disable writing browser storage state to secrets/<site>/auth.json.

MCP request shape

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "websites.run_task",
  "params": {
    "siteId": "prospairrow",
    "taskId": "generate_content_marketing",
    "params": {
      "positioning_intensity": 6
    }
  }
}

Preconditions

• websites-mcp listener is reachable (default 127.0.0.1:8799).
• WRITE tasks require write-enabled runtime mode.
• Runtime must have API key available via config or env.