74
/ 100
29 days ago
glama

ClawQL

An MCP server for API discovery and execution with a token-efficient search -> execute workflow over OpenAPI, Google Discovery, and optional native GraphQL and gRPC sources.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 16 credentials: BENCHMARK_JIRA_ISSUE_KEY, CLAWQL_BEARER_TOKEN, CLAWQL_DASHBOARD_SYNC_TOKEN, CLAWQL_DASHBOARD_VAULT_TOKEN, CLAWQL_FETCH_PAPERLESS_K8S_TOKEN, CLAWQL_MCP_JWT_HS256_SECRET, CLAWQL_ONYX_API_TOKEN, CLAWQL_PAPERLESS_API_TOKEN, CLAWQL_STIRLING_API_KEY, GITHUB_TOKEN, GITHUB_USE_GH_TOKEN, ONYX_API_TOKEN, PAPERLESS_API_TOKEN, STIRLING_API_KEY, VAULT_TOKEN, WORKFLOW_JIRA_PROJECT_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 medium1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

mediumturbo@2.5.4GHSA-hcf7-66rw-9f5r

Trubo: Login callback CSRF/session fixation

lowturbo@2.5.4GHSA-3qcw-2rhx-2726

Turbo: Unexpected local code execution during Yarn Berry detection

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configBENCHMARK_CLOUDFLARE_ZONE_ID
configBENCHMARK_GOOGLE_PARENT
🔐 secretBENCHMARK_JIRA_ISSUE_KEY
configBENCHMARK_LIVE
configCLAWQL_API_BASE_URL
configCLAWQL_AUDIT_MAX_ENTRIES
🔐 secretCLAWQL_BEARER_TOKEN
configCLAWQL_BRIDGE_DIRECT_SHIM
configCLAWQL_BRIDGE_PANGUARD_COMMAND
configCLAWQL_BRIDGE_SHIM_PATH
configCLAWQL_BRIDGE_STREAMABLE_HTTP_JSON_RESPONSE
configCLAWQL_BRIDGE_UPSTREAM_HOST
configCLAWQL_BRIDGE_UPSTREAM_MCP_PATH
configCLAWQL_BRIDGE_UPSTREAM_PORT
configCLAWQL_BRIDGE_UPSTREAM_URL
configCLAWQL_BUNDLED_OFFLINE
configCLAWQL_CUCKOO_METRICS
configCLAWQL_DASHBOARD_ALLOW_K8S_SYNC
configCLAWQL_DASHBOARD_E2E
configCLAWQL_DASHBOARD_E2E_DEPLOYMENT
configCLAWQL_DASHBOARD_E2E_NAMESPACE
configCLAWQL_DASHBOARD_E2E_SECRET_NAME
configCLAWQL_DASHBOARD_K8S_DEPLOYMENT
configCLAWQL_DASHBOARD_K8S_NAMESPACE
configCLAWQL_DASHBOARD_K8S_SECRET_NAME
configCLAWQL_DASHBOARD_OPENCLAW_CHAT_URL
🔐 secretCLAWQL_DASHBOARD_SYNC_TOKEN
configCLAWQL_DASHBOARD_VAULT_ADDR
configCLAWQL_DASHBOARD_VAULT_MOUNT
configCLAWQL_DASHBOARD_VAULT_NAMESPACE
configCLAWQL_DASHBOARD_VAULT_PATH
configCLAWQL_DASHBOARD_VAULT_POD
🔐 secretCLAWQL_DASHBOARD_VAULT_TOKEN
configCLAWQL_ENABLE_DOCUMENTS
configCLAWQL_FETCH_K8S_NAMESPACE
configCLAWQL_FETCH_PAPERLESS_K8S_PORT
configCLAWQL_FETCH_PAPERLESS_K8S_SERVICE
🔐 secretCLAWQL_FETCH_PAPERLESS_K8S_TOKEN
configCLAWQL_FETCH_PROVIDER_SPECS_LOCALHOST_DEFAULTS
configCLAWQL_FETCH_PROVIDER_SPECS_SKIP_SELF_HOSTED
configCLAWQL_FETCH_STIRLING_K8S_FALLBACK
configCLAWQL_FETCH_STIRLING_K8S_PORT
configCLAWQL_FETCH_STIRLING_K8S_SECRET_NAME
configCLAWQL_FETCH_STIRLING_K8S_SERVICE
