Mcp Integration

Use Model Context Protocol servers to access external tools and data sources. Enable AI agents to discover and execute tools from configured MCP servers (legal databases, APIs, database connectors, weather services, etc.).

Security Scan

The plugin's code, docs, and runtime instructions are consistent with its stated purpose (connecting to MCP servers and proxying their tools); it does not request unexplained credentials, but it can connect to arbitrary servers and — if configured to do so — spawn local MCP processes and pass environment variables, so you must trust the servers and configuration you point it at.

Purpose & Capability

Name/description, SKILL.md, README, config schema and code (http-transport.js, index.js) all implement an MCP HTTP/SSE transport, discovery (list) and invocation (call) of remote tools. The ability to call database, weather, legal services, etc. is coherent with the stated purpose. The config also supports a stdio transport (command, args, env) which is powerful but explainable (some MCP servers are local binaries).

Instruction Scope

Runtime instructions are narrowly focused: list available tools, inspect tool inputSchema, validate and construct calls, parse responses, chain calls, and handle errors. The SKILL.md and docs reference only OpenClaw config files (~/.openclaw/openclaw.json) and environment variables that are expected for configuring MCP servers. There are no instructions to read unrelated host files or exfiltrate data.

Install Mechanism

There is no registry install spec (instruction-only at registry level), which reduces automatic install risk. However the bundle includes Node.js code and README with manual install steps (git clone + npm install). That means if you follow the README and install the plugin it will write files and execute Node.js code under your OpenClaw instance. The code appears to only implement transport/management (no obfuscated downloads), but installing still grants it runtime ability to make network requests and spawn processes (via stdio transport) if configured.

Credentials

The registry declares no required env vars, which is consistent. Documentation explains using environment variables (or an envFile) to provide API keys to specific MCP servers and allows per-server env settings for stdio transport. This is reasonable for integrating third‑party services, but it means secrets placed in OpenClaw config or passed into spawned MCP processes could be exposed to the remote servers — configure with care and avoid committing secrets in repo/config files.

Persistence & Privilege

The skill is not forced always-on (always:false) and uses the normal autonomous-invocation defaults. It does not request modification of other plugins or system-wide settings. Its persistence model (registered mcp tool, configured in openclaw.json) is typical for an OpenClaw plugin.

Assessment

This plugin appears to do what it says: expose MCP servers' tools to agents. Before installing or enabling it, consider the following: - Only configure servers you trust. The plugin will forward requests and responses to whatever URL/command you provide — a malicious or compromised MCP server can return harmful data or attempt to trick the agent. - Avoid placing secrets directly in repository files. Use environment variables stored securely (not committed to git) and prefer per-server env entries that you control. Remember the plugin can pass env values into spawned stdio processes. - Prefer HTTPS and restricted network scope for production servers. For initial testing, keep servers on localhost or an isolated network. - If you enable stdio transport (command to spawn a local MCP server), only use trusted binaries: that option lets the plugin spawn local processes with given env and args. - Limit agent access to the mcp tool via agent allowlists/denylist in OpenClaw if you want to restrict autonomous use. - When installing, run npm install and the plugin in a controlled environment (container or VM) first and review index.js and http-transport.js yourself; check OpenClaw logs after startup to see which servers and tools were registered. If you want additional assurance, provide the plugin's source to an internal reviewer or run it in an isolated instance and verify behavior before enabling on production agents.

MCP Integration Usage Guide

Overview

Use the MCP integration plugin to discover and execute tools provided by external MCP servers. This skill enables you to access legal databases, query APIs, search databases, and integrate with any service that provides an MCP interface.

The plugin provides a unified mcp tool with two actions:

• list - Discover available tools from all connected servers
• call - Execute a specific tool with parameters

---

Process

🔍 Phase 1: Tool Discovery

1.1 Check Available Tools

Always start by listing available tools to see what MCP servers are connected and what capabilities they provide.

Action:

{
  tool: "mcp",
  args: {
    action: "list"
  }
}

Response structure:

[
  {
    "id": "server:toolname",
    "server": "server-name",
    "name": "tool-name", 
    "description": "What this tool does",
    "inputSchema": {
      "type": "object",
      "properties": {...},
      "required": [...]
    }
  }
]

1.2 Understand Tool Schemas

For each tool, examine:

• id: Format is "server:toolname" - split on : to get server and tool names
• description: Understand what the tool does
• inputSchema: JSON Schema defining parameters
  • properties: Available parameters with types and descriptions
  • required: Array of mandatory parameter names

1.3 Match Tools to User Requests

Common tool naming patterns:

• search_* - Find or search operations (e.g., search_statute, search_users)
• get_* - Retrieve specific data (e.g., get_statute_full_text, get_weather)
• query - Execute queries (e.g., database:query)
• analyze_* - Analysis operations (e.g., analyze_law)
• resolve_* - Resolve references (e.g., resolve_citation)

