mcporter

Reviewed 2026-10-14devopsPrompt / Rule# mcp # cli # openclaw # tools # typescript

OpenClaw's one-file mcporter skill: lets an AI agent list, configure, authenticate and call MCP servers from the shell through the mcporter CLI.

Security Reviewed

Instruction-only skill; the risk sits in the mcporter CLI it drives, which can call any MCP server, launch stdio commands and read other clients' MCP configs.

Install mcporter in Google Antigravity

Antigravity loads skills from .agents/skills/ in your project or ~/.gemini/config/skills/ for all projects (official docs). Full guide

EasiestOption 1: paste this to your Antigravity agent

Install the "mcporter" skill for Google Antigravity.
Follow the steps at https://www.antigravityskills.org/install/mcporter.md (source: https://github.com/openclaw/openclaw/tree/main/skills/mcporter).
Before running anything, show me what you will download and whether it includes scripts, and wait for my OK.
Install it into this project (.agents/skills/) unless I say global. When done, check that Antigravity lists it as an installed skill.

The agent reads the install file, shows you what it will download and waits for your OK.

Option 2: install it yourself

1. Download only the skill folder
```
git clone --depth 1 --filter=blob:none --sparse https://github.com/openclaw/openclaw /tmp/openclaw && git -C /tmp/openclaw sparse-checkout set skills/mcporter
```
A sparse checkout fetches skills/mcporter (one SKILL.md) instead of the whole OpenClaw repository, which also holds the OpenClaw app and 48 other skills.
2. Copy into this workspace (project skill)
```
mkdir -p .agents/skills && cp -r /tmp/openclaw/skills/mcporter .agents/skills/
```
Run from your project root. Antigravity reads workspace skills from <project>/.agents/skills/<folder>/.
3. Or install globally (all projects)
```
mkdir -p ~/.gemini/config/skills && cp -r /tmp/openclaw/skills/mcporter ~/.gemini/config/skills/
```
Use this instead of the previous step to have the skill in every workspace. Global skills folder from Antigravity's docs (antigravity.google/docs/skills).
4. Install the mcporter CLI
```
npm install -g mcporter && mcporter --version
```
Node 24 or newer. Alternatives from the mcporter README: brew install steipete/tap/mcporter, or no install at all with npx mcporter.
5. Check that Antigravity sees it
Antigravity 2.0 app: start a new conversation and ask "What skills do you have?" (the app has no /skills command; typing / and the skill name also finds it, sometimes only after your first message). Antigravity CLI: run /skills; in a session that was already open, run /skills reload first. mcporter should be listed.

Neither the OpenClaw repository nor the mcporter README mentions Antigravity; this is a plain folder copy into Antigravity's standard skill folders. mcporter does not read Antigravity's MCP config, so register servers with mcporter config add <name> <url> or call them by full URL.

Using Claude Code, Cursor or Codex? See other assistants below.

What is mcporter?

mcporter is a one-file skill from the OpenClaw repository that teaches an AI agent to reach Model Context Protocol (MCP) servers from the terminal with the mcporter CLI, instead of wiring every server into the chat client. It is for developers who want an agent, or a script, to list a server's tools, call one with arguments and get JSON back. What we counted at OpenClaw commit 493b90b (the skills/mcporter folder is unchanged at HEAD d38c6e9, 2026-10-14): the folder holds one file, SKILL.md, 61 lines and 1,612 bytes, with no scripts; it documents 5 ways to call a tool (selector, function syntax, full URL, stdio command, JSON payload) plus command groups for OAuth, config, a keep-alive daemon and code generation. It is one of 49 skill folders in openclaw/openclaw. The CLI it drives (steipete/mcporter, version 0.14.3 at commit 627965f) has 10 runtime dependencies in package.json, and its README says Node 24 or newer is required for npm installs.

How to use mcporter?

Install the CLI first: npm install -g mcporter, brew install steipete/tap/mcporter, or run it without installing as npx mcporter (all three are in the mcporter README). Copy skills/mcporter into your agent's skills folder, then ask in plain words. The agent runs mcporter list to see configured servers, mcporter list <server> --schema to read a tool's parameters, and mcporter call <server.tool> key=value to run it, with --output json when it needs to parse the result. Config is read from ./config/mcporter.json by default (override with --config). You can also skip config entirely and pass a full MCP URL, or a local server command with --stdio.

