MCP OpenClaw Extensions

Validate agent routing bindings (2026.2.26+). Checks default route, scope isolation, circular routing. Gap G13.

Execute a task DAG across the agent fleet with parallel layer execution, dependency resolution (topological sort), and configurable result aggregation (collect/vote/first_success). Gap T4/issue #10010: multi-agent coordination.

Check status of running or completed fleet orchestrations. Returns task progress, layer execution state, elapsed time.

Audit MCP audio content support (2025-06-18+). Checks mimeType allowlist, size limits, duration limits, and base64 encoding configuration.

Self-update supply chain integrity check (2026.2.22+). Checks update channel, signature verification, rollout delay, rollback. Gap G16.

Validates Playwright/Puppeteer headless browser configuration for agent use. Scans for dangerous launch args (--no-sandbox, remote debugging), checks headless mode, timeouts, viewport, and user data isolation. Gap T10: browser automation audit.

Detects channel SDK packages present in package.json but absent from README (zombie dependencies). Gap M1: @line/bot-sdk is in deps but LINE has zero documentation — a maintenance liability for 75M+ users in JP/TH. Returns: zombie deps, channel coverage matrix.

C8 — Vérifie la canonicalisation des chemins auth pour les channel plugins. Détecte les encoded dot-segment traversal (%2e%2e) qui peuvent contourner la gateway auth sur /api/channels. (Fix 2026.2.26)

Validates CI workflow completeness: checks that .github/workflows/ contains lint, test, and secrets scanning steps. Also checks recommended steps (coverage, type_check). Gap T6: no CI validation tool existed.

Audit circuit breaker / resilience configuration for external calls — timeouts, retries, fallback.

H13 — Vérifie les guardrails $include dans la config. Détecte les hardlinks, les fichiers oversized, et les targets hors de la racine config. (Fix 2026.2.26 + 2026.2.17)

H14 — Détecte les clés de prototype pollution (__proto__, constructor, prototype) dans config.json. Bloquées dans config merge/patch depuis 2026.2.22.

Content boundary & anti-prompt-injection audit (2026.2+). Checks wrapExternalContent, wrapWebContent, toolResult stripping, content boundary markers. Gap G19.

Context rot / cognitive health detection. Checks token utilization, session age, turn count, compression ratio, recovery recommendations. Gap G23.

Usage/cost tracking and analysis. Estimates cost per session, checks budget thresholds, analyzes tool call patterns. Gap G27.

Checks the integrity and freshness of the server channel credentials. Gap M3: Baileys WhatsApp creds.json can silently corrupt, preventing reconnection. Validates JSON integrity (CRITICAL if corrupted) and staleness (MEDIUM if > max_age_days). Returns: per-credentials-dir findings with severity.

M16 — Vérifie que dmPolicy=allowlist avec allowFrom vide est détecté (fail-closed non appliqué). Vérifie tous les canaux : telegram, whatsapp, signal, imessage, discord, slack, line, matrix, feishu. (Fix 2026.2.26)

Compares dependency versions in package.json against versions referenced in markdown docs. Gap M5: docs.acp.md says ACP SDK '0.13.x' but package.json has '0.14.1'. Returns: desynced dependencies, severity (HIGH for ACP SDK/Carbon), update instructions.

Audit MCP elicitation capability compliance (2025-06-18+). Checks capability declaration, requestedSchema validity, URL mode support (2025-11-25), and schema type restrictions.

C9 — Vérifie l'immutabilité des plans d'exécution (argv/cwd/agentId/sessionKey). Détecte les shell-wrapper allow-always patterns et les configs sans sandboxing. (Fix 2026.2.26 + 2026.2.22)

Auto-route firm workflow output to the correct export target (GitHub PR, Jira, Linear, Slack, or local document) based on delivery_format. Main entrypoint for firm-delivery-export.

Write firm workflow output to a local Markdown document.

Create a GitHub draft PR from firm workflow output. Always adds needs-review + ai-generated labels. Never auto-merges.

