OpenClaw MCP Debugger

Universal adapter diagnostics for Model Context Protocol (MCP). It automatically detects connection issues between agents and external tools, providing deep-...

Security Scan

The skill's description claims system-level diagnostics and automatic repair actions (inspect binary streams, restart servers) but the package provides no code, no install spec, and requests no permissions—this mismatch and the SKILL.md's instruction to run npx to fetch code are concerning.

Purpose & Capability

The SKILL.md claims deep packet/handshake inspection, latency tracking, and an Auto-Fixer that restarts local MCP servers (e.g., SQLite, Google Search, custom adapters). Those capabilities normally require system binaries, network/socket access, and elevated privileges, but the skill declares no required binaries, no config paths, and no credentials. The capability claims are not justified by the declared requirements.

Instruction Scope

The runtime instructions are high-level and largely vague. The only concrete command shown is 'npx openclaw skill run openclaw-mcp-debugger --all' which instructs fetching and running remote code. The SKILL.md offers no explicit, scoped steps for what to read, which processes to restart, or what files/ports it will touch—giving the agent broad discretion without constraints.

Install Mechanism

There is no install spec in the registry, but the usage explicitly suggests invoking npx, which would download and execute code from the npm registry at runtime. That introduces a remote code-fetching vector not captured in the registry metadata and carries risk because the fetched package is not present for review here.

Credentials

No environment variables, credentials, or config paths are declared, yet the described features (interacting with local servers, restarting services, inspecting adapters that may require credentials) would typically need access to system services, sockets, or cloud credentials. The absence of declared permissions or requirements is disproportionate to the claimed functionality.

Persistence & Privilege

The skill is not always-enabled and is user-invocable (normal). However, the Auto-Fixer behavior implies modifying or restarting local services; if the agent is allowed to invoke this skill autonomously, that increases blast radius. The registry metadata itself does not request persistent privileges, but the semantics in the SKILL.md imply potentially privileged operations.

What to consider before installing

This SKILL.md claims powerful, system-level debugging and automatic repair but provides no code, no declared installs, and no permissions—yet tells the agent to run an npx command which would download and run remote code. Treat this as suspicious: do not run or allow autonomous use unless you can verify the package source and contents. Ask the publisher for: (1) the npm/package source or a checksum so you can audit the downloaded code; (2) an explicit install spec and a list of required binaries and permissions; (3) clear, minimal actions the skill will perform (which processes, which ports/files). If you must try it, do so in an isolated environment (ephemeral VM or container) with least privilege and network restrictions.

The definitive toolkit for managing complex MCP environments. As AI Agents transition from toys to infrastructure, protocol stability is paramount. This skill provides real-time health checks, latency audits, and automated repair paths for your local MCP servers.

Features

• Protocol Audit: Deep inspection of MCP handshakes and binary streams.
• Latency Tracker: Measures the round-trip time between your LLM and its tools.
• Auto-Fixer: Automatically restarts crashed MCP servers (e.g., SQLite, Google Search, custom adapters).

Usage

npx openclaw skill run openclaw-mcp-debugger --all

Architect's Note

Operational excellence is the invisible foundation of successful AI Agents. Built for the Sovereign Protocol.