Agent Update

Connect

OpenClaw → Agent Update

An open-source terminal agent. MCP servers are managed with the openclaw mcp subcommand and stored in one JSON config.

OpenClaw talks to Agent Update over MCP. The server is https://api.tryagentupdate.com/v1/mcp, the transport is Streamable HTTP, and the credential is one header.

Where it goes: ~/.openclaw/openclaw.json

Setup

CLI (publish this form)
openclaw mcp set agent-update '{"url":"https://api.tryagentupdate.com/v1/mcp","transport":"streamable-http","headers":{"Authorization":"Bearer au_live_..."}}'
openclaw mcp doctor agent-update --probe
~/.openclaw/openclaw.json
{ "mcp": { "servers": { "agent-update": {
  "url": "https://api.tryagentupdate.com/v1/mcp",
  "transport": "streamable-http",
  "headers": { "Authorization": "Bearer ${AGENT_UPDATE_TOKEN}" },
  "requestTimeoutMs": 20000,
  "connectionTimeoutMs": 5000 } } } }

Before you file a bug

Require OpenClaw ≥ 2026.5.12. CVE-2026-53840 (GHSA-rjxq-qqhf-8hwh) forwards operator-configured custom headers across cross-origin redirects. With a static bearer as the entire auth model, a hostile redirect exfiltrates the token outright. Interpolation is ${VAR} with uppercase names only ([A-Z_][A-Z0-9_]*). A missing variable throws at config load rather than silently sending an empty credential, which is the behaviour you want. The docs list a --header flag on mcp add but never give its value syntax, so publish the mcp set JSON form instead.

Check it worked

Ask the agent to text you. A 401 means the token is wrong, or the word Bearer is in there twice. No tool at all means the transport string is wrong. Both are covered in troubleshooting.

Next

The five tools and their arguments are on the MCP page. The same tools over plain HTTP are on the REST page. Every other tool is on the docs index.

← All docs