github not analyzable

hith3sh/clawlink

MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.

maintainer: hith3sh
license: —
first seen: 2026-06-03
last seen: 2026-06-03
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities0 tools

transport streamable-http · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsgithub-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed analyzer v17 · 1d ago

skills & prompt files 116

danger signals8

suspicious endpointapi.telegram.orgClawLink-HQ-clawlink-b7fa417/src/app/api/feedback/route.ts:75`https://api.telegram.org/bot${botToken}/sendPhoto`,
over-broad OAuth scopehttps://mail.google.com/ClawLink-HQ-clawlink-b7fa417/scripts/audit-composio-scopes.mjs:206"https://mail.google.com/": [
over-broad OAuth scopegmail.modifyClawLink-HQ-clawlink-b7fa417/scripts/audit-composio-scopes.mjs:208"https://www.googleapis.com/auth/gmail.modify",
over-broad OAuth scopehttps://www.googleapis.com/auth/driveClawLink-HQ-clawlink-b7fa417/scripts/audit-composio-scopes.mjs:219"https://www.googleapis.com/auth/drive": [
over-broad OAuth scopehttps://www.googleapis.com/auth/spreadsheetsClawLink-HQ-clawlink-b7fa417/scripts/audit-composio-scopes.mjs:228"https://www.googleapis.com/auth/spreadsheets": [
over-broad OAuth scopehttps://www.googleapis.com/auth/documentsClawLink-HQ-clawlink-b7fa417/scripts/audit-composio-scopes.mjs:232"https://www.googleapis.com/auth/documents": [
over-broad OAuth scopeadmin:orgClawLink-HQ-clawlink-b7fa417/src/data/integrations.ts:2666{ name: "github_add_or_update_team_project_permissions", description: "Adds a classic project to a team or updates the team's permission on it. This endpoint grants or updates permissions for a team o
over-broad OAuth scopeadmin:orgClawLink-HQ-clawlink-b7fa417/src/generated/composio-manifests/github.generated.ts:217description: "Adds a classic project to a team or updates the team's permission on it. This endpoint grants or updates permissions for a team on a specific classic project (not Projects V2). The authe

code evidencevHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

last analysis: too-large · showing evidence from the last successful analysis (1w ago)

filesystem 19

fs ClawLink-HQ-clawlink-b7fa417/packages/openclaw-clawlink/index.js :2 import { readFileSync, statSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/packages/openclaw-clawlink/index.test.mjs :11 } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/audit-available-integrations.mjs :17 import { promises as fs } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/audit-composio-scopes.mjs :31 import { promises as fs } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/audit-dual-url-file.mjs :6 import { promises as fs } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/audit-file-uploadable-all.mjs :5 import { promises as fs } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/cross-ref-auth-schemes.mjs :1 import { promises as fs } from 'node:fs';
fs ClawLink-HQ-clawlink-b7fa417/scripts/deploy-web.mjs :4 import { readFileSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/import-composio-auth-schemes.mjs :15 import { promises as fs } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/import-composio-tools.mjs :1 import { promises as fs } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/notify-indexnow.mjs :3 import { readFileSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/publish-clawhub-plugin.mjs :16 import { readFileSync, renameSync, existsSync, readdirSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/publish-missing-skills.mjs :13 import { readFileSync, readdirSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/publish-remaining-skills.mjs :2 import { readFileSync, readdirSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/reconstruct-integrations.mjs :1 import { promises as fs } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/rotate-credential-key.mjs :26 import { existsSync, readFileSync, writeFileSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/smoke-openclaw-plugin-live.mjs :3 import { existsSync, readFileSync, readdirSync } from "node:fs";
fs ClawLink-HQ-clawlink-b7fa417/scripts/star-clawhub-skills.mjs :3 import { access, mkdir, readFile } from "node:fs/promises";
fs ClawLink-HQ-clawlink-b7fa417/scripts/test-alias-hooks.mjs :5 import { existsSync } from "node:fs";

shell / exec 6

shell ClawLink-HQ-clawlink-b7fa417/scripts/deploy-web.mjs :3 import { spawnSync } from "node:child_process";
shell ClawLink-HQ-clawlink-b7fa417/scripts/publish-clawhub-plugin.mjs :15 import { execFileSync } from "node:child_process";
shell ClawLink-HQ-clawlink-b7fa417/scripts/publish-missing-skills.mjs :12 import { execSync } from "node:child_process";
shell ClawLink-HQ-clawlink-b7fa417/scripts/publish-remaining-skills.mjs :1 import { execSync } from "node:child_process";
shell ClawLink-HQ-clawlink-b7fa417/scripts/reconstruct-integrations.mjs :86 while ((match = regex.exec(content)) !== null) {
shell ClawLink-HQ-clawlink-b7fa417/scripts/rotate-credential-key.mjs :25 import { execFileSync } from "node:child_process";

