Clawlink MCP Server

ClawLink is an integration platform for AI agents that connects to 100+ third-party APIs via OAuth. The codebase shows a well-intentioned architecture with some security controls, but several concerns lower the score: (1) The plugin uses broad network access to orchestrate external API integrations without visible request validation/sanitization, (2) token/credential handling is delegated to a backend service without clear client-side safeguards visible in the provided code, (3) the generated GitHub tool manifest reveals extensive write/destructive operations are available without sufficient granularity or scope limitation in the client, and (4) dependency composition around OAuth and API orchestration introduces attack surface that requires careful credential management. The server's purpose (API integration) justifies broad permissions, but the lack of visible input validation and request signing in the client code is concerning. Supply chain analysis found 12 known vulnerabilities in dependencies (1 critical, 3 high severity).

4 files analyzed · 19 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.