elixir-mcpBLOCK
Clash Royale history recorder + remote MCP server. Unofficial; not endorsed by Supercell.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Clash Royale history, recorded, and served to your own agent.
The Clash Royale API only answers "what is true right now": no trophy timelines, no battle archive beyond a rotating log of about 30 battles, no per-season history. Elixir MCP records those observations continuously and keeps them. It records the players and clans its accounts track and the members of the clans it tracks. The record is served on one origin: the Console, Ladder and Elixir Clan in the browser, an authenticated remote MCP server for agents, and a versioned JSON API.
- Web:
- MCP:
https://elixir.poapkings.com/mcp - JSON API:
https://elixir.poapkings.com/api/v1
What the service does is documented publicly, at ; this repository does not describe product behavior. Want to help run the fetch fleet? See the operator guide.
Repository
An npm workspaces monorepo.
5911846f5f26OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add web-api --env BUTTONDOWN_API_TOKEN=${BUTTONDOWN_API_TOKEN} --env CLAN_MODEL_SECRET=${CLAN_MODEL_SECRET} --env OAUTH_ISSUER=${OAUTH_ISSUER} --env ORIGIN_SECRET=${ORIGIN_SECRET} -- npx -y @elixir-mcp/[email protected]{
"mcpServers": {
"web-api": {
"command": "npx",
"args": [
"-y",
"@elixir-mcp/[email protected]"
],
"env": {
"BUTTONDOWN_API_TOKEN": "${BUTTONDOWN_API_TOKEN}",
"CLAN_MODEL_SECRET": "${CLAN_MODEL_SECRET}",
"OAUTH_ISSUER": "${OAUTH_ISSUER}",
"ORIGIN_SECRET": "${ORIGIN_SECRET}"
}
}
}
}Exposed tools (8)
4 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
channel_recent | read | What this channel posted in the last 3 days, newest first, at most 15 posts: to connect a story to an earlier one, or to avoid saying the same thing again. |
member_battles | read | A current member |
member_record | read | What Elixir records about one current member of the clan, by their name exactly as written: role, trophies and best, arena, career wins, collection level, time in the clan and earlier stints, war weeks as decks and points, the clan |
t | read | d |
write_chat_message | write | One clan-chat line for a person to review, edit and send. |
write_leader_message | write | A Clan Leader Message for a leader to edit, then send in the game. |
write_pitch | write | The clan |
write_posts | write | The channel |
Trust audit
BLOCKgrade F · trust 34/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (9 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
payload-field-audit.mjs
payload-evidence.mjs
payload-keys.mjs
never edit, commit, deploy, call a write tool, or read .env files.
- Never read `.env` files or secret values; the public repos hold none.
with name `gym`, scope `cr:read feedback:write`, and the `.env` path here.
- Never read `.env` files; the production URL lives only in the Lambda.
- The repo is public. Never read `.env` files or secret values.
Clash_Regular.otf
console.log(`secret exists: ${SECRET_NAME} (left untouched)`);console.log(`created secret: ${SECRET_NAME}`);script.src = `https://tinylytics.app/embed/${SITE_ID}/min.js?hits&countries&events&beacon`;const beacon = (next, referrer) => {beacon(next, referrer);
if (last) beacon(last, documentReferrer());
baseURL: "http://127.0.0.1:4321",
url: "http://127.0.0.1:4321/",
"default-src 'none'; style-src 'unsafe-inline'; form-action https: http://localhost:* http://127.0.0.1:* http://[::1]:*; base-uri 'none'; frame-ancestors 'none'",
{ label: "ΔTROPHIES", num: true },{ pk: "model_key#clan", key: "sk-ant-123456789012345678901234567" },PG_ADMIN_URL: postgres://postgres:postgres@localhost:5432/postgres
answer = [200, { ok: true, token: "svt_fixture_not_a_real_key" }];const SECRET = "test-sealing-secret-0123456789abcdef";
.oxlintrc.json
.prettierignore
Gates applied: no_behavioural_pass, no_license.
5911846f5f26full audit observations/trust-audit/mcp-server/jthingelstad__elixir-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 5911846f5f26 | BLOCK | F | 34 | first audit |
Questions
What is the elixir-mcp MCP server?
Clash Royale history recorder + remote MCP server. Unofficial; not endorsed by Supercell.
What tools does elixir-mcp expose?
8 in total: 4 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is elixir-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (34/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does elixir-mcp need?
It reads BUTTONDOWN_API_TOKEN, CLAN_MODEL_SECRET, OAUTH_ISSUER, ORIGIN_SECRET, ORIGIN_SECRET_PREVIOUS, SESSION_SECRET, SESSION_SECRET_PREVIOUS and UNSUBSCRIBE_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (5911846f5f26), read on 2026-10-12. The repository is watched and re-audited when it changes.