network 34

net ClawLink-HQ-clawlink-b7fa417/apps/blog/src/lib/notion.ts :2 * Notion API client using fetch (Workers-compatible).
net ClawLink-HQ-clawlink-b7fa417/packages/openclaw-clawlink-clawhub/index.js :206 const response = await fetch(`${DEFAULT_BASE_URL}${path}`, {
net ClawLink-HQ-clawlink-b7fa417/packages/openclaw-clawlink/index.js :411 const response = await fetch(`${DEFAULT_BASE_URL}${path}`, {
net ClawLink-HQ-clawlink-b7fa417/scripts/audit-composio-scopes.mjs :144 const response = await fetch(url, {
net ClawLink-HQ-clawlink-b7fa417/scripts/audit-dual-url-file.mjs :47 const resp = await fetch(url.toString(), {
net ClawLink-HQ-clawlink-b7fa417/scripts/audit-file-uploadable-all.mjs :46 const resp = await fetch(url.toString(), {
net ClawLink-HQ-clawlink-b7fa417/scripts/import-composio-auth-schemes.mjs :90 const response = await fetch(url, {
net ClawLink-HQ-clawlink-b7fa417/scripts/import-composio-tools.mjs :105 const response = await fetch(url.toString(), {
net ClawLink-HQ-clawlink-b7fa417/scripts/notify-indexnow.mjs :13 const res = await fetch(`${SITE_URL}/sitemap.xml`);
net ClawLink-HQ-clawlink-b7fa417/scripts/publish-docs-to-notion.mjs :219 const res = await fetch("https://api.notion.com/v1" + path, {
net ClawLink-HQ-clawlink-b7fa417/src/app/api/feedback/route.ts :74 telegramResponse = await fetch(
net ClawLink-HQ-clawlink-b7fa417/src/app/dashboard/admin/support-email/SupportEmailComposer.tsx :251 const response = await fetch("/api/admin/support-email/send", {
net ClawLink-HQ-clawlink-b7fa417/src/app/dashboard/billing/page.tsx :53 const response = await fetch("/api/billing", { cache: "no-store" });
net ClawLink-HQ-clawlink-b7fa417/src/app/dashboard/feedback/page.tsx :103 const res = await fetch("/api/feedback", {
net ClawLink-HQ-clawlink-b7fa417/src/app/dashboard/logs/page.tsx :318 const response = await fetch(`/api/logs?${buildParams().toString()}`, { cache: "no-store" });
net ClawLink-HQ-clawlink-b7fa417/src/app/dashboard/request-app/page.tsx :63 const res = await fetch("/api/app-requests");
net ClawLink-HQ-clawlink-b7fa417/src/app/dashboard/settings/page.tsx :144 const response = await fetch("/api/api-keys", { cache: "no-store" });
net ClawLink-HQ-clawlink-b7fa417/src/components/connect/HostedConnectPage.tsx :78 const response = await fetch(`/api/connect/sessions/${session.token}`, {
net ClawLink-HQ-clawlink-b7fa417/src/components/dashboard/AutomationsWorkspace.tsx :205 fetch("/api/flows/templates", { cache: "no-store" }),
net ClawLink-HQ-clawlink-b7fa417/src/components/dashboard/DashboardBillingProvider.tsx :35 const response = await fetch("/api/billing", { cache: "no-store" });
net ClawLink-HQ-clawlink-b7fa417/src/components/dashboard/DashboardConnectionsProvider.tsx :35 const response = await fetch("/api/integrations?summary=true");
net ClawLink-HQ-clawlink-b7fa417/src/components/dashboard/DevicesPanel.tsx :50 const response = await fetch("/api/devices", { cache: "no-store" });
net ClawLink-HQ-clawlink-b7fa417/src/components/dashboard/IntegrationDetails.tsx :116 const response = await fetch(`/api/integrations/${integration.slug}`, { cache: "no-store" });
net ClawLink-HQ-clawlink-b7fa417/src/components/dashboard/useOAuthConnect.ts :79 const response = await fetch(`/api/connect/sessions/${encodeURIComponent(sessionToken)}`, {
net ClawLink-HQ-clawlink-b7fa417/src/components/hermes/HermesApprovalPage.tsx :80 const response = await fetch(
net ClawLink-HQ-clawlink-b7fa417/src/components/openclaw/OpenClawPairingPage.tsx :203 const response = await fetch(`/api/openclaw/pair/sessions/${session.token}`, {
net ClawLink-HQ-clawlink-b7fa417/src/lib/composio/backend-client.ts :765 const response = await fetch(`${config.baseUrl}${path}`, {
net ClawLink-HQ-clawlink-b7fa417/src/lib/notion-blog.ts :2 * Notion API client using fetch (Cloudflare Workers compatible).
net ClawLink-HQ-clawlink-b7fa417/src/lib/server/email/resend.ts :55 const response = await fetch("https://api.resend.com/emails", {
net ClawLink-HQ-clawlink-b7fa417/src/lib/server/file-upload-relay.ts :250 response = await fetch(params.url, {
net ClawLink-HQ-clawlink-b7fa417/worker/index.ts :237 const response = await fetch(`${getClawLinkAppUrl(env)}/api/triggers/run-due`, {
net ClawLink-HQ-clawlink-b7fa417/worker/integrations/base.ts :379 const response = await fetch(url, {
net ClawLink-HQ-clawlink-b7fa417/worker/integrations/postiz.ts :404 const response = await fetch(`${POSTIZ_BASE_URL}/upload-from-url`, {
net ClawLink-HQ-clawlink-b7fa417/workers/trial-cron/src/index.ts :19 const response = await env.WEB.fetch(url, {

