Skip to main content
Glama
pslkk

openclaw-syncralis

by pslkk

Syncralis ๐ŸŒโš™๏ธ

An industry-grade, highly secure Model Context Protocol (MCP) server.

Syncralis provides load-balanced web searching, secure file downloads, and secure external file sharing, built on a hardened, hybrid architecture.

Works with OpenClaw, Cursor, Claude Desktop, and any MCP client that can launch Node-based servers.

๐Ÿš€ Key Features

*Stateless File Sharing: Securely generates public Ngrok download links for files inside your workspace with a maximum of 3 download attempts until expiry.

โš ๏ธ SECURITY WARNING: Generating a download link creates a public tunnel. This makes the specific local workspace file accessible to anyone who possesses the link when you share that link. Ensure you understand this exposure boundary before sharing sensitive local files.

*Load-Balanced Web Search: Intelligently alternates between Tavily and Brave Search APIs to prevent rate-limiting and ensure high availability.

*Secure File Downloads: Downloads files directly to your workspace with strict MIME-type enforcement and streaming size limits to prevent DoS attacks.

*Path Boundary Enforcement: Cryptographically verifies all file requests to prevent directory traversal attacks outside the designated workspace.

Related MCP server: minimal-mcp-web-search

๐Ÿ”‘ Requirements & API Keys (Free Tiers)

Syncralis relies on three external services. Each of these providers offers a generous free tier for developers (subject to their respective Terms and Conditions):

*Ngrok: Provides the secure public tunnel for file downloads. Claim your free static domain at https://ngrok.com.

*Tavily API: Provides AI-optimized web search results. Get your API key at https://tavily.com.

*Brave Search API: Provides the fallback web search index. Get your API key at https://brave.com/search/api/.

๐Ÿ“ฆ Installation

Install the package globally via your terminal:


npm install -g openclaw-syncralis

# OR via Openclaw: openclaw plugins install clawhub:openclaw-syncralis

โš™๏ธ Configuration & Deployment

Syncralis is designed as a hybrid tool. It works perfectly on your native operating system (Windows/Mac/Linux) or securely inside a Dockerized environment.

The Workspace Directory (WORKSPACE_DIR):

The gateway needs a secure folder to store and manage files. We have designed this to be fully automated, but flexible for power users:

*Native / Default Install (Recommended): Leave WORKSPACE_DIR= completely empty (or omit it). The gateway will automatically detect your OS and securely store files in your native home directory: ~/.openclaw/workspace.

*Docker / Custom Environments: If you are running OpenClaw inside a custom Docker container or want to force the gateway to use a specific volume mount, define the absolute path here: WORKSPACE_DIR=/custom/path/to/workspace

Choose the deployment method that matches your OpenClaw setup below:

Option 1: Native NPM Setup (Without Docker):

When running OpenClaw natively on your host machine, Syncralis spins up a secure local HTTP server bound strictly to localhost.

  1. Open a new terminal window and run Ngrok to expose the default port:

    Note: For a production setup, we highly recommend using your static URL from the Ngrok dashboard so your tunnel never changes.


# 1. Authenticate your terminal (Run this once)
ngrok config add-authtoken your_ngrok_token_here

# 2. Start the tunnel using your static URL (Recommended)
ngrok http --url your-custom-url.ngrok-free.app 8080

# Or, using a dynamic URL (Testing only)
ngrok http 8080
  1. Add the generated Ngrok URL to your OpenClaw configuration generally inside (/home/node/.openclaw/openclaw.json):


"mcp": {
  "servers": {
    "syncralis": {
      "command": "node",
      "args": [
        "/home/node/.openclaw/extensions/openclaw-syncralis/server.js"
      ],
      "env": {
        "NODE_ENV": "production",
        "FILE_SERVER_HOST": "127.0.0.1",
        "WORKSPACE_DIR": "",
        "PUBLIC_TUNNEL_URL": "https://your-ngrok-url.ngrok-free.app",
        "NGROK_API_PORT": 4040,
        "TAVILY_API_KEY": "your_tavily_key",
        "BRAVE_API_KEY": "your_brave_key",
        "URL_SIGNING_SECRET": "your_custom_32_character_secret_here"
      }
    }
  }
},
"plugins": {
  "entries": {
    "openclaw-syncralis": {
      "enabled": true
    }
  }
}

Option 2: Docker Environment Setup (Recommended for Production):

OpenClaw often executes tools as ephemeral child processes. In a containerized setup, it is highly recommended to run openclaw alongside Ngrok to serve the workspace volume 24/7. This guarantees your download links remain active even after the MCP process shuts down.

