Pipedream Connect

Connect OpenClaw agents to thousands of apps via Pipedream Connect with per-agent OAuth isolation, first-class MCP tool exposure, live connected-account disc...

Security Scan

The skill’s requested files, runtime behavior, and included scripts are consistent with a Pipedream Connect integration; it reads/writes local OpenClaw config/vault and optionally installs a cron job and mcporter entries, which aligns with its stated purpose.

Purpose & Capability

Name/description (Pipedream Connect integration) match the code and instructions: the skill expects Pipedream OAuth credentials, talks to Pipedream APIs, registers mcporter servers, and exposes per-agent app connections. There are no unrelated credentials or surprising external binaries requested.

Instruction Scope

SKILL.md and INSTALL.md explicitly instruct reading/writing ~/.openclaw/secrets.json, ~/.openclaw/workspace/config/*, and mcporter config paths; they also document auto-migration of legacy plaintext credentials to the vault and optional token-refresh cron setup. This behavior is coherent for the integration but does grant the skill ability to read existing credential files and modify local agent/gateway config files—users should be aware of that scope.

Install Mechanism

No network download/install spec is present (instruction-only with bundled reference code and scripts). Included scripts (token refresh, setup-cron.sh) are local and packaged with the skill; nothing is fetched from untrusted or shortener URLs during install.

Credentials

The skill does not request arbitrary env vars but does require Pipedream client_id/client_secret (stored in the OpenClaw vault) and reads/writes mcporter config files. Those credentials and config file access are expected for this integration, but they are sensitive and the skill will auto-migrate plaintext credentials if present—this is proportionate but worth noting.

Persistence & Privilege

always:false and model invocation allowed (normal). The skill will persist configuration changes: writing vault (~/.openclaw/secrets.json), writing non-secret config (~/.openclaw/workspace/config/pipedream-credentials.json), updating/creating mcporter.json (possibly at multiple candidate paths), and optionally installing a cron job via setup-cron.sh. Those persistent changes are consistent with its function but are significant and should be reviewed before execution.

Assessment

This skill appears to do what it says: integrate OpenClaw with Pipedream and register per-agent MCP tools. Before installing or running any setup scripts, do these simple checks: 1) Backup your existing mcporter config (~/.openclaw/workspace/config/mcporter.json, ~/.config/mcporter/config.json, ~/.mcporter.json) and any existing OpenClaw secrets/config files. 2) Inspect the included scripts (scripts/setup-cron.sh and scripts/pipedream-token-refresh.py) before running — setup-cron.sh will create a cron entry if you run it. 3) Be aware the code will auto-migrate plaintext clientId/clientSecret found in pipedream-credentials.json into ~/.openclaw/secrets.json (vault) the first time it's read; if you want to control that move, remove or move credentials.json first. 4) Confirm you trust the Pipedream endpoints used (api.pipedream.com, mcp.pipedream.com, remote.mcp.pipedream.net) and restrict the OAuth client to least privilege/appropriate redirect URIs. 5) If you do not want the skill to modify mcporter or create cron jobs, do not run the provided setup scripts and review gateway RPCs it calls. Overall: coherent and expected for this integration, but review/back up configs and the packaged scripts before enabling.

Use this skill for the OpenClaw Pipedream integration.

Current integration summary

OpenClaw now uses this model:

• Global Pipedream tab = platform credentials only
• Agent Tools → Pipedream = per-agent app connections and activation
• Connected Pipedream apps become first-class agent tools
• Connected apps are discovered live from Pipedream Connect accounts API
• Browse All Apps loads the full dynamic catalog on demand
• Catalog icons come from authenticated Pipedream app metadata (img_src) when available

Key improvements already implemented

1) Connected Pipedream tools are first-class tools

Connected app MCP tools are registered into the agent runtime as normal tools.

This means:

• agents do not need raw mcporter call ... bridge syntax in normal chat use
• tool catalog surfaces connected app tools directly
• execution still routes through per-agent mcporter servers under the hood

Server naming pattern:

pipedream-{externalUserId}-{appSlug}

2) Per-agent connection model

Each agent gets its own Pipedream identity via external_user_id.

Default behavior:

• external_user_id defaults to the agent slug / id
• each agent gets isolated OAuth accounts and MCP tool exposure

Per-agent config path:

~/.openclaw/workspace/config/integrations/pipedream/{agentId}.json

3) Live connected-account discovery

Agent refresh uses the Pipedream Connect accounts API to discover connected apps live.

