io.github.freema/openclaw-mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/openclaw/client.ts:58mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
      try {
        const response = await fetch(url, {
          ...options,
          signal: controller.signal,

• src/openclaw/client.ts:129mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
      try {
        const response = await fetch(url, {
          method: 'POST',
          signal: controller.signal,

• src/__tests__/server/auth-integration.test.ts:183mcp-js-ssrf-nonliteral-url (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      authorizeUrl.searchParams.set('code_challenge_method', 'S256');
  
      const authorizeRes = await fetch(authorizeUrl.toString(), { redirect: 'manual' });
      expect(authorizeRes.status).toBe(302);
      const location = authorizeRes.headers.get('location')!;

• src/__tests__/server/auth-integration.test.ts:236mcp-js-ssrf-nonliteral-url (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      authorizeUrl.searchParams.set('code_challenge_method', 'S256');
  
      const res = await fetch(authorizeUrl.toString(), { redirect: 'manual' });
      expect(res.status).toBe(400);
      const body: any = await res.json();

• src/__tests__/server/auth-integration.test.ts:254mcp-js-ssrf-nonliteral-url (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      authorizeUrl.searchParams.set('scope', 'mcp:tools');
  
      const res = await fetch(authorizeUrl.toString(), { redirect: 'manual' });
      expect(res.status).toBe(302);
      const location = new URL(res.headers.get('location')!);

• src/__tests__/server/auth-integration.test.ts:307mcp-js-ssrf-nonliteral-url (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
    it('accepts a listed redirect_uri', async () => {
      const res = await fetch(authorizeUrlWith(ALLOWED_URI), { redirect: 'manual' });
      expect(res.status).toBe(302);
      const location = new URL(res.headers.get('location')!);

• src/__tests__/server/auth-integration.test.ts:315mcp-js-ssrf-nonliteral-url (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
    it('rejects an unlisted redirect_uri', async () => {
      const res = await fetch(authorizeUrlWith('https://evil.example.com/callback'), {
        redirect: 'manual',
      });

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 1 credential-shaped string(s), every one from a keyword or entropy heuristic (Base64 High Entropy String). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Base64 High Entropy String at dist/index.js:11

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 27 day(s) before 2026-10-16

• issue_responsiveness

  median over 6 issue(s) in the last 6 months: 4.0 day(s) to first maintainer comment

• release_cadence

  median release gap 9 days (by releases), last release 82 day(s) ago

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md, but README.md documents a disclosure route — `03` §7 accepts either