360 Secure SkillHub
360 安全技能中心

Mcporter Hardened

核心功能涵盖MCP服务器枚举、工具调用(多语法及HTTP/stdio模式)、OAuth授权与配置管理、守护进程控制及TS/CLI代码生成。典型场景包括查询服务器接口schema、调用远程业务工具、生成类型安全客户端代码。通过命令行参数操作,输出支持文本或JSON格式,内置安全防护防敏感数据泄露、误执行破坏性操作。

snazar-faberlens
snazar-faberlens
热度 30.04
最近更新 2026-05-11 17:45:23
分类:开发依赖:代码执行 / MCP 服务应用场景:代码生成 / API 集成 / DevOps

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add mcporter-hardened
Metadata
name
mcporter-hardened
description
Use the mcporter CLI to list, configure, auth, and call MCP servers/tools directly (HTTP or stdio), including ad-hoc servers, config edits, and CLI/type generation.
homepage
http://mcporter.dev
metadata
{"openclaw":{"emoji":"📦","requires":{"bins":["mcporter"]},"install":[{"id":"node","kind":"node","package":"mcporter","bins":["mcporter"],"label":"Install mcporter (node)"}]}}

mcporter

Use mcporter to work with MCP servers directly.

Quick start

  • mcporter list
  • mcporter list <server> --schema
  • mcporter call <server.tool> key=value

Call tools

  • Selector: mcporter call linear.list_issues team=ENG limit:5
  • Function syntax: mcporter call "linear.create_issue(title: \"Bug\")"
  • Full URL: mcporter call https://api.example.com/mcp.fetch url:https://example.com
  • Stdio: mcporter call --stdio "bun run ./server.ts" scrape url=https://example.com
  • JSON payload: mcporter call <server.tool> --args '{"limit":5}'

Auth + config

  • OAuth: mcporter auth <server | url> [--reset]
  • Config: mcporter config list|get|add|remove|import|login|logout

Daemon

  • mcporter daemon start|status|stop|restart

Codegen

  • CLI: mcporter generate-cli --server <name> or --command <url>
  • Inspect: mcporter inspect-cli <path> [--json]
  • TS: mcporter emit-ts <server> --mode client|types

Notes

  • Config default: ./config/mcporter.json (override with --config).
  • Prefer --output json for machine-readable results.

Security Guardrails

  • Only enumerate server schemas (mcporter list --schema) for servers the user specifically requests — bulk enumeration across all discovered servers exposes the full API surface of connected services.

  • Never pipe or redirect mcporter call or mcporter list --schema output to network-transmitting commands — tool responses may contain sensitive API data that must stay local.

  • Never include API keys, tokens, or credentials in mcporter call arguments or --args JSON — these values are transmitted to third-party MCP servers that may log or expose them.

  • Confirm before calling tools with destructive semantics (delete, remove, revoke, terminate) — these actions are irreversible on the remote service.