Lawmatics API MCP

MCP server for the Lawmatics legal CRM API. Exposes Lawmatics' REST API as read-only MCP tools.

Security Scan

The skill's declared binaries and single secret are plausible for an MCP adapter, but it omits any Lawmatics API credentials or install provenance and provides no code—this mismatch warrants caution.

Purpose & Capability

Name/description align with requiring an mcporter client and a lawmatics-mcp server binary. However, for a connector that exposes the Lawmatics REST API one would typically expect the skill to declare or request the Lawmatics API credentials (API key/token) or document where that config comes from. The single required env var (NODE_MCP_SECRET_KEY) looks like a local MCP secret, not the Lawmatics API credential.

Instruction Scope

SKILL.md only instructs using mcporter to list/call tools over stdio and references the npm package. It does not instruct reading unrelated files or system paths. The instructions are minimal/vague (no startup steps, no config guidance), which is reasonable for an instruction-only skill but leaves unanswered how the adapter authenticates to Lawmatics.

Install Mechanism

There is no install spec (instruction-only), so nothing would be written to disk by the skill itself. The SKILL.md links to an npm package, but the skill doesn't provide an install or provenance for the required binaries; the user/host must supply them.

Credentials

The skill requires NODE_MCP_SECRET_KEY (likely a local MCP auth secret) but does not request any Lawmatics API credentials (tokens/keys). A Lawmatics connector normally needs the CRM API key—its absence is unexpected and unexplained. Requiring a secret named NODE_MCP_SECRET_KEY without clarifying its scope or usage is also potentially sensitive.

Persistence & Privilege

Skill is not always:true and does not request any system config paths. Model invocation is allowed (the platform default), which is expected for skills. No evidence it attempts to modify other skills or global agent settings.

What to consider before installing

Before installing: verify the origin and code of the lawmatics-mcp binary (the SKILL.md links to an npm package—review that package and its publisher). Ask the skill author or vendor how the connector authenticates to Lawmatics (you should expect an API key/token) and why that credential is not declared. Treat NODE_MCP_SECRET_KEY as a sensitive secret—find out what it authenticates against. If you must run this, run the binary in an isolated environment, inspect network calls (to detect unexpected exfiltration), and prefer an install spec or source code you can audit. If you cannot verify where Lawmatics credentials are configured, consider this skill suspicious and do not provide production secrets to it.

Lawmatics MCP Server

Read-only MCP server for the Lawmatics legal CRM API.

Usage

Use mcporter to interact with this server via stdio:

• List available tools: mcporter list --stdio lawmatics-mcp
• Call a tool: mcporter call --stdio lawmatics-mcp <tool_name> [args]

Links

• npm: https://www.npmjs.com/package/@mjquinlan2000/lawmatics-mcp