Create a Jira issue from firm workflow output.

Create a Linear issue from firm workflow output.

Post a formatted firm delivery digest to Slack via webhook.

Checks the Gateway authentication configuration. Gap H2: Funnel mode without password auth is a CRITICAL exposure — anyone on the internet can reach the Gateway without authentication. Also detects dangerouslyDisableDeviceAuth=true (HIGH). Returns: findings list with severity and remediation.

Register a new Firm Gateway instance in the fleet. Verifies connectivity before saving.

Broadcast a message to all (or filtered) Gateway instances. Useful for fleet-wide announcements and multi-department orchestration kickoffs.

List all registered Gateway instances with their configuration.

Remove a Gateway instance from the fleet registry.

Health check all registered Firm Gateway instances. Runs parallel /health checks and returns latency, version and session counts.

Sync configuration or skills across all fleet instances in parallel.

Tests Gateway WebSocket connectivity with exponential backoff reconnection. Gaps H6+H7: Gateway unreachable after macOS sleep/wake, LaunchAgent WS 1006 closure. Returns: connection status, latency, close code, exact launchctl restart command.

Audit GDPR compliance and data residency — legal basis, retention, PII fields, cross-border transfers.

H16 — Vérifie que le group policy par défaut est fail-closed (allowlist). Détecte les canaux sans groupPolicy explicite. (Fix 2026.2.22)

Analyze co-activation patterns from harvested sessions. Uses Jaccard similarity for tag co-occurrence and rule co-activation. Returns top pattern candidates. CDC §4.3 clustering.

Validate Hebbian parameters: learning_rate, decay, poids_min/max, consolidation thresholds (episodic→emergent, emergent→strong). CDC §4.3.

Detect Claude.md semantic drift vs a baseline using TF-IDF cosine similarity. Alerts if similarity drops below threshold (default 0.7). CDC §5.1 anti-dérive.

Ingest JSONL session logs into the local Hebbian SQLite database. PII/secrets are stripped before storage (CDC §5.2). Supports session summary, tags, quality score, rule activations.

Validate the 4-layer structure of a Hebbian-augmented Claude.md: CORE (L1), CONSOLIDATED PATTERNS (L2), EPISODIC INDEX (L3), META (L4). CDC §3.3.

Audit PII stripping configuration: regex patterns (email, phone, IP, API keys), secret detection, embedding rotation policy, access restriction. CDC §5.2.

Dashboard: total sessions, Layer 2 rule weights, atrophy/promotion candidates, last harvest timestamp, weight update history. CDC §7 monitoring.

Compute or apply Hebbian weight updates on Layer 2 rules in Claude.md. Uses the formula: new = old + (lr × activation) - (decay × (1-activation)). Default dry_run=True (simulation only). CDC §4.3 + §4.4.

H12 — Vérifie le durcissement du routing session-key pour les hooks. Détecte allowRequestSessionKey sans prefix gates et les hooks sans token auth. (Breaking 2026.2.12)

H9 — Vérifie la présence des HTTP security headers dans la config gateway (HSTS, X-Content-Type-Options, Referrer-Policy). Ajoutés dans Firm 2026.2.23 / 2026.2.20.

Audits internationalization files for missing keys, empty values, interpolation mismatches, and ICU format issues. Gap T5/issue #3460: i18n audit was most-requested feature (71 comments).

Audit icon metadata support (MCP 2025-11-25). Checks tools/resources/prompts for icon fields, validates icon URLs use HTTPS or data: URI.

Audit JSON Schema dialect compliance (MCP 2025-11-25). Checks $schema declaration, detects draft-07 only keywords (definitions, dependencies, additionalItems).

Audits knowledge graph integrity: backend validation, TTL policy, orphan node detection, cycle detection, density metrics, and backup configuration. Gap T9/issue #7783.

Post-creation compliance checklist — steps, costs, timeline, and annual obligations for the chosen legal form.

