setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
OloLand authenticates via OAuth (one-click sign-in) — there is no key to copy for normal use. The plugin's MCP server is OAuth-native: connecting it opens a sign-in page at api.ololand.ai, you approve, and you're done.
plugin settings. On Cursor and Grok Bot this is the connector bundled by the Cursor-format plugin (.mcp.json → https://api.ololand.ai/mcp).
in with email or Google and click Approve.
/dd-analyze — Run bounded extraction, risk, and financial-snapshot processing for a deal; cross-document reconciliation is a separate explicit tool/workflow/similar-deals — Find comparable transactionsIf you see OloLand tools in your tools list, you're connected.
The sign-in runs on a single canonical host and self-heals the browser handoff, so it works in Cowork and Desktop. If a sign-in window doesn't return on the first try, just reconnect the server and approve again.
Automated environments can't do an interactive sign-in, so they use a long-lived agent key as a Bearer token. One command does the wiring — no hand-editing JSON:
key**, starts with olo_agent_sk_), and export it:
export OLOLAND_AGENT_KEY=olo_agent_sk_....mcp.json,preserving any servers already there:
"${CLAUDE_PLUGIN_ROOT}/scripts/setup_headless.sh"The config references ${OLOLAND_AGENT_KEY} rather than the literal key, so the secret stays in your environment, not on disk. Flags: --config <path> targets a different file; --inline-key writes the literal key for ephemeral CI that can't set an env var (gitignore that config).
(If you're asking Claude to set this up, it can run that script for you.)
<details> <summary>Manual config — equivalent to what the script writes</summary>
The published plugin manifest is OAuth-native and sends no header, so add the OloLand server to your own MCP config with an Authorization header:
{
"mcpServers": {
"ololand": {
"type": "http",
"url": "https://api.ololand.ai/mcp",
"headers": { "Authorization": "Bearer ${OLOLAND_AGENT_KEY}" }
}
}
}</details>
The agent key works in every MCP host and never expires until you revoke it.
Reconnect it and complete the OAuth sign-in (interactive), or check your OLOLAND_AGENT_KEY + Authorization header (headless).
the handoff is self-healing and the second attempt typically completes. If it still stalls, generate an agent key (see Headless / CI) and use that.
[email protected] to upgrade.
60 seconds (Cloud Run cold start).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.