138-tool MCP server for AI agent firms: security, A2A, Hebbian memory, fleet mgmt
Quick Install
Automated & IDE SetupCopy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.
Manual Client & Custom JSON ConfigExpand JSON ▾
Client Config & Setup
Choose your client or environment
Target File:
💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.
Documentation Overview
firm-mcp-server
Python MCP server (port 8012) that bridges VS Code Copilot agents to the [Firm](https://github.com/the server) Gateway ecosystem. Companion to setup-vs-agent-firm.
Tools (138)
| Module | Tool | Description | Gaps |
|---|---|---|---|
| vs_bridge | vs_context_push | Push VS Code context → Firm session | — |
| vs_bridge | vs_context_pull | Pull Firm session state → VS Code | — |
| vs_bridge | vs_session_link | Associate workspace path ↔ session ID | — |
| vs_bridge | vs_session_status | Bridge health check | — |
| gateway_fleet | firm_gateway_fleet_status | Parallel health-check all instances | — |
| gateway_fleet | firm_gateway_fleet_add | Register a Gateway instance | — |
| gateway_fleet | firm_gateway_fleet_remove | Remove a Gateway instance | — |
| gateway_fleet | firm_gateway_fleet_broadcast | Broadcast to all instances | — |
| gateway_fleet | firm_gateway_fleet_sync | Sync config+skills to all instances | — |
| gateway_fleet | firm_gateway_fleet_list | List instances | — |
| delivery_export | firm_export_github_pr | Create draft PR on GitHub | — |
| delivery_export | firm_export_jira_ticket | Create Jira ticket (ADF) | — |
| delivery_export | firm_export_linear_issue | Create Linear issue (GraphQL) | — |
| delivery_export | firm_export_slack_digest | Post Slack digest (Block Kit) | — |
| delivery_export | firm_export_document | Write local Markdown deliverable | — |
| delivery_export | firm_export_auto | Auto-route by delivery_format | — |
| security_audit | firm_security_scan | Scan files for SQL injection + XSS patterns | C1 |
| security_audit | firm_sandbox_audit | Detect sandbox.mode: off → CRITICAL | C2 |
| security_audit | firm_session_config_check | Detect ephemeral SESSION_SECRET in .env/compose | C3 |
| security_audit | firm_rate_limit_check | Detect Funnel without rate limiter → CRITICAL | H8 |
| acp_bridge | acp_session_persist | Persist ACP session to ~/.firm/acp_sessions.json | C4 |
| acp_bridge | acp_session_restore | Restore persisted ACP session by run_id | C4 |
| acp_bridge | acp_session_list_active | List ACP sessions active in last N hours | C4 |
| acp_bridge | fleet_session_inject_env | Inject env vars to spawned sessions (allowlist) | H3 |
| acp_bridge | fleet_cron_schedule | Schedule cron with sandbox enforcement | H4 |
| acp_bridge | firm_workspace_lock | Advisory file lock with owner tracking (fcntl) | H5 |
| acp_bridge | firm_acpx_version_check | ACPX plugin version pin (≥0.1.15) + streaming mode check | 3.1 |
| reliability_probe | firm_gateway_probe | WS probe with backoff — detects close 1006, returns launchctl | H6/H7 |
| reliability_probe | firm_doc_sync_check | Detect version drift in docs vs package.json | M5 |
| reliability_probe | firm_channel_audit | Detect zombie channel SDK deps (LINE, Baileys…) | M1 |
| reliability_probe | firm_adr_generate | Generate MADR + commit path for architecture decisions | M6 |
| gateway_hardening | firm_gateway_auth_check | Verify Gateway auth config — CRITICAL if Funnel without password | H2 |
| gateway_hardening | firm_credentials_check | Check Baileys/channel credential integrity and freshness | M3 |