---

🎯 Phase 2: Tool Execution

2.1 Validate Parameters

Before calling a tool:

1. Identify all required parameters from inputSchema.required
2. Verify parameter types match schema (string, number, boolean, array, object)
3. Check for constraints (minimum, maximum, enum values, patterns)
4. Ensure you have necessary information from the user

2.2 Construct Tool Call

Action:

{
  tool: "mcp",
  args: {
    action: "call",
    server: "<server-name>",
    tool: "<tool-name>",
    args: {
      // Tool-specific parameters from inputSchema
    }
  }
}

Example - Korean legal search:

{
  tool: "mcp",
  args: {
    action: "call",
    server: "kr-legal",
    tool: "search_statute",
    args: {
      query: "연장근로 수당",
      limit: 5
    }
  }
}

2.3 Parse Response

Tool responses follow this structure:

{
  "content": [
    {
      "type": "text",
      "text": "JSON string or text result"
    }
  ],
  "isError": false
}

For JSON responses:

const data = JSON.parse(response.content[0].text);
// Access data.result, data.results, or direct properties

---

🔄 Phase 3: Multi-Step Workflows

3.1 Chain Tool Calls

For complex requests, execute multiple tools in sequence:

Example - Legal research workflow:

1. Search - search_statute to find relevant laws
2. Retrieve - get_statute_full_text for complete text
3. Analyze - analyze_law for interpretation
4. Precedents - search_case_law for related cases

Each step uses output from the previous step to inform the next call.

3.2 Maintain Context

Between tool calls:

• Extract relevant information from each response
• Use extracted data as parameters for subsequent calls
• Build up understanding progressively
• Present synthesized results to user

---

⚠ Phase 4: Error Handling

4.1 Common Errors

"Tool not found: server:toolname"

• Cause: Server not connected or tool doesn't exist
• Solution: Run action: "list" to verify available tools
• Check spelling of server and tool names

"Invalid arguments for tool"

• Cause: Missing required parameter or wrong type
• Solution: Review inputSchema from list response
• Ensure all required parameters provided with correct types

"Server connection failed"

• Cause: MCP server not running or unreachable
• Solution: Inform user service is temporarily unavailable
• Suggest alternatives if possible

4.2 Error Response Format

Errors return:

{
  "content": [{"type": "text", "text": "Error: message"}],
  "isError": true
}

Handle gracefully:

• Explain what went wrong clearly
• Don't expose technical implementation details
• Suggest next steps or alternatives
• Don't retry excessively

---

Complete Example

User Request: "Find Korean laws about overtime pay"

Step 1: Discover tools

{tool: "mcp", args: {action: "list"}}

Response shows kr-legal:search_statute with:

• Required: query (string)
• Optional: limit (number), category (string)

Step 2: Execute search

{
  tool: "mcp",
  args: {
    action: "call",
    server: "kr-legal",
    tool: "search_statute",
    args: {
      query: "연장근로 수당",
      category: "노동법",
      limit: 5
    }
  }
}

Step 3: Parse and present

const data = JSON.parse(response.content[0].text);
// Present data.results to user

User-facing response:

Found 5 Korean statutes about overtime pay:

1. 근로기준법 제56조 (연장·야간 및 휴일 근로)
   - Overtime work requires 50% premium
   
2. 근로기준법 제50조 (근로시간)
   - Standard working hours: 40 hours per week

Would you like me to retrieve the full text of any statute?

---

Quick Reference

List Tools

{tool: "mcp", args: {action: "list"}}

Call Tool

{
  tool: "mcp",
  args: {
    action: "call",
    server: "server-name",
    tool: "tool-name",
    args: {param1: "value1"}
  }
}

Essential Patterns

Tool ID parsing: "server:toolname" → split on : for server and tool names

Parameter validation: Check inputSchema.required and inputSchema.properties[param].type

Response parsing: JSON.parse(response.content[0].text) for JSON responses

Error detection: Check response.isError === true

---

Reference Documentation

Core Documentation

• Plugin README: README.md - Installation and configuration
• Real Example: REAL_EXAMPLE_KR_LEGAL.md - Working kr-legal setup
• API Reference: API.md - Technical API details
• Configuration: CONFIGURATION.md - Server configuration guide
• Troubleshooting: TROUBLESHOOTING.md - Common issues and solutions

Usage Examples

• Examples Collection: EXAMPLES.md - 13 real-world examples including:
  • Legal research workflows
  • Database queries
  • Weather service integration
  • Multi-step complex workflows
  • Error handling patterns

---

Remember: Always start with action: "list" when uncertain about available tools.