Stashdog
PassAudited by ClawScan on May 10, 2026.
Overview
This appears to be a straightforward StashDog MCP connector, but users should notice that it uses OAuth, talks to a remote server, and can modify or delete inventory items.
Install only if you intend to connect your StashDog account to this remote MCP server. Confirm any add, edit, or delete actions before they run, and consider pinning or otherwise vetting the `mcp-remote` package used through `npx`.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
You may be granting access to your StashDog inventory account through the OAuth flow.
The skill requires delegated OAuth access to use the StashDog MCP server, which is expected for this integration but gives the connected service account-level authority.
- **Auth:** OAuth (via `mcp-remote` proxy)
Only authorize the connection if you trust the StashDog server and review/revoke the OAuth grant if you stop using the skill.
If invoked, the agent can add, edit, or delete StashDog inventory items.
The exposed MCP tools include mutation and deletion of inventory records. This is purpose-aligned, but users should be aware these actions can change account data.
- **Tools:** `list_items`, `search_items`, `get_item`, `add_item`, `edit_item`, `delete_item`
Use explicit confirmation for edits and deletions, and verify item IDs before destructive actions.
Your MCP client may run externally sourced package code to connect to the remote server.
The recommended MCP setup runs `mcp-remote` through `npx -y`, which may fetch and execute an npm package without pinning a specific version.
"command": "npx", "args": ["-y", "mcp-remote", "https://gmchczeyburroiyzefie.supabase.co/functions/v1/mcp-server/mcp"]
Prefer a trusted, pinned version of `mcp-remote` where possible and use a normal package-management review process.
Inventory data you query or modify may be sent to and processed by the remote StashDog MCP server.
The skill sends MCP requests to a disclosed remote HTTPS endpoint. This is central to the skill, but inventory queries and item data will be handled by that service.
- **Endpoint:** `https://gmchczeyburroiyzefie.supabase.co/functions/v1/mcp-server/mcp`
Avoid sending sensitive inventory details unless you trust the endpoint and understand the service’s data handling.