📦 Outline MCP — 技能工具

v1.3.4

Model Context Protocol (MCP) bridge for Outline (getoutline.com). Enables AI agents to search, read, create, and manage documents, collections, and comments...

0· 153·0 当前·0 累计
samuellie 头像by @samuellie (Samuel Lie)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/7
0
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
安全
high confidence
The skill's requested binaries, environment variables, install step, and scripts are coherent with an Outline MCP bridge; the main risk is that its upload/bulk-sync tools read arbitrary absolute paths from the host filesystem (intended for uploads) and could be used to exfiltrate files if used in an untrusted environment.
评估建议
This skill appears to do what it claims (an Outline MCP bridge) and needs your Outline API key and MCP URL. The main risk is its upload/bulk-sync tools: they read arbitrary absolute file paths on the host (via fs.readFileSync) and then upload those files to your Outline workspace. Before installing: 1) Only enable this skill on trusted hosts or in isolated containers; do not run it on multi-tenant or developer laptops with sensitive files. 2) Use an Outline API key with the minimum privileges po...
详细分析 ▾
用途与能力
Name/description state an Outline MCP bridge and the skill requires OUTLINE_API_KEY, OUTLINE_URL, Node and npm and includes MCP client code — these are appropriate and expected for connecting to an Outline workspace and performing document/attachment operations.
指令范围
SKILL.md and the scripts explicitly include local filesystem access for bulk upload and an 'upload' action that reads files from paths provided to the agent. This behavior is within the declared purpose (bulk file/media uploads) but expands the agent's ability to read arbitrary absolute paths on the host — a sensitive capability which SKILL.md does warn about.
安装机制
Install is a single npm install (no remote download of arbitrary archives). package.json depends on @modelcontextprotocol/sdk and package-lock references standard npm packages — this is a normal npm dependency install pattern.
凭证需求
Only OUTLINE_API_KEY and OUTLINE_URL are required and OUTLINE_API_KEY is declared as primary. These are the expected secrets for an Outline integration and are proportionate to the skill's functionality.
持久化与权限
always is false and the skill does not request system-wide config changes. It does not persist itself or modify other skills. Autonomous invocation is allowed (platform default) but is not combined with other unusual privileges.
scripts/bulk_sync.mjs:22
Environment variable access combined with network send.
scripts/mcp_bridge.mjs:11
Environment variable access combined with network send.
scripts/bulk_sync.mjs:70
File read combined with network send (possible exfiltration).
scripts/mcp_bridge.mjs:78
File read combined with network send (possible exfiltration).
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

无特殊依赖

版本

latestv1.3.42026/3/25

Version synchronization for Security & Permissions disclosure

可疑

安装命令

点击复制
官方npx clawhub@latest install outline-app-mcp
镜像加速npx clawhub@latest install outline-app-mcp --registry https://cn.longxiaskill.com

技能文档

This skill provides a high-fidelity bridge between OpenClaw and an Outline workspace. It utilizes the Model Context Protocol (MCP) v1.0.0 to dynamically expose Outline's internal documentation tools to AI agents.

⚠️ Security & Permissions Warning

Host Filesystem Access: The upload (in mcp_bridge.mjs) and bulk-sync (in bulk_sync.mjs) tools require access to the local host filesystem. These scripts use fs.readFileSync to read files from arbitrary absolute paths provided by the agent and upload them to the configured Outline workspace.

  • Risk: If an agent is compromised or misconfigured, it could potentially exfiltrate sensitive local files by providing their absolute paths to these tools.
  • Scope: Access is limited to the permissions of the user running the OpenClaw process.
  • Recommendation: Only enable this skill in trusted environments and monitor agent logs for unexpected file access patterns.

📋 Prerequisites

Before setting up the skill in OpenClaw, ensure you have completed the following steps in your Outline instance:

  • Enable AI Features: Ensure AI features are enabled for your workspace under Settings -> AI.
  • Enable MCP: In the same AI settings tab, toggle the MCP switch to "On". This enables the Model Context Protocol endpoint for your workspace.
  • Generate API Key: Click Generate API Key (also in the AI tab). Copy this key immediately as it will only be shown once.
  • Locate your MCP URL: Your MCP endpoint is typically your workspace URL with /mcp appended (e.g., https://docs.yourcompany.com/mcp).
  • Node.js Environment: Ensure Node.js (v18+) is installed on your OpenClaw host.

🛠️ Setup & Configuration

To use this skill, you must provide your Outline workspace details via environment variables.

Configuration Commands

openclaw config set skills.entries.outline-app-mcp.env.OUTLINE_API_KEY "your_ol_api_key"
openclaw config set skills.entries.outline-app-mcp.env.OUTLINE_URL "https://your-workspace.getoutline.com/mcp"

🧰 API Reference & Detailed Tool Parameters

The following tools are available via the scripts/mcp_bridge.mjs executor. All arguments are passed as a JSON object.