Governance structure audit — recommends statutory clauses, pactes d'associés, and governance organs based on legal form and investor involvement.

Social protection analysis by status — TNS vs assimilé salarié vs micro-entrepreneur. Compares charges, retirement, health, and unemployment coverage.

Compare legal forms (SAS, SARL, SASU, EURL, etc.) with multi-criteria scoring matrix. Analyzes liability, tax regime, social charges, fundraising flexibility, and governance.

Tax simulation IS vs IR over 3-5 years. Includes salary/dividend optimization, holding structure benefits, and effective tax rate calculation.

Geo-economic analysis of candidate cities — talent pools, transport, ecosystem, infrastructure, quality of life. Compares multiple zones.

Tax incentives and aid programs by territory — ZFU, ZRR, BER, CIR, JEI, BPI, FEDER. Matches company profile to available programs.

Real estate market intelligence — availability, pricing per sqm, coworking rates, trends by zone. Filters by budget and surface.

Multi-criteria site scoring with 20+ weighted criteria. Compares sites on transport, talent, cost, ecosystem, and more. Outputs ranked matrix.

Total Cost of Occupation simulation over 3-5 years. Includes rent, charges, CFE, insurance, maintenance. Compares multiple sites.

Audits the logging configuration. Gap M7: debug/trace logging leaks tokens and PII into log files. Missing redactPatterns means secrets appear in plain text. Returns: findings with severity HIGH (verbose level) or MEDIUM (missing redact patterns).

Full competitive landscape analysis. Produces feature matrix, SWOT per competitor, and positioning map framework. Accessible to all departments.

Financial benchmarking — unit economics (CAC, LTV, ARPU, churn), pricing analysis, revenue comparisons. Cross-references with CFO data.

Generate a complete professional market research report in Markdown. Structured for cross-department readability: CEO (executive summary), CFO (financial), CTO (tech), Marketing (positioning), Commercial (battlecards).

Continuous competitive monitoring. Actions: add/remove competitors, log market events, check watchlist status, export monitoring data.

TAM/SAM/SOM market sizing with top-down and bottom-up approaches. Includes growth analysis, drivers, and inhibitors with confidence scoring.

Structured web research and OSINT intelligence gathering. Multi-source (Crunchbase, LinkedIn, G2, news...) with confidence scoring.

MCP Gateway firewall policy audit. Checks tool allowlists, argument sanitization, per-tool rate limits, secret leakage prevention, request size limits. Gap G21.

Audit multi-model routing — strategy, fallback chain, cost caps, provider diversity.

Export a server agent pipeline as an n8n-compatible workflow JSON. Converts pipeline steps (name, type, parameters, depends_on) to n8n format with proper node layout and connections. Gap T8: workflow automation bridge.

Validate and import an n8n workflow JSON file. Checks structure (nodes, connections, required fields), detects credential references, and optionally copies to workspace. Gap T8: workflow automation bridge.

C5 — Vérifie que Node.js ≥ 22.12.0 est installé (CVE-2025-59466 async_hooks DoS + CVE-2026-21636 Permission model bypass). Détecte les versions insuffisantes avec guidance de mise à jour.

H10 — Détecte les overrides dangereux de gateway.nodes.allowCommands. Remplace le finding `gateway.nodes.allow_commands_dangerous` de `firm security audit` (severity CRITICAL si gateway exposé).

Audit OAuth 2.1 / OIDC Discovery compliance (MCP 2025-06-18 / 2025-11-25). Checks issuer, PKCE S256, Protected Resource Metadata (RFC 9728), token validation, scope enforcement, resource indicators (RFC 8707).

Ingests JSONL structured logs/traces (OpenTelemetry format) into a local SQLite database for offline analysis. Handles trace_id/span_id deduplication, batch inserts, and flexible field extraction. Gap T1: no observability pipeline existed.