Key features of mcporter

✓Five call forms: selector (mcporter call linear.list_issues team=ENG limit:5), function syntax, a full MCP URL, an ad-hoc --stdio command, or a JSON --args payload
✓List configured servers and tool schemas (mcporter list, mcporter list <server> --schema)
✓OAuth and config management: mcporter auth <server | url> [--reset] and mcporter config list|get|add|remove|import|login|logout
✓Keep-alive daemon for servers that are slow to start: mcporter daemon start|status|stop|restart
✓Code generation: generate-cli builds a standalone CLI for one server, inspect-cli reads one back, emit-ts writes a TypeScript client or types
✓Machine-readable results with --output json

When to use mcporter

1Calling an MCP tool from a terminal or script without adding it to a chat client
2Checking which tools and parameters an MCP server exposes before you trust it
3Turning one MCP server into a small standalone CLI
4Smoke-testing a local stdio MCP server once

Installation & Setup Guide

Agent Rules / Prompt Setup

Follow these steps (taken from the project's own docs) to configure mcporter in your development environment.

Step 1: Install the mcporter CLIAny

npm install -g mcporter

From the mcporter README (alternatives: brew install steipete/tap/mcporter or npx mcporter). Needed for every assistant.

Step 2: Claude Code: copy the folder (not documented by the project)Claude Code

git clone --depth 1 --filter=blob:none --sparse https://github.com/openclaw/openclaw /tmp/openclaw && git -C /tmp/openclaw sparse-checkout set skills/mcporter && mkdir -p ~/.claude/skills && cp -r /tmp/openclaw/skills/mcporter ~/.claude/skills/

OpenClaw gives no Claude Code install for this bundled skill. The ~/.claude/skills/ folder comes from the Claude Code skills docs (https://code.claude.com/docs/en/skills).

Step 3: Cursor: not documentedCursor

Neither OpenClaw nor the mcporter README gives a Cursor skill install, so we do not list one.

Usage Example & Verification

Prompt / Request Example

1) README example (SKILL.md, "Call tools"): "List the tools on my linear server, then fetch 5 issues for team ENG."
-> What happens: the agent runs mcporter list linear --schema, then mcporter call linear.list_issues team=ENG limit:5. This only works if a server named linear is in your mcporter config (or imported from another client) and, if it uses OAuth, after mcporter auth linear.

2) README example (mcporter README, Quick start): "Use mcporter to look up the Context7 library ID for React."
-> What happens: npx mcporter call https://mcp.context7.com/mcp.resolve-library-id query="React hooks docs" libraryName=react. The README says this public server returns matching library IDs without local configuration or credentials, so it is a good first test.

3) Our example: "Generate a standalone CLI for my context7 server."
-> What happens: mcporter generate-cli --server context7 (the form in SKILL.md). Per mcporter's docs/cli-generator.md it writes context7.ts in the working directory by default; --bundle or --compile produce a runnable file instead.

Installation Confirmation Method

In Antigravity: Antigravity 2.0 app: start a new conversation and ask "What skills do you have?" (the app has no /skills command; typing / and the skill name also finds it, sometimes only after your first message). Antigravity CLI: run /skills; in a session that was already open, run /skills reload first. mcporter should be listed. Then run mcporter --version in a terminal and ask the agent "use mcporter to list the tools on https://mcp.context7.com/mcp"; the mcporter README says that server needs no config or credentials.

Security Review

Static review

Reviewed Date

2026-10-14

Audited Ref / Commit

493b90b2ba91d6d70e7b6784e475ff15f0aa891c

Reviewer

antigravityskills.org (static code review)

Instruction-only skill; the risk sits in the mcporter CLI it drives, which can call any MCP server, launch stdio commands and read other clients' MCP configs.