secrets 13

secrets ClawLink-HQ-clawlink-b7fa417/apps/blog/src/lib/notion.ts :11 Authorization: `Bearer ${process.env.NOTION_API_KEY}`,
secrets ClawLink-HQ-clawlink-b7fa417/instrumentation-client.ts :3 posthog.init(process.env.NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN!, {
secrets ClawLink-HQ-clawlink-b7fa417/scripts/audit-dual-url-file.mjs :88 const apiKey = process.env.COMPOSIO_API_KEY || env.COMPOSIO_API_KEY;
secrets ClawLink-HQ-clawlink-b7fa417/scripts/audit-file-uploadable-all.mjs :78 const apiKey = process.env.COMPOSIO_API_KEY || env.COMPOSIO_API_KEY;
secrets ClawLink-HQ-clawlink-b7fa417/scripts/publish-docs-to-notion.mjs :9 const NOTION_API_KEY = process.env.NOTION_API_KEY;
secrets ClawLink-HQ-clawlink-b7fa417/scripts/publish-missing-skills.mjs :17 const CLAWHUB_TOKEN = process.env.CLAWHUB_TOKEN;
secrets ClawLink-HQ-clawlink-b7fa417/scripts/publish-remaining-skills.mjs :6 const CLAWHUB_TOKEN = process.env.CLAWHUB_TOKEN;
secrets ClawLink-HQ-clawlink-b7fa417/scripts/rotate-credential-key.mjs :92 const OLD_KEY = process.env.CREDENTIAL_ENCRYPTION_KEY_OLD || (APPLY_EARLY ? undefined : prod.CREDENTIAL_ENCRYPTION_KEY);
secrets ClawLink-HQ-clawlink-b7fa417/src/app/api/feedback/route.ts :29 const botToken = process.env.TELEGRAM_BOT_TOKEN;
secrets ClawLink-HQ-clawlink-b7fa417/src/lib/notion-blog.ts :9 const apiKey = process.env.NOTION_API_KEY;
secrets ClawLink-HQ-clawlink-b7fa417/src/lib/posthog-server.ts :7 posthogClient = new PostHog(process.env.NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN!, {
secrets ClawLink-HQ-clawlink-b7fa417/src/lib/server/billing.ts :267 const accessToken = process.env.POLAR_ACCESS_TOKEN?.trim();
secrets ClawLink-HQ-clawlink-b7fa417/worker/crypto.ts :13 const encryptionKey = providedKey ?? process.env.CREDENTIAL_ENCRYPTION_KEY;

install hooks 1

postinstall ClawLink-HQ-clawlink-b7fa417/package.json :21 patch-package

declared dependencies 36

@base-ui/react@^1.3.0
@clerk/nextjs@^7.0.8
@clerk/ui@^1.7.0
@mux/mux-player@^3.13.0
@mux/mux-player-react@^3.13.0
@opennextjs/cloudflare@^1.18.0
@polar-sh/nextjs@^0.9.5
@useclawlink/openclaw-plugin@^0.1.10
class-variance-authority@^0.7.1
clsx@^2.1.1
lucide-react@^1.7.0
motion@^12.38.0
next@^15.5.2
next-intl@^4.12.0
openclaw@^2026.4.2
posthog-js@^1.376.0
posthog-node@^5.35.1
react@^19.2.4
react-dom@^19.2.4
react-hot-toast@^2.6.0
react-icons@^5.6.0
shadcn@^4.1.2
tailwind-merge@^3.5.0
tw-animate-css@^1.4.0
@cloudflare/workers-types@^4.20260401.1
@tailwindcss/postcss@^4
@types/node@^20
@types/react@^19
@types/react-dom@^19
eslint@^9
eslint-config-next@16.2.1
husky@^9.1.7
patch-package@^8.0.1
tailwindcss@^4
typescript@^5
wrangler@^4.80.0