阿里云云效mcp对接

Use when needing to query or update Yunxiao work items, comments, projects, or organization members from OpenClaw.

Security Scan

The skill's code and docs largely match its Yunxiao integration purpose, but there are inconsistencies (missing declared env requirement) and runtime behaviors (dynamic npx install + child process inherits full environment) that merit caution before installing.

Purpose & Capability

The name, README, SKILL.md and scripts all implement a Yunxiao (云效) MCP CLI that queries/updates work items, comments, projects and members — this matches the described purpose. However the registry metadata reported "Required env vars: none" while SKILL.md and the code require YUNXIAO_ACCESS_TOKEN (and optionally YUNXIAO_ORG_ID). That metadata omission is an incoherence that should be corrected/clarified.

Instruction Scope

SKILL.md instructions restrict activity to Yunxiao operations and recommend storing org-specific mappings locally. The runtime instructions and CLI commands in scripts perform only API calls via the alibabacloud-devops-mcp-server. There is no instruction to read unrelated system files. Note: SKILL.md references optional local files (~/.cursor/mcp.json and AGENTS.md) for configuration—these are local-only suggestions, not required remote calls.

Install Mechanism

There is no formal install spec, but the code spawns `npx -y alibabacloud-devops-mcp-server` at runtime. That means the skill will dynamically download and run an npm package (un-pinned) when used. Dynamic installs from npm at runtime increase risk compared with a bundled/pinned dependency because the fetched code could change between runs and execute arbitrary code on the host.

Credentials

The only required secret for the skill's stated purpose is a Yunxiao access token (YUNXIAO_ACCESS_TOKEN), which is proportionate. However: (1) the registry metadata does not declare this required env var (inconsistent), and (2) when the skill spawns the MCP server it passes a copy of the entire process.env (env: { ...process.env, YUNXIAO_ACCESS_TOKEN: ACCESS_TOKEN }). That means any other environment variables (other credentials/secrets present in the agent runtime) will be available to the child process (the npx-installed package), creating a potential for unintended secret exposure.

Persistence & Privilege

The skill does not request always:true, does not modify other skills' configs, and has no explicit install spec that writes system-wide files. The main persistent behavior is that npx may cache the downloaded npm package locally; otherwise the skill does not request elevated or permanent platform privileges.

What to consider before installing

This skill appears to implement a legitimate Yunxiao integration, but take these precautions before installing or running it: - Expect to provide YUNXIAO_ACCESS_TOKEN (and optionally YUNXIAO_ORG_ID). The registry metadata omitted this; verify the token is required and how it's used. - The CLI will run `npx -y alibabacloud-devops-mcp-server` at runtime. That dynamically downloads and executes an npm package (not pinned). Review the alibabacloud-devops-mcp-server package on npm/GitHub and confirm you trust its source before allowing the skill to run. - The child process inherits the full environment. Avoid running this skill in an environment that contains unrelated secrets (AWS keys, other API tokens). Prefer running in a minimal/isolated environment or agent workspace containing only the Yunxiao token. - If you prefer to reduce risk, install and audit the alibabacloud-devops-mcp-server package locally (pin its version), or modify the skill to call a vetted, pinned binary instead of using npx. - If you need a final sign-off: ask the publisher to correct the registry metadata to list YUNXIAO_ACCESS_TOKEN as a required env var, and to document/pin the MCP-server dependency (or include an explicit install spec).

云效工作项 Skill

用于查询和操作云效工作项，包括需求、任务、缺陷、评论、项目与组织成员信息。

公开版约定

• 本文件只保留可公开的通用说明。
• 私有组织 ID、项目 ID、内部前缀和团队约定，统一记录在工作区本地的 AGENTS.md。
• 对外示例统一使用占位符，例如 <orgId>、<projectId>、PROJ-12345。

前置要求

• 已设置环境变量 YUNXIAO_ACCESS_TOKEN
• 可选设置 YUNXIAO_ORG_ID
• 如需在 Cursor 中直接使用，可在 ~/.cursor/mcp.json 配置对应 MCP Server

环境变量

# 云效访问令牌（必填）
export YUNXIAO_ACCESS_TOKEN="<your-yunxiao-token>"

# 默认组织 ID（可选）
export YUNXIAO_ORG_ID="<your-org-id>"

组织 ID 获取顺序

脚本会按以下顺序确定 organizationId：

1. 命令行显式传入的 [orgId]
2. 环境变量 YUNXIAO_ORG_ID
3. get_organizations 返回的第一个组织

如果你有内部默认组织或常用项目映射，把它们写到本地 AGENTS.md，不要写进公开 skill。

MCP 配置示例

{
  "mcpServers": {
    "yunxiao": {
      "command": "npx",
      "args": ["-y", "alibabacloud-devops-mcp-server"],
      "env": {
        "YUNXIAO_ACCESS_TOKEN": "<your-token>"
      }
    }
  }
}

功能列表

1. 获取组织列表

node scripts/yunxiao-mcp.cjs get_organizations

2. 获取当前用户信息

node scripts/yunxiao-mcp.cjs get_current_user [orgId]

3. 搜索项目

node scripts/yunxiao-mcp.cjs search_projects [keyword] [orgId]