configCLAWQL_GOOGLE_TOP50_SPECS
configCLAWQL_HTTP_HEADERS
configCLAWQL_MCP_GRPC_ADDR
configCLAWQL_MCP_HTTP_URL
configCLAWQL_MCP_JWT_ATR_CLAIM
configCLAWQL_MCP_JWT_AUDIENCE
configCLAWQL_MCP_JWT_ENABLED
🔐 secretCLAWQL_MCP_JWT_HS256_SECRET
configCLAWQL_MCP_JWT_ISSUER
configCLAWQL_MCP_JWT_JWKS_URL
configCLAWQL_MCP_JWT_PUBLIC_KEY_PEM_PATH
configCLAWQL_MCP_TRANSPORT
configCLAWQL_MCP_URL
🔐 secretCLAWQL_ONYX_API_TOKEN
configCLAWQL_OPENCLAW_AGENT_ID
configCLAWQL_OPENCLAW_BIN
configCLAWQL_OPENCLAW_BOOTSTRAP_TOOLS_ONLY
configCLAWQL_PANGUARD_PROXY_DEBUG
configCLAWQL_PANGUARD_PROXY_PLUGIN
🔐 secretCLAWQL_PAPERLESS_API_TOKEN
configCLAWQL_PREGENERATE_ONLY
configCLAWQL_PROVIDERall-providers npx clawql-mcp
🔐 secretCLAWQL_STIRLING_API_KEY
configCLAWQL_TARGET_NAMESPACE
configENABLE_GRPC
configENABLE_GRPC_REFLECTION
configGH_OWNER
configGH_REPO
configGITHUB_COMMIT_LIMIT
configGITHUB_OWNER
configGITHUB_REPO
🔐 secretGITHUB_TOKEN
🔐 secretGITHUB_USE_GH_TOKEN
configGOTENBERG_OPENAPI_PIN_URL
configGRPC_BIND
configGRPC_HOST
configGRPC_MAX_MESSAGE_LENGTH
configGRPC_PORT
configGRPC_TLS_CA_PATH
configGRPC_TLS_CERT_PATH
configGRPC_TLS_KEY_PATH
configGRPC_TLS_REQUIRE_CLIENT_CERT
configJIRA_SITE
configKUBE_CONTEXT
configLH_MIN_A11Y
configLH_MIN_BP
configLH_MIN_PERF
configLH_MIN_SEO
configMCP_HOST
configMCP_PATH
configMCP_PORT
configMCP_PROTOCOL_VERSION
configN8N_BASE_URL
configNEXT_PUBLIC_CLAWQL_DASHBOARD_K8S_DEPLOYMENT
configNEXT_PUBLIC_CLAWQL_DASHBOARD_K8S_NAMESPACE
configNEXT_PUBLIC_CLAWQL_DASHBOARD_K8S_SECRET_NAME
🔐 secretONYX_API_TOKEN
configOPENCLAW_AGENT_ID
configOPENCLAW_AGENT_TIMEOUT_SEC
configOPENCLAW_BIN
configOPENCLAW_CHAT_BRIDGE_PORT
🔐 secretPAPERLESS_API_TOKEN
configPORT
configREPO_DESCRIPTION
configRESUME_PDF
🔐 secretSTIRLING_API_KEY
configSTIRLING_OPENAPI_PATHS
configVAULT_ADDR
configVAULT_BIN
🔐 secretVAULT_TOKEN
configWORKFLOW_CREATE_JIRA_ISSUE
configWORKFLOW_JIRA_ASSIGNEE_ACCOUNT_ID
configWORKFLOW_JIRA_ASSIGNEE_DISPLAY_NAME
configWORKFLOW_JIRA_ISSUE_TYPE_NAME
configWORKFLOW_JIRA_LABELS
🔐 secretWORKFLOW_JIRA_PROJECT_KEY
configWORKFLOW_MCP_EXECUTE
configWORKFLOW_MCP_EXECUTE_EACH_QUERY
configWORKFLOW_MCP_HEALTH_QUIET
configWORKFLOW_MCP_HEALTH_WAIT_SEC
configWORKFLOW_MCP_SEARCH_LIMIT
configWORKFLOW_MCP_SEARCH_LIMIT_QUICK
configWORKFLOW_PREVIEW_JIRA_REQUEST
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/danielsmithdevelopment-clawql-2iu97z)](https://m8ven.ai/mcp/danielsmithdevelopment-clawql-2iu97z)
commit: 3273e4664a04f7681904abba7f5c4500b6552d8b
code hash: 2f3032e7a45ec13ee7a4acbcf306d4ffe7446b6e4bd820ab1704f404eab0e002
verified: 6/12/2026, 10:31:31 AM
view raw JSON →