ClawHub
Bundle Pluginstructural

MCPBundlesv0.1.2

OpenClaw plugin for calling MCPBundles-connected MCP tools through the local MCPBundles CLI.

mcpbundles·runtime mcpbundles·by @tonyllondon
openclaw bundles install clawhub:mcpbundles
Latest release: v0.1.2Download zip

Capabilities

Bundle format
generic
Tags
bundle-onlyformat:genericartifact:npm-packnpm-mirror:available
Runtime ID
mcpbundles

Compatibility

Built With Open Claw Version
2026.5.7
Min Gateway Version
2026.3.24-beta.2
Plugin Api Range
>=2026.3.24-beta.2
Plugin Sdk Version
2026.5.7
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name, description, SKILL.md, plugin metadata, and code all align around one purpose: routing OpenClaw tool calls to the local `mcpbundles` CLI. The registered tools for listing, describing, discovering, and calling MCPBundles Hub/server tools are consistent with that purpose.
✓
Instruction Scope
The instructions stay within the MCPBundles domain. They tell the agent to discover servers, inspect schemas, call MCPBundles tools, avoid asking users for raw third-party credentials, and request approval for destructive or billing-impacting actions. They do not instruct the agent to read unrelated files, environment variables, shell history, or send data to unexpected endpoints.
ℹ
Install Mechanism
There is no separate install script or download/extract mechanism, which is lower risk. However, this is not purely instruction-only: it includes plugin code that runs as an OpenClaw extension and spawns the configured `mcpbundles` CLI. That behavior is expected for this plugin, but users should recognize that installing it enables executable plugin code, not just prose instructions.
✓
Credentials
The skill does not request environment variables, API keys, tokens, passwords, or config paths. It relies on the local MCPBundles CLI already being installed and logged in, which is proportional to the stated purpose. Access to third-party services is indirect through the user's existing MCPBundles connections.
✓
Persistence & Privilege
`always` is false, and the tools are marked optional. The plugin activates on startup to register its tools, which is normal for an OpenClaw plugin. It does not appear to modify other plugins, system-wide agent policy, or unrelated configuration.
Assessment
This looks internally consistent, but it is a broad bridge: once enabled, the agent can use whatever services and Hub operations your logged-in MCPBundles CLI can access. Only install it if you trust MCPBundles and are comfortable letting OpenClaw invoke MCPBundles-connected tools. Also verify that the `mcpbundles` binary on the Gateway host is the one you intend to use, especially if you configure a custom command path.
✗
dist/index.js:81
Shell command execution detected (child_process).
✗
index.ts:102
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Verification

Tier
structural
Scope
artifact only
Summary
Validated package structure and extracted metadata.
Scan status
clean

Tags

latest
0.1.2

MCPBundles for OpenClaw

OpenClaw plugin that lets agents call MCPBundles-connected MCP servers through the local mcpbundles CLI.

What It Adds

  • mcpbundles_hub_tools - list every Hub platform tool visible to the active MCPBundles connection.
  • mcpbundles_call_hub_tool - call any Hub platform tool with JSON arguments.
  • mcpbundles_get_skill - fetch the Hub platform skill or a published MCP server skill.
  • mcpbundles_discover_servers - find MCP servers available through MCPBundles.
  • mcpbundles_list_tools - list tools for a selected MCP server.
  • mcpbundles_describe_tool - inspect the schema for a specific tool.
  • mcpbundles_call_tool - call a MCPBundles-routed MCP tool with JSON arguments.

The plugin also ships a mcpbundles skill adapted from the existing MCPBundles CLI skill at .skills/mcpbundles-cli/SKILL.md. It teaches the agent to discover servers, inspect tool schemas, fetch Hub skills, use exact hash-suffixed tool names, and avoid asking users for third-party credentials.

Requirements

  • OpenClaw 2026.3.24-beta.2 or newer on Node 22.19.0 or newer.
  • MCPBundles CLI installed and logged in on the same host as the OpenClaw Gateway.
  • Optional: configure a default MCPBundles connection when multiple named connections exist.

Install From ClawHub

openclaw plugins install clawhub:mcpbundles

Enable the optional tools in OpenClaw config:

{
  tools: {
    allow: ["mcpbundles"]
  }
}

The Gateway host needs a logged-in MCPBundles CLI:

mcpbundles login

Set command when the CLI is not on the Gateway process PATH.

Local Development Install

openclaw plugins install ./apps_on_third_party_sites/openclaw/openclaw-mcpbundles-plugin

If mcpbundles is not on the Gateway process PATH, set:

{
  plugins: {
    entries: {
      mcpbundles: {
        config: {
          command: "/opt/homebrew/bin/mcpbundles",
        },
      },
    },
  },
}

When multiple MCPBundles connections exist, set the default connection:

{
  plugins: {
    entries: {
      mcpbundles: {
        config: {
          connection: "local",
          timeoutMs: 120000,
        },
      },
    },
  },
}

ClawHub Publish

npm run build
npm run typecheck
clawhub package pack ./apps_on_third_party_sites/openclaw/openclaw-mcpbundles-plugin --pack-destination /tmp
clawhub package publish /tmp/mcpbundles-0.1.2.tgz --name mcpbundles --display-name MCPBundles --version 0.1.2