Full review: scope, findings, risks

Audit Scope:Static review. openclaw/openclaw at commit 493b90b (2026-10-06): skills/mcporter/SKILL.md, the skills/ folder listing and LICENSE; we confirmed skills/mcporter is unchanged at HEAD d38c6e9 (2026-10-14). steipete/mcporter at commit 627965f (2026-10-11) for tool context: README.md, package.json, docs/import.md, docs/agent-skills.md, docs/cli-reference.md, docs/cli-generator.md, LICENSE. mcporter's src/ was not reviewed line by line.

Key Findings:Instruction-only skill: one SKILL.md (61 lines), no scripts, no API key of its own. Requires the mcporter binary (metadata: requires bins mcporter, npm package mcporter). The commands it teaches reach any HTTP MCP endpoint, start local processes via --stdio, run a background daemon, perform OAuth and write config. mcporter imports server definitions from 7 other clients' config files by default (docs/import.md); "imports": [] turns that off.

Identified Operational Risks & Permissions:Arbitrary local command execution through --stdio; network calls to any MCP URL; OAuth tokens and config written locally; reads other clients' MCP config files (which can contain tokens) on import. Static review only: we did not run mcporter.

Static review of skills/mcporter/SKILL.md at commit 493b90b: documentation and OpenClaw metadata only, no scripts or executable files in the folder. It tells the agent to run mcporter list, mcporter call, mcporter auth, mcporter config ..., mcporter daemon ... and the generate-cli / inspect-cli / emit-ts code generators. mcporter call --stdio "<command>" starts a local process, and full-URL calls contact remote MCP endpoints, so the agent can reach whatever server or command it is given. mcporter auth runs an OAuth flow and stores the result; config add/import/login change ./config/mcporter.json by default. From the mcporter docs at 627965f: by default it merges MCP servers from Cursor, Claude Code, Claude Desktop, Codex, Windsurf, OpenCode and VS Code config files (docs/import.md, "imports": [] disables this), supports ${VAR} environment placeholders, and offers allowedTools / blockedTools to hide tools from agents (docs/agent-skills.md). The skill needs no API key itself; individual MCP servers may.

Operational Notes & Known Limitations

Known Limitations

•The skill does nothing without the mcporter binary. Its install hint lives in OpenClaw's own metadata.openclaw block, so outside OpenClaw (including Antigravity) you install the CLI yourself
•npm installs need Node 24 or newer (mcporter README); npx mcporter avoids a global install
•mcporter imports MCP servers from 7 client configs (cursor, claude-code, claude-desktop, codex, windsurf, opencode, vscode; docs/import.md). Antigravity is not in that list, so servers you added in Antigravity's MCP settings are not picked up; add them with mcporter config add or pass the URL
•SKILL.md covers part of the CLI: the mcporter README also documents resource, serve, record/replay and vault commands that the skill never mentions
•mcporter's own docs/agent-skills.md recommends one small skill per MCP server over a generic mcporter skill, because a generic skill makes the agent discover and load schemas for every server
•SKILL.md's homepage field says mcporter.dev, while the mcporter README badge and docs/CNAME point to mcporter.sh

Frequently Asked Questions

Is the mcporter skill safe?

The skill itself is one SKILL.md with no scripts (static review of commit 493b90b). The risk is the CLI it drives: mcporter can call any MCP URL, start any local command you pass with --stdio, store OAuth tokens and edit ./config/mcporter.json. Only point it at servers you trust.

How do I install mcporter in Antigravity?

Sparse-clone openclaw/openclaw with only skills/mcporter, copy that folder to .agents/skills/ (or ~/.gemini/config/skills/), install the CLI with npm install -g mcporter, then ask "What skills do you have?" in the Antigravity 2.0 app or run /skills in the Antigravity CLI.

Will mcporter see the MCP servers I already added to Antigravity?

No. Its docs/import.md lists 7 import sources (Cursor, Claude Code, Claude Desktop, Codex, Windsurf, OpenCode, VS Code) and Antigravity is not one of them. Add servers with mcporter config add or call them by URL.

What is the difference between the skill and the mcporter tool?

The skill is 61 lines of instructions in the OpenClaw repo. The tool is the mcporter npm package (0.14.3 at the commit we read), a TypeScript runtime and CLI by Peter Steinberger in its own repository.