Mflow Memory

What to consider before installing: - Metadata mismatch: The registry claims no required env vars, but setup.sh/README require an LLM API key (LLM_API_KEY / OpenAI key). Expect to provide a secret; verify you are comfortable supplying it. - Docker image risk: setup.sh pulls and runs flowelement/m_flow-mcp:latest@sha256:... from Docker Hub. Verify the image name and digest, inspect the upstream repository (FlowElement) and release notes, or run the image in an isolated environment first. - Privacy implications: The agent is instructed to "silently" search and to save conversation content. Conversations (or parts of them) will be stored persistently in a Docker volume and processed by the MCP service which uses the provided LLM key to extract knowledge. Avoid providing highly sensitive secrets or PII unless you trust the image and have reviewed its behavior. - Configuration changes: setup.sh will create/modify ~/.openclaw/openclaw.json to register the MCP server. Back up that file before installing if you need to preserve custom config. - Mitigations: run the container on an isolated host or VM, review the container runtime (docker inspect, docker history) and network behavior, consider using a scoped API key with usage limits for the LLM provider, and confirm you can remove the volume with the provided teardown script if needed. If you want this skill but are uncomfortable: ask the publisher to update metadata to declare LLM_API_KEY as a required credential, provide a link to the official image source and reproducible build, or provide a signed/image manifest you can verify before running.