minimax-mcp

Provides MiniMax Token Plan web search and image understanding with fallback to Brave Search/Qwen Chat, using environment-injected API keys and no C drive us...

Security Scan

The skill largely does what it says (wraps a local Python MCP server for search and image analysis) but has multiple inconsistencies and a notable privacy risk: it requires an API key that is not declared in the registry metadata and it spawns a Python subprocess that inherits the full process environment (potentially exposing other secrets).

Purpose & Capability

The skill's code and SKILL.md match the stated purpose: it launches a local Python minimax MCP server (via `-m minimax_mcp.server`) and exposes web_search and understand_image tool calls. However the public registry metadata claims no required env vars while both SKILL.md and the script require MINIMAX_API_KEY (and optionally MINIMAX_PYTHON / MINIMAX_API_HOST). That mismatch between metadata and the actual requirements is an inconsistency users should be aware of.

Instruction Scope

SKILL.md instructs creating a venv on E: and installing minimax-coding-plan-mcp and describes automated fallback behavior to Brave Search / Qwen Chat. The shipped JavaScript implements only calls to the MCP server (search, image, tools) and does not implement any automatic fallback logic or the 'enabled' toggle behavior described in the docs. The docs therefore overstate automation. The runtime instructions do not request unrelated system files, but they do assume the user will install a Python package and provide environment variables.

Install Mechanism

This is an instruction-only skill with no installer spec. The SKILL.md asks the user to pip-install minimax-coding-plan-mcp into a venv; there are no bundled downloads or obscure URLs. Risk from install mechanism is low, but you should audit the referenced Python package before installing.

Credentials

Functionality legitimately requires MINIMAX_API_KEY and optionally a Python path/host. Those are proportionate to the stated purpose. However: (1) the skill's registry metadata does not declare MINIMAX_API_KEY, creating an information gap; and (2) the script starts a Python subprocess and passes {...process.env, MINIMAX_API_KEY, ...}, i.e., it forwards the entire current environment to the subprocess. That means any other environment secrets present in the agent process become accessible to the spawned Python process and anything that package might send over the network — a potential secret-exfiltration/privacy risk.

Persistence & Privilege

The skill does not request 'always: true', does not modify other skills or global agent settings, and has no install-time mechanism that writes to system-wide configs. It only runs a subprocess when invoked, which is expected for this function.

What to consider before installing

What to check before installing: - The script requires MINIMAX_API_KEY (and optionally MINIMAX_PYTHON/MINIMAX_API_HOST) even though the registry metadata lists none — add only the key you intend to use and confirm the registry is updated. - The Node script launches a local Python module and forwards the entire process environment to that subprocess. If your agent/process environment contains other secrets (other API keys, tokens), those could be visible to the Python code or the remote API it calls. Prefer running this skill with a dedicated, minimal environment (no other secrets), or inspect/contain the Python package before use. - SKILL.md asserts automatic fallback behavior and zero C: usage; the JavaScript does not implement automatic fallback — fallback appears to be manual (toggle `enabled`). Do not rely on the docs for automation guarantees. - Audit the pip package minimax-coding-plan-mcp (version referenced in docs) before installing, and install Python from a trusted source. - If you are uncomfortable with a spawned subprocess inheriting all env vars, do not install or run this skill until the author/maintainer clarifies that only necessary env vars are passed. If you want, I can: list the exact lines that forward the full environment, propose a safer wrapper that only forwards MINIMAX_API_KEY, or draft a checklist to safely sandbox this skill.

封装 MiniMax Token Plan 内置 web_search, image_understanding 工具，免费、零配置、无 C 盘占用。

---

这个 Skill 解决什么问题？

MiniMax Token Plan 订阅自带 web_search 工具，但原生的 uvx minimax-coding-plan-mcp 在 Windows 上有 asyncio DLL 问题跑不起来。这个 skill 绕过去，让你直接在 OpenClaw 里用上 MiniMax 搜索。

特点：

• 完全免费（用你自己的订阅额度）
• 不占 C 盘（venv + 缓存全在 E 盘）
• 凭证不写死在文件里（通过环境变量注入）
• 订阅失效自动降级 Brave Search / Qwen Chat

---

安装前提

1. Python 环境（若没有）

# 创建 venv（不占 C 盘）
python -m venv E:\.uv-venv

# 安装 MCP 包
E:\.uv-venv\Scripts\pip.exe install minimax-coding-plan-mcp

2. 配置 API Key

在 openclaw.json 的 env 块添加：

{
  "env": {
    "MINIMAX_API_KEY": "你的 MiniMax API Key"
  }
}

重启 Gateway 使配置生效。

---

状态配置

{ "enabled": true }

值	含义
true	使用 MiniMax 搜索
false	降级到 Brave Search / Qwen Chat

订阅失效特征： 报错 401 / 403 / authentication failed → 改为 enabled: false 激活 Fallback，恢复订阅后改回 true

---

使用方法

网络搜索

node skills/minimax-mcp/scripts/minimax_mcp.js search "搜索关键词"

输出格式：

{
  "query": "中国LLM算法薪资 2026",
  "count": 10,
  "results": [
    {
      "title": "...",
      "link": "https://...",
      "snippet": "...",
      "date": "2026-03-24"
    }
  ],
  "related": [{ "query": "相关搜索词" }]
}

图片理解

node skills/minimax-mcp/scripts/minimax_mcp.js image "分析要求" "图片路径或URL"

示例：

# 本地文件
node skills/minimax-mcp/scripts/minimax_mcp.js image "描述截图内容" "Your_local_image.jpg"

# 网络图片
node skills/minimax-mcp/scripts/minimax_mcp.js image "这张图里有什么？" "https://example.com/image.jpg"

支持格式： JPEG、PNG、WebP（最大 20MB） 返回： 图片内容的文字描述

---

Fallback 降级链

当 MiniMax 订阅失效时，改为 enabled: false，自动切换：

1. Brave Search — OpenClaw 内置 web_search 工具
2. Qwen Chat — Chrome Relay 打开 chat.qwen.ai 搜索

---

目录结构

skills/minimax-mcp/
├── SKILL.md
├── SKILL_en.md
├── config.json          ← 无 Key，仅存 HOST 默认值
└── scripts/
    └── minimax_websearch.js

---

技术细节

项目	说明
Python 环境	E:\.uv-venv（Python 3.11，完全在 E 盘）
包缓存	E:\.uv-cache（不占 C 盘）
MCP 包	minimax-coding-plan-mcp==0.0.4
凭证	从 MINIMAX_API_KEY 环境变量读取，不写文件 ✅
Python 路径	从 MINIMAX_PYTHON 环境变量读取（默认 E:\.uv-venv\Scripts\python.exe）
通信方式	stdio JSON-RPC，不占用 OpenClaw 进程端口
工具	web_search（搜索）+ understand_image（图片理解）

---

已知问题

uvx 在 Windows 上有 asyncio DLL 问题 🔴

uvx minimax-coding-plan-mcp 会报错 _overlapped import failed。解决方案是用 E:\.uv-venv\Scripts\python.exe -m minimax_mcp.server，不要用 uvx。

.uv-venv SSL 证书问题

某些 Windows 环境下 .uv-venv 的 SSL 证书配置可能为空。脚本会自动设置 REQUESTS_CA_BUNDLE 环境变量指向 certifi CA 包，无需手动处理。

---

更新日志

• 2026-03-24 v2.1：新增 understand_image 图片理解工具，支持本地文件和 URL
• 2026-03-24 v2：修复审查问题（凭证移至环境变量、移除硬编码路径、修复 SSL 证书问题）

🦞 Created by godiao — MIT License