  1. Configure your openclaw.json generally inside (/home/node/.openclaw/openclaw.json):


"mcp": {
  "servers": {
    "syncralis": {
      "command": "node",
      "args": [
        "/home/node/.openclaw/extensions/openclaw-syncralis/server.js"
      ],
      "env": {
        "NODE_ENV": "production",
        "FILE_SERVER_HOST": "0.0.0.0",
        "WORKSPACE_DIR": "",
        "PUBLIC_TUNNEL_URL": "https://your-static-domain.ngrok-free.app",
        "NGROK_API_PORT": 4040,
        "TAVILY_API_KEY": "your_tavily_key",
        "BRAVE_API_KEY": "your_brave_key",
        "URL_SIGNING_SECRET": "your_custom_32_character_secret_here"
      }
    }
  }
},
"plugins": {
  "entries": {
    "openclaw-syncralis": {
      "enabled": true
    }
  }
}
  1. ๐Ÿณ Complete Docker Compose (Just an example only):

If you are running OpenClaw entirely inside Docker, here is a complete, production-ready docker-compose.yml template to get Syncralis and Ngrok running together seamlessly.


version: '3.8'

networks:
 mcp_network:
   driver: bridge

services:
 # Your main OpenClaw instance
 openclaw_gateway:
   image: ghcr.io/openclaw/openclaw:latest # Replace with your actual OpenClaw image or version
   container_name: openclaw_gateway
   restart: unless-stopped
   networks:
     - mcp_network
   ports:
     - "127.0.0.1:18789:18789"
   extra_hosts:
     - "host.docker.internal:host-gateway"
   volumes:
     - ./claw_data:/home/node/.openclaw:rw
     - # Your config file
     - ./workspace:/home/node/.openclaw/workspace:rw
   environment:
     - FILE_SERVER_HOST=0.0.0.0
     - FILE_SERVER_PORT=8080
     - PUBLIC_TUNNEL_URL=https://<your-custom-domain>.ngrok-free.app
     - TAVILY_API_KEY=${TAVILY_API_KEY}
     - BRAVE_API_KEY=${BRAVE_API_KEY}
   deploy:
     resources:
       limits:
         cpus: '2.0' # Hard cap: Cannot exceed 2 CPU cores
         memory: 2G
       reservations:
         memory: 512M

   logging:
     driver: "json-file"
     options:
       max-size: "10m"
       max-file: "5"
       compress: "true"

   healthcheck:
     test: ["CMD", "curl", "-f", "http://localhost:18789"]
     interval: 30s
     timeout: 10s
     retries: 3
     start_period: 40s

 # The Ngrok tunnel pointing to Syncralis's internal file server

 ngrok_tunnel:

   image: ngrok/ngrok:latest
   container_name: ngrok_tunnel
   restart: unless-stopped
   ports:
     - "4040:4040"
   networks:
     - mcp_network
   command: http openclaw_gateway:8080 --url=https://<your-custom-domain>.ngrok-free.app --log=stdout
   environment:
     - NGROK_AUTHTOKEN=${NGROK_AUTHTOKEN}
   depends_on:
     openclaw_gateway:
       condition: service_healthy

๐Ÿ” Advanced Configuration (The .env Method):

If you prefer to maintain "Industry Grade" security and not keep your API keys exposed in your main openclaw.json file, you can securely configure the plugin using a standard .env file directly inside the extension's folder and remove the env block at mcp server configuration in openclaw.json.

๐Ÿ’ป Native OpenClaw (Local / NPM Installation):

  1. Navigate to the plugin's directory:

    
    cd ~/.openclaw/extensions/openclaw-syncralis
    
  2. Create and open the .env file:

    
    nano .env
    
  3. Add your API keys securely:

    
    NODE_ENV=production
    WORKSPACE_DIR=""
    PUBLIC_TUNNEL_URL="https://your-domain.ngrok-free.app"
    NGROK_API_PORT=4040
    URL_SIGNING_SECRET="your_custom_32_character_secret_here"
    TAVILY_API_KEY=your_tavily_key_here
    BRAVE_API_KEY=your_brave_key_here
    FILE_SERVER_HOST=127.0.0.1
    
  4. Save the file (Ctrl + O, Enter, Ctrl + X) and restart your OpenClaw instance.

๐Ÿณ Docker Environment:

  1. Write your API keys directly into a new .env file using notepad:

    
    NODE_ENV=production
    WORKSPACE_DIR=""
    PUBLIC_TUNNEL_URL="https://your-domain.ngrok-free.app"
    NGROK_API_PORT=4040
    URL_SIGNING_SECRET="your_custom_32_character_secret_here"
    TAVILY_API_KEY=your_tavily_key_here
    BRAVE_API_KEY=your_brave_key_here
    FILE_SERVER_HOST=0.0.0.0
    
  2. Open a terminal session directly inside the gateway's plugin directory:

    
    docker cp "C:/path/to/your/.env" container_name:/home/node/.openclaw/extensions/openclaw-syncralis/.env
    
  3. Restart your OpenClaw gateway to apply the secure variables:

    
    docker restart container_name
    

๐Ÿ›ก๏ธ Security Parameters

  • MAX_QUERY_LENGTH: Defaults to 2000 characters.

  • TIMEOUT_MS: Defaults to 10000ms (10 seconds) to prevent hung API calls.

  • MAX_DOWNLOAD_ATTEMPTS: Defaults to 3 attempts with same generated download link.

  • CONFIRM_TOKEN_TTL_MS: Defaults to 5 minutes and specifies the time window within which the user must verify and confirm the correct file to generate a secure download link.

Size Limits: Syncralis enforces a hard limit of 50MB for all file reads and downloads to prevent memory exhaustion.