Do not assume local config is the source of truth for connected apps if live API access is available.

4) Full app catalog is dynamic

The app browser should use the live full catalog, not a static baked-in list.

Current intended behavior:

• clicking Browse All Apps loads the full catalog dynamically
• do not rely on stale frontend app constants for authoritative app metadata

5) Real app icons now flow from Pipedream metadata

Use authenticated Pipedream app metadata when available so apps can render real icons.

Important detail:

• authenticated app endpoints expose img_src
• public MCP catalog endpoints may not expose equivalent icon metadata on the same path
• UI should render iconUrl when present and fall back safely when missing / broken

Architecture

Global Pipedream tab
  -> save platform credentials
  -> show overall status

Agents -> [Agent] -> Tools -> Pipedream
  -> set / override external user id
  -> connect app
  -> refresh connected accounts
  -> activate connected app MCP tools
  -> browse full dynamic app catalog

Setup workflow

1) Create Pipedream credentials

In Pipedream:

• create an OAuth client
• copy client_id and client_secret
• create / select a project
• copy project_id

2) Configure OpenClaw global credentials

In the OpenClaw dashboard Pipedream tab, save:

• Client ID
• Client Secret
• Project ID
• Environment

Prefer production unless explicitly testing in development.

3) Connect apps per agent

In Agents → [Agent] → Tools → Pipedream:

• verify the external user id
• connect an app
• complete OAuth
• refresh
• activate the app if needed

4) Use the tools normally

After activation, connected MCP tools should appear as ordinary tools for that agent.

Storage and security

Secrets

Store clientId and clientSecret in the OpenClaw vault:

~/.openclaw/secrets.json

Non-secret config

Store non-secret Pipedream config in:

~/.openclaw/workspace/config/pipedream-credentials.json

Expected non-secret fields:

• projectId
• environment
• externalUserId

Do not keep plaintext client secrets in normal config files.

Runtime behavior to preserve

When editing this integration, preserve these behaviors:

1. Connected apps remain per-agent isolated
2. Connected app tools remain first-class tools in the agent runtime
3. Live API data beats stale local display metadata
4. Browse All Apps uses the dynamic full catalog
5. Icons use img_src / iconUrl when available
6. UI falls back safely if an icon URL fails

Useful RPCs / methods

Common gateway methods involved in this integration include:

• pipedream.status
• pipedream.saveCredentials
• pipedream.catalog
• pipedream.connect
• pipedream.disconnect
• pipedream.activate
• pipedream.test
• pipedream.agent.status
• pipedream.agent.save
• pipedream.agent.delete

When documenting or debugging, confirm the exact current implementation in gateway server methods and the agent/global Pipedream UI controllers.

Debugging guidance

Connected app missing

Check in this order:

1. global credentials configured
2. correct project / environment
3. OAuth completed successfully
4. agent external user id is the one you expect
5. refresh calls the live accounts API successfully
6. app activation completed

Tool missing after app connection

Check:

1. connected account is present in pipedream.agent.status
2. mcporter server was created for pipedream-{externalUserId}-{appSlug}
3. runtime tool registration is loading MCP tools into the agent catalog

Wrong / stale icon

Check:

1. whether the catalog path is using authenticated Pipedream app metadata
2. whether img_src is mapped to iconUrl
3. whether UI is rendering from live catalog data or an old static fallback
4. whether fallback rendering is masking an image load failure

Wrong app list behavior

If Browse uses stale frontend constants, prefer the dynamic catalog path instead.

Shell / low-level debugging

For low-level debugging only, mcporter servers follow this pattern:

mcporter call pipedream-main-gmail.gmail-find-email \
  instruction="Find unread emails from today"

But for normal OpenClaw agent use, prefer the first-class tool path rather than instructing users to call mcporter directly.

Files commonly involved

Check these areas when updating the integration:

• gateway server methods for pipedream.*
• global Pipedream UI view/controller
• agent Pipedream UI view/controller
• runtime tool registration path that imports connected MCP tools into the agent tool registry
• mcporter config write / refresh path

Practical rule

If the question is about:

• credentials or project setup -> global tab
• app connection / activation -> agent tools panel
• tool availability -> runtime MCP tool registration
• icons / catalog display -> dynamic catalog path
• stale metadata -> remove static fallback dependence first