gate-mcp-openclaw-installer
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
install.shscript executesmcporterCLI commands to manage server configurations and check tool availability. - [EXTERNAL_DOWNLOADS]: The configuration for the 'gate' server uses
npx -y gate-mcp, which downloads thegate-mcppackage from the NPM registry during execution. - [REMOTE_CODE_EXECUTION]: The skill configures the agent to execute code from the
gate-mcppackage vianpxwhen the server is invoked. - [CREDENTIALS_UNSAFE]: The installer includes a hardcoded public API key (
MCP_AK_8W2N7Q) for thegate-dexservice. This is documented by the vendor as a fixed identifier for the service interface rather than a private user credential.
Audit Metadata