Baselight data via MCP

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward instruction-only connector to Baselight's external MCP service; the main things to notice are account/API-key authentication and sending queries to a remote provider.

This appears reasonable to install if you intend to use Baselight through MCP. Before using it, verify the Baselight endpoint, authenticate with a revocable account/API key, and avoid sending private data in queries unless you are comfortable sharing it with Baselight.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent or client may be able to use the user's Baselight account/API key to run dataset queries, potentially consuming query limits.

Why it was flagged

The skill relies on Baselight account credentials or an API key. This is expected for a Baselight connector, but users should notice that authentication is involved.

Skill content

Connect using OAuth or API key depending on client. ... Requires Baselight account or API key

Recommendation

Use credentials intended for Baselight only, keep them revocable, and confirm the account scope and query limits before use.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Questions, dataset searches, and SQL queries may leave the local/chat environment and be processed by Baselight.

Why it was flagged

The skill connects the user's AI client to a disclosed external MCP server. Query text and generated SQL may be transmitted to that service as part of normal operation.

Skill content

MCP Server URL: https://api.baselight.app/mcp

Recommendation

Avoid including confidential or regulated data in prompts or queries unless sharing it with Baselight is intended and permitted.