Chatwoot Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Chatwoot Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Local Node/TypeScript MCP split for read-only Chatwoot analytics.
This service is intended to replace the MCP surface of the current Python combined server after shadow testing. It does not process Chatwoot webhooks and does not generate embeddings.
This repo has Node/TypeScript registrations for all 66 Python MCP tools from the previous combined server, plus Node-first read-only tools for clearer agent workflows.
For recent conversation audit requests like "last 7 days all conversations summary per inbox", agents should use get_recent_resolved_conversation_summaries_by_inbox. It returns cached resolved conversations grouped by account/inbox with each Chatwoot conversation ID and a compact transcript summary. If the user names an account, brand, inbox, product, or channel, call list_available_chatwoot_scope first and pass selected account_id and/or inbox_ids.
Semantic/vector tools remain embedding-free in this repo. They call the split Python embedding service through:
EMBEDDING_SERVICE_URL=http://127.0.0.1:8000
EMBEDDING_API_KEY=YOUR_EMBEDDING_SERVICE_X_API_KEYTool parity notes are tracked in docs/PORTING_CHECKLIST.md.
Default mode is stdio:
npm run build
npm startHTTP mode:
npm run build
npm run start:httpLegacy SSE compatibility mode uses the same HTTP server:
npm run start:sseRoutes are mounted under BASE_PATH:
GET ${BASE_PATH}/healthPOST/GET ${BASE_PATH}/mcp for Streamable HTTPGET ${BASE_PATH}/sse for legacy SSEPOST ${BASE_PATH}/messages for legacy SSE client messagesIf MCP_API_KEY is set, Authorization: Bearer <key> is required.
npm install
cp .env.example .env
npm run build
npm run start:httpWindows PowerShell:
npm install
Copy-Item .env.example .env
npm run build
npm run start:httpRun locally with a non-production port/path:
PORT=3010
BASE_PATH=/node-mcpThen compare selected tools against the live Python MCP before exposing this behind Nginx.
Use path-preserving proxying. Do not depend on rewrite-only behavior because SSE advertises the POST message URL back to clients.
location /node-mcp/ {
proxy_pass http://127.0.0.1:3010/node-mcp/;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Authorization $http_authorization;
proxy_buffering off;
proxy_read_timeout 3600s;
}Keep the live Python MCP endpoint unchanged until:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.