| gateway_hardening | firm_webhook_sig_check | Verify HMAC signing secrets for all inbound webhook channels | M4 |
| gateway_hardening | firm_log_config_check | Detect debug/trace logging and missing redactPatterns | M7 |
| gateway_hardening | firm_workspace_integrity_check | Validate ~/.firm/workspace (AGENTS.md, SOUL.md, staleness) | M8 |
| runtime_audit | firm_node_version_check | Verify Node.js ≥ 22.12.0 (CVE-2025-59466, CVE-2026-21636) | C5 |
| runtime_audit | firm_secrets_workflow_check | Detect hardcoded secrets in config.json (migrate to firm secrets) | C6 |
| runtime_audit | firm_http_headers_check | Verify HTTP security headers (HSTS, X-Content-Type-Options, Referrer-Policy) | H9 |
| runtime_audit | firm_nodes_commands_check | Detect dangerous gateway.nodes.allowCommands override | H10 |
| runtime_audit | firm_trusted_proxy_check | Verify trusted-proxy config coherence (bind + trustedProxies + auth mode) | H11 |
| runtime_audit | firm_session_disk_budget_check | Verify session.maintenance.maxDiskBytes / highWaterBytes configured | M15 |
| runtime_audit | firm_dm_allowlist_check | Detect dmPolicy=allowlist with empty allowFrom (fail-closed) across 9 channels | M16 |
| advanced_security | firm_secrets_lifecycle_check | Verify External Secrets lifecycle (audit/configure/apply/reload) | C7 |
| advanced_security | firm_channel_auth_canon_check | Verify channel auth path canonicalization (encoded traversal) | C8 |
| advanced_security | firm_exec_approval_freeze_check | Verify exec approval plan immutability (symlink cwd rebind) | C9 |
| advanced_security | firm_hook_session_routing_check | Verify hook session-key routing hardening | H12 |
| advanced_security | firm_config_include_check | Verify $include hardlink escape + file-size guardrails | H13 |
| advanced_security | firm_config_prototype_check | Detect prototype pollution (proto, constructor, prototype) in config | H14 |
| advanced_security | firm_safe_bins_profile_check | Verify safeBins entries have explicit profiles | H15 |
| advanced_security | firm_group_policy_default_check | Verify group policy default is fail-closed (allowlist) | H16 |
| config_migration | firm_shell_env_check | Verify shell env sanitization (LD_PRELOAD, DYLD_*, ZDOTDIR) | H17 |
| config_migration | firm_plugin_integrity_check | Verify plugin install integrity/pin + drift detection | H18 |
| config_migration | firm_token_separation_check | Verify hooks.token ≠ gateway.auth.token | H19 |
| config_migration | firm_otel_redaction_check | Verify OTEL secret redaction in diagnostics export | M17 |
| config_migration | firm_rpc_rate_limit_check | Verify control-plane RPC rate limiting config | M21 |
| observability | firm_observability_pipeline | Ingest JSONL traces into SQLite for offline analysis | T1 |
| observability | firm_ci_pipeline_check | Validate CI workflow completeness (lint, test, secrets) | T6 |
| memory_audit | firm_pgvector_memory_check | Verify pgvector config (HNSW index, dimensions, distance metrics) | T3 |
| memory_audit | firm_knowledge_graph_check | Audit knowledge graph integrity (orphan nodes, cycles, TTL) | T9 |
| agent_orchestration | firm_agent_team_orchestrate | Task DAG execution with topological sort + parallel layers | T4 |
| agent_orchestration | firm_agent_team_status | Check orchestration status by ID or list all | T4 |
| i18n_audit | firm_i18n_audit | Scan locale files for missing keys, empty values, interpolation mismatches | T5 |