示例输出：

[
  {
    "id": "project-id-1",
    "name": "示例项目",
    "customCode": "PROJ",
    "status": { "name": "进行中" }
  }
]

4. 获取工作项详情

node scripts/yunxiao-mcp.cjs get_work_item <workItemId> [orgId]

示例输出：

{
  "id": "work-item-id",
  "serialNumber": "PROJ-12345",
  "subject": "示例需求标题",
  "status": { "name": "处理中" },
  "assignedTo": { "name": "负责人A", "id": "user-id-1" },
  "creator": { "name": "创建人A", "id": "user-id-2" },
  "participants": [{ "name": "参与人A", "id": "user-id-3" }],
  "customFieldValues": []
}

5. 搜索工作项

node scripts/yunxiao-mcp.cjs search_workitems <spaceId> [optionsJson] [orgId]

参数：

参数	必填	说明
spaceId	是	项目 ID，可通过 search_projects 获取
optionsJson	否	JSON 格式搜索选项
orgId	否	显式指定组织 ID

搜索选项：

字段	类型	说明
category	string	工作项类型：req、task、bug、risk、epic
status	string	状态 ID 或状态名
assignedTo	string	指派人 ID，self 表示当前用户
creator	string	创建人 ID，self 表示当前用户
subject	string	标题关键词
sprint	string	迭代 ID
page	number	页码，默认 1
perPage	number	每页条数，默认 20，最大 200
includeDetails	boolean	是否包含详情，默认 false
orderBy	string	排序字段
sort	string	排序方向：desc 或 asc

常用示例：

# 搜索项目中的所有需求
node scripts/yunxiao-mcp.cjs search_workitems "<projectId>"

# 搜索待处理的需求
node scripts/yunxiao-mcp.cjs search_workitems "<projectId>" '{"status":"pending_processing"}'

# 搜索指派给我的工作项
node scripts/yunxiao-mcp.cjs search_workitems "<projectId>" '{"assignedTo":"self"}'

# 搜索缺陷
node scripts/yunxiao-mcp.cjs search_workitems "<projectId>" '{"category":"bug"}'

# 分页搜索
node scripts/yunxiao-mcp.cjs search_workitems "<projectId>" '{"perPage":50,"page":1}'

示例输出：

{
  "items": [
    {
      "id": "work-item-id",
      "serialNumber": "PROJ-12345",
      "subject": "示例工作项",
      "status": { "name": "待处理", "id": "100005" },
      "assignedTo": { "name": "负责人A", "id": "user-id-1" },
      "creator": { "name": "创建人A", "id": "user-id-2" },
      "workitemType": { "name": "产品需求" }
    }
  ],
  "pagination": {
    "page": 1,
    "perPage": 20,
    "total": 1,
    "totalPages": 1
  }
}

6. 获取工作项评论

node scripts/yunxiao-mcp.cjs get_comments <workItemId> [orgId] [page] [perPage]

示例输出：

[
  {
    "id": "comment-id",
    "content": "评论内容示例",
    "contentFormat": "RICHTEXT",
    "user": { "name": "评论人A", "id": "user-id-1" },
    "gmtCreate": 1767843788000,
    "gmtModified": 1767843788000
  }
]

7. 创建工作项评论

node scripts/yunxiao-mcp.cjs create_comment <workItemId> <content> [orgId]

8. 搜索组织成员

node scripts/yunxiao-mcp.cjs search_members <keyword> [orgId]

命令速查

node scripts/yunxiao-mcp.cjs <command> [args...]

get_organizations
get_current_user [orgId]
search_projects [keyword] [orgId]
get_work_item <workItemId> [orgId]
search_workitems <spaceId> [optionsJson] [orgId]
get_comments <workItemId> [orgId] [page] [perPage]
create_comment <workItemId> <content> [orgId]
search_members <keyword> [orgId]

使用场景

场景 1：查看某个工作项

用户: 帮我看看云效需求 PROJ-12345
助手: 调用 get_work_item 获取详情并整理重点信息

场景 2：搜索待处理工作

用户: 帮我看看某个项目有哪些待处理需求
助手:
1. 调用 search_projects 获取项目 ID
2. 调用 search_workitems 搜索待处理需求
3. 展示结果

场景 3：查看我的待办

用户: 我在云效上有哪些待办？
助手:
1. 调用 search_projects 获取相关项目
2. 调用 search_workitems 搜索 assignedTo=self 的需求、任务或缺陷
3. 展示结果

场景 4：查看工作项评论

用户: 看一下 PROJ-12345 的评论
助手: 调用 get_comments 获取评论列表

注意事项

1. 评论内容通常是富文本结构。
2. 大量结果建议结合 page 和 perPage 分页获取。
3. 如果需要内部默认组织、项目快捷名或前缀映射，请放在本地 AGENTS.md，不要写进公开文档。

错误处理

错误	原因	解决方案
Cannot determine organization ID	未显式提供组织 ID，且无法自动获取	设置 YUNXIAO_ORG_ID、传入 [orgId]，或先运行 get_organizations
NotFound	工作项不存在或无权限	检查工作项 ID 和权限
Invalid spaceId	项目 ID 无效	使用 search_projects 获取正确的项目 ID