1. Document Management

list_documents

Searches documents or lists recent ones.
  • query (string, optional): Full-text search query.
  • collectionId (string, optional): Filter by collection.
  • offset (integer, optional): Pagination offset.
  • limit (integer, optional): Max results (default 25, max 100).

read_document

Retrieves the full Markdown content.
  • id (string, required): Unique identifier of the document.

create_document

Creates a new document.
  • title (string, required): Document title.
  • text (string, optional): Markdown content.
  • collectionId (string, required if no parentDocumentId): Target collection.
  • parentDocumentId (string, optional): Nest under this document.
  • icon (string, optional): Emoji icon.
  • color (string, optional): Hex color (e.g., #FF0000).
  • publish (boolean, optional): Default true. Set false for draft.

update_document

Edits an existing document.
  • id (string, required): Document ID.
  • title (string, optional): New title.
  • text (string, optional): New markdown content.
  • editMode (enum: replace, append, prepend, optional): Default replace.
  • collectionId (string, optional): Required when publishing a draft with no collection.
  • icon (string/null, optional): Update or remove emoji.
  • color (string/null, optional): Update or remove hex color.
  • publish (boolean, optional): Publish draft or revert to draft.

move_document

Relocates a document.
  • id (string, required): Document ID.
  • collectionId (string, optional): Target collection.
  • parentDocumentId (string, optional): Target parent document.
  • index (integer, optional): Zero-based position among siblings.

2. Collection Management

list_collections

Lists available collections.
  • query (string, optional): Filter by name.
  • offset (integer, optional): Pagination offset.
  • limit (integer, optional): Max results (max 100).

create_collection

Creates a new collection.
  • name (string, required): Collection name.
  • description (string, optional): Markdown description.
  • icon (string, optional): Emoji icon.
  • color (string, optional): Hex color.

update_collection

Updates collection metadata.
  • id (string, required): Collection ID.
  • name (string, optional): New name.
  • description (string, optional): New description.
  • icon (string/null, optional): Update or remove icon.
  • color (string/null, optional): Update or remove color.

3. Commenting & Collaboration

list_comments

Lists comments (requires documentId or collectionId).
  • documentId (string, optional): Filter by document.
  • collectionId (string, optional): Filter by collection.
  • parentCommentId (string, optional): List only replies to this comment.
  • statusFilter (array of resolved/unresolved, optional): Filter by status.
  • offset (integer, optional): Pagination offset.
  • limit (integer, optional): Max results.

create_comment

Adds a comment to a document.
  • documentId (string, required): Document to comment on.
  • text (string, required): Markdown content.
  • parentCommentId (string, optional): Nest as a reply.

update_comment

Updates or resolves a comment.
  • id (string, required): Comment ID.
  • text (string, optional): New markdown text.
  • status (enum: resolved, unresolved, optional): Resolve thread.

delete_comment

Deletes a comment.
  • id (string, required): Comment ID.

4. User Directory

list_users

Lists workspace members.
  • query (string, optional): Search by name or email.
  • role (enum: admin, member, viewer, guest, optional): Filter by role.
  • filter (enum: active, suspended, invited, all, optional): Filter by status.
  • offset (integer, optional): Pagination offset.
  • limit (integer, optional): Max results.

🚀 Usage Examples (Common Actions)

1. Search for project documentation

OUTLINE_API_KEY="..." OUTLINE_URL="..." node skills/outline-app-mcp/scripts/mcp_bridge.mjs call "list_documents" '{"query": "Project Roadmap"}'

2. Create a new status update

OUTLINE_API_KEY="..." OUTLINE_URL="..." node skills/outline-app-mcp/scripts/mcp_bridge.mjs call "create_document" '{
  "title": "Weekly Sync - April 1",
  "collectionId": "col_uuid_here",
  "text": "# Update\nEverything is on track."
}'

3. Append a new row to a table (Token Efficient)

OUTLINE_API_KEY="..." OUTLINE_URL="..." node skills/outline-app-mcp/scripts/mcp_bridge.mjs call "update_document" '{
  "id": "doc_uuid_here",
  "text": "\n| New Entry | Ready | Link |",
  "editMode": "append"
}'

4. Bulk Upload Images & Update Document (Power-Tool)

Use the bulk_sync.mjs script for unified Turnaround (Upload + Update).
OUTLINE_API_KEY="..." OUTLINE_URL="..." node skills/outline-app-mcp/scripts/bulk_sync.mjs "bulk-sync" "target_doc_id" "/path/1.png,/path/2.png" "## 🎨 New Media Assets\n{{MEDIA}}\n---\nSynced via AI Agent" "append"
  • Inputs:
1. Document ID 2. Comma-separated absolute file paths. 3. Template Text: Use {{MEDIA}} as a placeholder for uploaded images. 4. Edit Mode: replace, append, or prepend.

5. Add a Review Comment to a Document

OUTLINE_API_KEY="..." OUTLINE_URL="..." node skills/outline-app-mcp/scripts/mcp_bridge.mjs call "create_comment" '{
  "documentId": "doc_uuid_here",
  "text": "Draft is ready for review."
}'

6. Relocate a document to a new Collection

OUTLINE_API_KEY="..." OUTLINE_URL="..." node skills/outline-app-mcp/scripts/mcp_bridge.mjs call "move_document" '{
  "id": "doc_uuid_here",
  "collectionId": "new_collection_uuid"
}'

💡 Best Practices

🚀 Token Efficiency & Cost Optimization (Mandatory)

To minimize token consumption and improve responsiveness, always prefer append or prepend modes when adding new information to existing documents.
  • Avoid Full Rewrites: Do NOT use replace mode (default) if you only need to add a new row or section.
  • Bulk Sync for Media: Always use bulk_sync.mjs for uploading multiple images to avoid redundant Turnarounds.

📜 Technical Requirements

  • Runtime: Node.js v18+
  • Protocol: MCP v1.0.0 (over SSE)
  • Dependency: @modelcontextprotocol/sdk (local)
  • Authentication: Bearer Token via OUTLINE_API_KEY
  • Transport: StreamableHTTPClientTransport (POST-based SSE)
数据来源ClawHub ↗ · 中文优化:龙虾技能库