skills.rest
swcstudiospace
swcstudiospaceOFFICIAL
Explore all skills by this author →
Website𝕏@govantarcticaGitHub

openclaw-mcp-connectors

Build OAuth-secured MCP HTTP connectors that hand off work to local OpenClaw agents.

Updated Aug 19, 2026
Search Tags:#deployment#oauth#mcp#handoff#nginx#streamable-http#openclaw
One-click install
npx skills add https://github.com/swcstudiospace/aimeecodes --skill openclaw-mcp-connectors-swcstudiospace
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: openclaw-mcp-connectors
Source: https://github.com/swcstudiospace/aimeecodes/tree/main/.aimee/skills/openclaw-mcp-connectors
Command: npx skills add https://github.com/swcstudiospace/aimeecodes --skill openclaw-mcp-connectors-swcstudiospace

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Exposing a local OpenClaw agent to external MCP clients like Grok requires OAuth (PKCE) rather than simple bearer tokens, plus careful nginx, systemd, and TLS configuration—mistakes here expose the Gateway or silently break handoffs. ## Core Features & Use Cases - OAuth MCP ingress: Implement a Streamable HTTP MCP server with PKCE authorization, dynamic client registration, and well-known discovery endpoints using the MCP Python SDK 2.x. - Structured handoff packs: Compact session transcripts into briefs with a mandatory EXECUTE block, persist them to disk, and submit them to OpenClaw via background openclaw agent calls. - Production deployment guidance: Covers nginx TLS binding on eth0 only (avoiding Tailscale IPv6 conflicts), systemd hardening, separate connector secrets, and verification checklists. - Use Case: Connect Grok to a local OpenClaw instance by deploying a loopback connector at https://openclaw-ego.engineer/mcp, registering it in the Grok UI with OAuth fields, and handing off compacted work sessions. ## Quick Start Use this skill to build an OAuth-secured MCP connector that accepts handoffs from Grok and submits them to my local OpenClaw agent.

Frequently Asked Questions about openclaw-mcp-connectors

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I expose a local OpenClaw agent to Grok over MCP?▼

Deploy a thin connector on 127.0.0.1 running an MCP Streamable HTTP server, proxy it through nginx with TLS, and register it in the Grok UI with OAuth endpoints. The connector compacts messages into a handoff pack and submits it via `openclaw agent`.

Why does Grok need OAuth instead of a bearer token for MCP?▼

Grok's connector form requires OAuth authorization and token endpoints with PKCE, so bearer-only middleware is insufficient. Implement `OAuthAuthorizationServerProvider` in the MCP Python SDK and pass only `auth_server_provider`, not `token_verifier`.

How do I configure nginx for an MCP connector on a host running Tailscale?▼

Bind TLS to the public eth0 IPv4 address only with `listen <PUBLIC_IP>:443 ssl http2` and never `listen [::]:443`, which conflicts with Tailscale. Proxy all of `/` to the connector so OAuth and well-known endpoints work, and restart nginx rather than reload after bind changes.

Why do StreamableHTTP ASGI tests fail with 'Task group is not initialized'?▼

The MCP Streamable HTTP app requires an active lifespan context. Wrap tests with `asgi-lifespan.LifespanManager` before making requests with an ASGI transport client.

What are the security rules for an OpenClaw MCP connector?▼

Keep the Gateway on loopback only, use a separate connector secret distinct from the gateway token, treat transcripts as untrusted prompt-injection input, apply systemd hardening with limited ReadWritePaths, and never log secrets.

When should I not use openclaw mcp serve as public ingress?▼

Do not use `openclaw mcp serve` as primary ingress because it needs existing channel routes, and never expose Gateway WS, `/tools/invoke`, or `/v1/*` publicly. Use a dedicated thin connector as the only public surface.

Related Skills

Explore More Software Engineering Skills→
billyfranklim1billyfranklim1

ssl-certificates

Automate Let's Encrypt certificate issuance and renewal via certbot with Cloudflare DNS-01 validation.

Community
Advanced
escoffier-labsescoffier-labs
65

brigade-work

Route work, verification runs, and session handoffs through the Brigade workflow.

Official
Intermediate
ganzinnganzinn

better-auth-security-best-practices

Configure Better Auth secrets, rate limits, CSRF, origins, sessions, and OAuth encryption.

Community
Advanced
wjlmrzdwjlmrzd

clawpet

Adopt, track, and interact with OpenClaw pets via local scripts.

Community
Intermediate