M17 — Vérifie la rédaction des secrets dans l'export OTEL/diagnostics. Détecte les credentials inline dans endpoints, headers et span attributes. (Fix 2026.2.27)

Validates pgvector configuration for semantic memory: index type (HNSW recommended), dimensions, distance metric, HNSW params (M, ef_construction), and connection string credential exposure. Gap T3/issue #15093.

H18 — Vérifie l'intégrité et le pin des plugins installés. Détecte les versions non pinnées, les hash manquants, et les drifts post-install. (Plugin integrity tracking 2026.2.26+)

Plugin SDK integrity validation (2026.1.16+). Checks plugin hooks, permissions, integrity hashes, package install restrictions. Gap G17.

Batch scan multiple text inputs for injection patterns. Accepts a list of {id, text} objects and returns per-item results with severity and hit counts.

Scan text for prompt injection and jailbreak patterns. Detects 16 pattern families including ChatML injection, role reassignment, memory reset, system prompt exfiltration, encoding evasion, and JSON boundary escape.

Cryptographic audit trail / provenance tracking. Actions: append (hash chain entry), verify (integrity check), status, export. Gap G24.

RAG pipeline health & configuration audit. Checks embedding model, vector store, chunk settings, retrieval top-K, index freshness. Gap G22.

Checks if a rate limiter is configured in front of the Gateway. Gap H8: no rate limiting means Tailscale Funnel exposure creates amplification risk. Returns: funnel status, rate limiter detected?, Nginx/Caddy fix snippets.

Audit MCP resource links in tool results — URI validation, MIME types, subscriptions, templates.

Audit MCP Resources & Prompts capability compliance. Checks capability declarations, listChanged support, resource URI schemes, and prompt field completeness.

M21 — Vérifie la configuration du rate limiting pour le control-plane RPC. Détecte l'absence de rate limit sur les déploiements remote et les webhooks sans throttling.

H15 — Vérifie que les safeBins ont des profils explicites dans safeBinProfiles. Détecte les interpréteurs sans restriction. (Fix 2026.2.22)

Audits the config for sandbox.mode setting. CRITICAL gap C2: sandbox defaults to 'off', giving any agent session full host shell access. A prompt injection → RCE with mode:off. Returns: severity, current mode, fix snippet.

Sandbox execution isolation audit. Checks sandbox mode, resource limits, filesystem restrictions, network policy, timeout enforcement. Gap G26.

C7 — Vérifie le lifecycle complet du workflow External Secrets (audit/configure/apply/reload). Détecte les inline credentials, les snapshots non activées, et la migration incomplète. (2026.2.26+)

Audit the secrets v2 lifecycle (2026.2.26+). Checks external provider, rotation policy, audit log, runtime snapshots, and hardcoded secret detection. Gap G12.

C6 — Détecte les secrets hardcodés dans config.json (tokens, API keys, passwords). Guide la migration vers `firm secrets` workflow (External Secrets Management, 2026.2.26+).

Scans source files for SQL injection patterns and dangerous query constructs. Specifically targets the /api/metrics/database vulnerability (issue #29951). Returns: vulnerabilities with file/line/severity, CVSS-style severity classification, and ready-to-apply remediation snippets.

Checks if the express-session secret is configured as a persistent env var. Gap C3: Firm regenerates the session secret on every container restart, causing infinite login loops in rolling/crash deployments (issue #29955). Returns: severity, secret found?, Docker and .env fix snippets.

M15 — Vérifie que session.maintenance.maxDiskBytes et highWaterBytes sont configurés pour éviter la croissance illimitée des transcripts. Fonctionnalité ajoutée dans Firm 2026.2.23.

H17 — Vérifie l'assainissement des variables d'environnement shell. Détecte LD_PRELOAD / DYLD_LIBRARY_PATH dans les configs agents, exec et hooks. (Fix 2026.2.22 + Breaking 2026.2.12)

Lazy-loads SKILL.md metadata (YAML front-matter) without parsing full content. Caches for 5 minutes. Supports per-skill or bulk loading. Gap T7/issue #26301: reduces startup time for large skill catalogs.

