Serpapi Mcp

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a coherent SerpAPI search wrapper with disclosed external API use and optional Airtable logging, but users should review the required API keys, global CLI dependency, and logging settings before installing.

Before installing, confirm you trust the mcporter CLI, configure only the SerpAPI and Airtable credentials you intend this skill to use, and leave SERP_LOG_AIRTABLE disabled unless you specifically want every search and full SerpAPI result stored in Airtable.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the wrong or compromised global CLI could affect how searches are executed.

Why it was flagged

The skill depends on a globally installed external CLI that is not pinned or represented in the install specification. This is central to the skill’s purpose, but users should verify the package source.

Skill content

Install:
- `npm install -g mcporter`

Recommendation

Install mcporter only from a trusted package source and consider pinning or documenting a known-good version.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The skill can act using the configured SerpAPI account and, if enabled, write records to the configured Airtable base/table.

Why it was flagged

The skill requires a SerpAPI key and can optionally use an Airtable personal access token. These credentials are expected for the stated services, but they are not declared in the registry metadata.

Skill content

- `SERPAPI_API_KEY`
- `SERPAPI_API_KEYS`
...
- `AIRTABLE_TOKEN` (Airtable Personal Access Token)

Recommendation

Use least-privilege API keys or tokens, configure them in the intended skill-scoped environment, and avoid granting Airtable access beyond the needed base/table.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Search terms and returned results may leave the local environment and, with logging enabled, remain stored in Airtable.

Why it was flagged

User queries are sent to SerpAPI’s MCP endpoint, and when logging is enabled the full query and response are stored in Airtable. This is disclosed and purpose-aligned, but it is an external data flow.

Skill content

Runs SerpAPI searches from OpenClaw via MCP (HTTP).
...
Optionally persists each query + response into **Airtable**:
  - raw JSON (full SerpAPI payload)

Recommendation

Do not use the skill for sensitive searches unless you are comfortable sending them to SerpAPI, and enable Airtable logging only when persistent storage is intended.