Minimax Mcp

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent MiniMax MCP setup for web search and image analysis, with expected cautions around a remote package, API key use, and sending inputs to MiniMax.

Before installing, verify that the uvx package is the intended MiniMax MCP server, use a dedicated MiniMax API key, monitor API costs, and only submit images or URLs you are comfortable sending to MiniMax.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A changed or impersonated package could affect the MCP server behavior or how the MiniMax API key is used.

Why it was flagged

The setup runs a remote MCP package through uvx without a pinned version in the documented command. This is central to the skill and user-directed, but users should verify the package/source before installing.

Skill content

--command "uvx minimax-coding-plan-mcp -y"

Recommendation

Install from a trusted package/source, consider pinning a known version, and compare it with the referenced MiniMax GitHub project before adding credentials.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The key may allow billable MiniMax API calls or quota consumption if misused.

Why it was flagged

The skill requires a MiniMax API key for its intended provider integration. This is expected, but it delegates account/API usage to the configured MCP server.

Skill content

`MINIMAX_API_KEY` | ✅ | Your MiniMax API Key

Recommendation

Use a dedicated/regenerable API key where possible, keep it secret, monitor MiniMax usage, and revoke the key if you stop using the skill.

NoteMedium Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Sensitive images, URLs, search queries, or prompts could be sent to MiniMax for processing.

Why it was flagged

The examples show local images can be provided to the MiniMax image-understanding tool; because the skill operates through MiniMax API/MCP, user-provided images and prompts may be processed by the external provider.

Skill content

image_source="/path/to/local/image.png"

Recommendation

Avoid submitting private or confidential files unless you are comfortable with MiniMax processing them, and review the provider’s data handling policy.