Search skills by keyword/tags across all SKILL.md files. Returns relevance-ranked results with metadata. Uses the lazy loader cache for performance.

SQLite-vec memory backend validation (2026.1.12+). Checks backend config, db path, embedding model, chunking, index settings, lazy sync. Gap G20.

Audit Streamable HTTP / SSE transport compliance (MCP 2025-11-25). Checks transport type, polling support, event ID encoding, Origin validation, MCP-Protocol-Version header.

Contract clause analysis — checks SLA, penalties, data protection (DPA), reversibility, IP, NDA, and more against best practices.

Multi-criteria supplier evaluation with 15+ weighted criteria. Scores quality, price, delivery, support, security, and more. Outputs ranked matrix.

Continuous supplier risk monitoring — add/remove/update/status/export watchlist. Tracks financial, dependency, geopolitical, and service level risks.

Market-wide supplier sourcing — identifies potential suppliers by category, budget, geography. Provides recommended sources and methodology.

Total Cost of Ownership analysis over 3-5 years. Includes license, integration, training, support, migration, and exit costs.

Audit MCP Tasks capability compliance (2025-11-25 experimental). Checks tasks declaration, polling interval, timeout config, max concurrent tasks, deferred result retrieval.

Token optimization analysis. Finds compression opportunities, prompt deduplication, caching improvements, tool result savings. Gap G25.

Check if OAuth scopes properly restrict tool access. Verifies each tool has scope requirements, detects wildcards, and identifies unscoped tools.

H19 — Vérifie que hooks.token ≠ gateway.auth.token. La réutilisation de token entre webhook et gateway élargit la surface d'attaque. (Security best practice)

Audit tool deprecation lifecycle — sunset dates, replacements, circular chains.

Validate trust model and multi-user heuristics (2026.2.24+). Checks multi-user DM scope, trust model, gateway hardening. Gap G15.

H11 — Vérifie la cohérence de la config trusted-proxy (auth.mode, bind, trustedProxies, real_ip_fallback_enabled). Détecte les combinaisons invalides corrigées en 2026.2.22 / 2026.2.13.

TTS/voice channel security audit (2026.2.24+). Checks provider auth, rate limits, SSML injection, voice channel isolation. Gap G14.

Checks that each inbound webhook channel has a signing secret configured. Gap M4: Without HMAC signature verification, anyone can forge inbound webhook events, potentially injecting malicious instructions to agents. Checks Telegram, Discord, Slack, MS Teams, Gmail. Returns: findings list with severity HIGH for any channel with webhook but no secret.

Validates the integrity of the workspace directory (~/.firm/workspace). Gap M8: Missing AGENTS.md / SOUL.md means agents have no identity or instructions. Stale MEMORY.md blocks context continuity. Large files cause agent context bloat. Returns: file inventory, fingerprint, and findings with severity.

Advisory file lock with timeout and owner tracking. Gap H5: race condition in shared-workspace read/modify/write — multiple agent sessions can corrupt shared resources. Actions: acquire / release / status.

Schedules a cron task on the main session, bypassing sandbox denylist. Gap H4: cron tools are on the denylist in Docker sessions, blocking autonomous scheduled workflows. Enforces strict command allowlist and blocklist for safety.

Broadcasts provider env vars (API keys, model config) to all non-main Gateway sessions. Gap H3: isolated spawn/cron sessions cannot access provider env vars, blocking LLM calls. Enforces a strict key allowlist. Masks secrets in all logs and return values.

Pull the session context (model, tokens, last message, workspace) back into VS Code. Enables Copilot agents to know what Firm has been doing.

Push the current VS Code workspace context (open files, active file, recent changes, last agent action) into a server session so the Firm agent can reference it. This is the first VS Code ↔ Firm bridge in the ecosystem.

Associate a VS Code workspace with a specific Firm session. Once linked, push/pull calls use this session automatically.

Return bridge status: linked sessions and gateway reachability.