ClawGear MCP Server

Secure, file-based MCP server for OpenClaw agents. No external dependencies beyond the MCP SDK.

Exposes three tools — file_read, web_search_passthrough, memory_query — to any MCP-compatible client. Ships with token authentication (SHA-256 + timing-safe compare), path-traversal guards, and a clawarmor-clean security posture.

When to use this skill

• You need a local MCP server that other agents can call securely.
• You want file read, web search, or memory grep as MCP tools.
• You are building a multi-agent system and need a shared tool layer with auth.
• You want a ClawMart-ready MCP template to fork and extend.

Tools

| Tool | Description | |------|-------------| | file_read | Read a local file (path-traversal safe, 1 MB limit) | | web_search_passthrough | DuckDuckGo HTML passthrough (no API key, 5s timeout) | | memory_query | Case-insensitive grep of .md files in memory dir |

Security

• Token compared with secrets.compare_digest (timing-safe).
• file_read guards with os.path.realpath + startswith(basedir).
• memory_query applies identical traversal protection.
• No eval(), exec(), shell=True, or pickle.load().
• Zero hardcoded secrets.