Guru MCP
v1.0.0Access Guru knowledge base via MCP - ask AI questions, search documents, create drafts, and update cards. Connects to all your Guru sources including Slack, Drive, Confluence, and SharePoint.
⭐ 2· 2.2k·3 current·3 all-time
by@pvoo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (access Guru via MCP to search, ask questions, create/update cards) matches the SKILL.md instructions: it expects an MCP endpoint, a GURU_API_TOKEN, and the mcporter client to call the MCP API. However, the registry metadata provided with the skill lists no required binaries or env vars, while the SKILL.md metadata and instructions explicitly require the mcporter binary and a GURU_API_TOKEN — this mismatch is an incoherence to investigate.
Instruction Scope
Instructions are specific and constrained to the stated task: create a Guru API token, set GURU_API_TOKEN in ~/.clawdbot/.env, add a guru entry to config/mcporter.json, and invoke mcporter calls to MCP endpoints. These steps involve reading/writing configuration files in your home directory and calling an external API (mcp.api.getguru.com). The instructions do not ask for unrelated files/credentials, but they do instruct creating/modifying files at specific paths which is outside the skill bundle and should be done only if you trust the source.
Install Mechanism
This is an instruction-only skill with no install spec and no code to write to disk. That lowers risk. It does rely on an external CLI (mcporter) being present but does not provide an installer — the absence of an install spec is consistent with an instruction-only integration, though you should obtain mcporter from an official source.
Credentials
The only sensitive credential the SKILL.md requires is a single GURU_API_TOKEN (in the form email:token), which is proportionate for a Guru integration. That token is used in an Authorization header for the MCP server. However, the top-level registry metadata claimed no required env vars while the embedded SKILL.md requires GURU_API_TOKEN — this inconsistency should be resolved. Also note that queries are logged in Guru's AI Agent Center (per the docs), so content sent to the skill will be recorded by Guru.
Persistence & Privilege
The skill does not request 'always: true' or other elevated platform privileges. It will operate only when invoked. It does instruct you to write configuration files (~/ .clawdbot/.env and config/mcporter.json), which is normal for configuring a CLI client but is a permanent change to your environment that you should be willing to make before proceeding.
What to consider before installing
Before installing or using this skill: (1) Confirm the source — the registry shows 'Source: unknown' but the homepage is getguru.com; prefer installing only if you trust that origin. (2) Resolve the metadata mismatch: the SKILL.md requires the mcporter binary and a GURU_API_TOKEN even though the registry metadata lists none — verify that requirement and obtain mcporter from an official source. (3) Create a scoped/least-privilege Guru API token, understand its permissions and retention, and consider using a token you can revoke. (4) Be aware the skill instructs writing credentials to ~/.clawdbot/.env and editing config/mcporter.json — these are persistent changes; review those files and file permissions. (5) Remember that queries are logged in Guru's AI Agent Center, so do not send sensitive secrets or private data unless you accept that logging. If you cannot verify the origin or the mcporter client, treat this skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk971c6pzjnjr1c96fzyjbnebx97yqbc4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧠 Clawdis
Binsmcporter
EnvGURU_API_TOKEN