HSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http
verified
reported
listed in the official MCP registry counts 1 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
list_secrets
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 9592628 · analyzer v33 · 6d ago
skills & prompt files 1
danger signals2
- suspicious endpoint abc.ngrok.io 1clawAI-1claw-mcp-9592628/src/__tests__/security.test.ts :185
url: "https://abc.ngrok.io/webhook", - suspicious endpoint pastebin.com 1clawAI-1claw-mcp-9592628/src/__tests__/security.test.ts :193
url: "https://pastebin.com/abc",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 109
filesystem 1
- fs 1clawAI-1claw-mcp-9592628/src/index.ts :3
import { readFileSync } from "node:fs";
network 4
- net 1clawAI-1claw-mcp-9592628/src/client.ts :202
const res = await fetch(tokenUrl, { - net 1clawAI-1claw-mcp-9592628/src/index.ts :4
import http from "node:http"; - net 1clawAI-1claw-mcp-9592628/src/local-client.ts :10
import http from "node:http"; - net 1clawAI-1claw-mcp-9592628/src/tools/search_directory.ts :40
const res = await fetch(url);
secrets 1
- secrets 1clawAI-1claw-mcp-9592628/src/index.ts :181
const agentApiKey = process.env.ONECLAW_AGENT_API_KEY;
tool registrations 1
- list_secrets 1clawAI-1claw-mcp-9592628/src/index.ts :558
install hooks 1
- prepublishOnly 1clawAI-1claw-mcp-9592628/package.json :29
npm run build
declared dependencies 10
- fastmcp@^3.33.0
- @hono/node-server@^1.19.13
- glob@^11.1.0
- hono@^4.12.25
- koa@^3.1.2
- undici@^7.29.0
- zod@^3.24.0
- @types/node@^20.19.33
- typescript@^5.5.0
- vitest@^4.1.0
transport_posture 1
- binds all interfaces (0.0.0.0) 1clawAI-1claw-mcp-9592628/src/index.ts :981
httpStream: { port, host: "0.0.0.0" },