Mcp Integration

This plugin appears to do what it says: expose MCP servers' tools to agents. Before installing or enabling it, consider the following: - Only configure servers you trust. The plugin will forward requests and responses to whatever URL/command you provide — a malicious or compromised MCP server can return harmful data or attempt to trick the agent. - Avoid placing secrets directly in repository files. Use environment variables stored securely (not committed to git) and prefer per-server env entries that you control. Remember the plugin can pass env values into spawned stdio processes. - Prefer HTTPS and restricted network scope for production servers. For initial testing, keep servers on localhost or an isolated network. - If you enable stdio transport (command to spawn a local MCP server), only use trusted binaries: that option lets the plugin spawn local processes with given env and args. - Limit agent access to the mcp tool via agent allowlists/denylist in OpenClaw if you want to restrict autonomous use. - When installing, run npm install and the plugin in a controlled environment (container or VM) first and review index.js and http-transport.js yourself; check OpenClaw logs after startup to see which servers and tools were registered. If you want additional assurance, provide the plugin's source to an internal reviewer or run it in an isolated instance and verify behavior before enabling on production agents.