@homenshum/openclaw-mcp-nodebench
AMCP server package @homenshum/openclaw-mcp-nodebench
Install
agr install @homenshum/openclaw-mcp-nodebench --target claudeThis artifact does not publish files for Claude.
Document
{ "name": "@homenshum/openclaw-mcp-nodebench", "version": "0.2.0", "description": "Sandboxed OpenClaw orchestration + workflow auditing MCP server with DeepTrace trust skills. Tool allowlists, resource budgets, audit trails, Docker scaffolding, gotcha DB, and ClawHub-publishable receipt/evidence/delegation skills.", "type": "module", "bin": { "openclaw-mcp-nodebench": "./dist/index.js" }, "main": "./dist/index.js", "files": [ "dist//*.js", "dist//*.d.ts", "!dist/tests", "README.md" ], "scripts": { "build": "tsc", "dev": "tsx src/index.ts", "test": "vitest run", "test:watch": "vitest", "prepublishOnly": "npm run build && npm run test" }, "keywords": [ "mcp", "openclaw", "model-context-protocol", "sandbox", "security", "ai-agent", "audit", "workflow", "gotcha-db", "self-instruct", "orchestration", "deeptrace", "receipts", "delegation", "evidence", "trust", "clawhub" ], "clawhub": { "skills": [ { "name": "deeptrace-receipt-audit", "version": "0.1.0", "description": "Tamper-evident action receipts — log, list, verify, and audit what agents did.", "tools": ["deeptrace_log_receipt", "deeptrace_list_receipts", "deeptrace_verify_receipt", "deeptrace_receipt_stats"], "category": "trust" }, { "name": "deeptrace-evidence-pack", "version": "0.1.0", "description": "Evidence bundles with content-addressed hashing for investigation and provenance.", "tools": ["deeptrace_ingest_evidence", "deeptrace_create_evidence_pack", "deeptrace_search_evidence", "deeptrace_get_evidence_pack"], "category": "trust" }, { "name": "deeptrace-delegation-check", "version": "0.1.0", "description": "Agent passports with scoped permissions — pre-flight tool authorization checks.", "tools": ["deeptrace_create_passport", "deeptrace_check_permission", "deeptrace_get_passport", "deeptrace_revoke_passport"], "category": "trust" } ] }, "repository": { "type": "git", "url": "https://github.com/HomenShum/nodebench-ai.git", "directory": "packages/openclaw-mcp-nodebench" }, "license": "MIT", "author": "HomenShum", "dependencies": { "@modelcontextprotocol/sdk": "^1.0.4", "@toon-format/toon": "^1.0.0", "better-sqlite3": "^11.0.0" }, "optionalDependencies": { "@google/genai": "^1.10.0", "openai": "^5.8.2" }, "devDependencies": { "@types/better-sqlite3": "^7.6.0", "@types/node": "^20.11.0", "tsx": "^4.7.0", "typescript": "^5.3.3", "vitest": "^3.2.4" }, "engines": { "node": ">=18.0.0" } }
Trustgrade A
- passBody integrity
Whether the stored document is plausibly the kind of file the artifact declares, rather than something fetched by mistake.
- warnType matchbest-effort: server code not analyzed
Whether the artifact is really the kind of thing its metadata claims it is.
- passFreshness
How long since the source repository was last pushed to.
- passPrompt injection
Scans the artifact's own text for instructions aimed at your agent rather than at you.
- passLicense
Whether the source repository declares an SPDX license permissive enough to redistribute.
How the grade is calculated
Each check contributes 0 points when it passes, 1 when it warns, and 2 when it fails. The total maps to a letter:
- Aevery check passed
- Bone warning
- Ctwo warnings
- Dprompt injection or body integrity failed, or three warnings
- Fone of those failed, and something else is wrong
These are automated hygiene checks, not a security audit, and not a dependency or vulnerability scan. A grade of A means nothing was flagged — not that the artifact is safe.
Versions
git-06d5484cf8a62026-08-06