| skill_loader | firm_skill_lazy_loader | Lazy-load SKILL.md metadata (YAML front-matter, 5min cache) | T7 |
| skill_loader | firm_skill_search | Keyword/tag search across cached skills with relevance scoring | T7 |
| n8n_bridge | firm_n8n_workflow_export | Export agent pipeline as n8n-compatible workflow JSON | T8 |
| n8n_bridge | firm_n8n_workflow_import | Validate & import n8n workflow JSON into workspace | T8 |
| browser_audit | firm_browser_context_check | Validate Playwright/Puppeteer headless config for agents | T10 |
| hebbian_memory | firm_hebbian_harvest | Ingest JSONL session logs → SQLite (PII stripped) — CDC §4.1 | — |
| hebbian_memory | firm_hebbian_weight_update | Compute/apply Hebbian weight updates on Layer 2 — CDC §4.3 | — |
| hebbian_memory | firm_hebbian_analyze | Co-activation pattern analysis (Jaccard similarity) — CDC §4.3 | — |
| hebbian_memory | firm_hebbian_status | Dashboard: weights, atrophy, promotions — CDC §7 | — |
| hebbian_memory | firm_hebbian_layer_validate | Validate 4-layer Claude.md structure — CDC §3.3 | — |
| hebbian_memory | firm_hebbian_pii_check | Audit PII stripping config — CDC §5.2 | — |
| hebbian_memory | firm_hebbian_decay_config_check | Validate learning rate, decay, thresholds — CDC §4.3 | — |
| hebbian_memory | firm_hebbian_drift_check | Cosine similarity drift detection vs baseline — CDC §5.1 | — |
| a2a_bridge | firm_a2a_card_generate | Generate agent-card.json from SOUL.md (RC v1.0) | G1 |
| a2a_bridge | firm_a2a_card_validate | Validate A2A Agent Card against RC v1.0 spec | G2 |
| a2a_bridge | firm_a2a_task_send | Send message/task to an A2A agent (SendMessage) | G3 |
| a2a_bridge | firm_a2a_task_status | Get task status or list tasks (RC v1.0) | G4 |
| a2a_bridge | firm_a2a_cancel_task | Cancel a running A2A task (CancelTask) | G5 |
| a2a_bridge | firm_a2a_subscribe_task | Subscribe to task updates via SSE | G6 |
| a2a_bridge | firm_a2a_push_config | CRUD for push notification webhooks (RC v1.0) | G7 |
| a2a_bridge | firm_a2a_discovery | Discover agents via Agent Cards or SOUL.md scan | G8 |
| platform_audit | firm_secrets_v2_audit | Audit Firm secrets v2 lifecycle (2026.2+) | G9 |
| platform_audit | firm_agent_routing_check | Validate agent routing bindings | G10 |
| platform_audit | firm_voice_security_check | TTS/voice channel security audit | G11 |
| platform_audit | firm_trust_model_check | Validate trust model and multi-user heuristics | G12 |
| platform_audit | firm_autoupdate_check | Self-update supply chain integrity check | G13 |
| platform_audit | firm_plugin_sdk_check | Plugin SDK integrity validation | G14 |
| platform_audit | firm_content_boundary_check | Content boundary & anti-prompt-injection audit | G15 |
| platform_audit | firm_sqlite_vec_check | SQLite-vec memory backend validation | G16 |
| platform_audit | firm_adaptive_thinking_check | Claude 4.6 adaptive thinking configuration check | 3.1 |
| ecosystem_audit | firm_mcp_firewall_check | MCP Gateway firewall policy audit | G17 |
Related MCP Servers
Reviews
No reviews yet — be the first to share how this listing worked for you.
Frequently Asked Questions about MCP OpenClaw Extensions
AllMCPs Directory Badge
Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.
Badge Style:
Live Dynamic SVG Preview
Markdown (GitHub README)
[](https://allmcps.com/mcp/mcp-openclaw-extensions)HTML Embed
<a href="https://allmcps.com/mcp/mcp-openclaw-extensions"><img src="https://allmcps.com/api/badge/mcp-openclaw-extensions?style=directory" alt="MCP OpenClaw Extensions on AllMCPs" /></a>