๐Ÿ—‘๏ธ Uninstallation

If you need to remove the plugin, follow the instructions for your specific environment below.

๐Ÿ’ป Native OpenClaw (Local / NPM Installation):

*The Standard Method:


openclaw plugins uninstall openclaw-syncralis

*The "Hard Reset" (If the CLI fails):


rm -rf ~/.openclaw/extensions/openclaw-syncralis

๐Ÿณ Docker Environment:

*The Standard Method:


docker exec -it container_name openclaw plugins uninstall openclaw-syncralis

*The "Hard Reset" (If the CLI fails):


docker exec -it container_name rm -rf /home/node/.openclaw/extensions/openclaw-syncralis

๐Ÿงน Final Cleanup (Both Environments):

After uninstalling via either method:

  1. Open your openclaw.json file.

  2. Delete the openclaw-syncralis blocks from both the "plugins" and "mcp" sections.

  3. Restart your OpenClaw environment (or run docker restart container_name) for a perfectly clean boot.

๐Ÿ’ฌ Usage Examples (Prompts)

Once connected, you can ask your OpenClaw agent to perform complex I/O tasks:

**"Search the web for the latest advancements in solid-state batteries using syncralis mcp tool."*

**"Download the PDF from [URL] and save it as report.pdf using syncralis mcp tool."*

**"Download Tesla Model Y pdf from genuine sources and save it as tesla_model_y.pdf using syncralis mcp tool."*

**"Generate a mobile download link for report.pdf using syncralis mcp tool."*


Built for resilient, secure agentic workflows.

Available Tools

4 tools
download_from_urlB

Downloads a file directly from a public or authenticated HTTP/HTTPS URL and saves it to the workspace.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesThe direct HTTP/HTTPS URL of the file to download.
fileNameYesThe name to save the downloaded file as (e.g., report.pdf).
headersNoOPTIONAL: JSON object of HTTP headers for authenticated/secure URLs.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description must cover behaviors fully. It mentions authenticated URLs and headers but does not specify file size limits, timeout, overwrite behavior, or error handling. Significant gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence covering the core action, which is concise. However, it could be more structured (e.g., bullet points) for clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description covers basic purpose but omits important context like supported file types, size limits, and error scenarios. Adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds no extra meaning beyond the schema's own param descriptions; all three parameters are already documented in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool downloads a file from a public or authenticated HTTP/HTTPS URL and saves it to the workspace, distinguishing it from sibling tools like share_files and web_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for downloading files but provides no explicit when-to-use, when-not-to-use, or alternative tool guidance. The meaning is clear only in context of sibling names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

save_shared_fileA

Saves a file provided directly by the AI agent into the workspace. Use this to save generated images, PDFs, DOCX, or text files without needing an external URL download. Binary files MUST be provided as base64 encoded strings.

ParametersJSON Schema
NameRequiredDescriptionDefault
fileNameYesThe name of the file to save, including the exact extension (e.g., target_image.png, report.pdf).
contentYesThe raw content of the file. For binary files like images and PDFs, this MUST be a base64 encoded string.
encodingNoThe encoding of the provided content. Use 'base64' for images/documents and 'utf-8' for plain text. Defaults to 'base64'.

TDQS

A4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It only covers the encoding requirement for binary files but does not mention whether saves overwrite existing files, required permissions, workspace scope, size limits, or success/error responses. This significant gap limits transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with essential information, and every sentence contributes meaning. No redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no output schema or annotations, the description covers the core purpose, usage context, and a critical encoding rule. However, it omits mention of return values, overwrite behavior, and workspace implications. These are minor gaps given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds value by explaining that binary files must be base64 encoded and that the encoding parameter defaults to 'base64' (implied by the mandatory base64 requirement). It also advises including file extensions in fileName. This guidance goes beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb 'Saves' and specifies the resource 'file' into the workspace. It also distinguishes the tool from the sibling 'download_from_url' by explicitly stating that it avoids needing an external URL download, making its unique purpose evident.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear when-to-use guidance: 'Use this to save generated images, PDFs, DOCX, or text files without needing an external URL download.' This contrasts with the download tool, but does not explicitly mention alternatives like 'share_files' for sharing existing files, nor does it list exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

share_filesA

Reads or shares workspace files. Three actions are available: 'read' โ€” return file contents inline. For PDFs: (1) If the user specifies a page number, read that range directly using pageStart/pageEnd. (2) If searching for a topic, first read pages 1-10 to find the Table of Contents. If no TOC is found in pages 1-10, extend to pages 1-20, then check the final 10 pages as some PDFs place the index at the back. (3) If the PDF has no TOC, scan in 15-page chunks from the beginning until the topic is located. (4) Always read in chunks of 20 pages or fewer. Never request the full PDF in a single call. (5) If a section appears to continue beyond the chunk boundary, read the next chunk to complete it. (6) For PDFs under 15 pages total, reading the entire document in one call is acceptable. 'preview' โ€” REQUIRED first step before sharing. Returns file metadata (name, size, type, modified) and a short-lived confirmationToken. Present ALL metadata to the user and ask for explicit approval before proceeding. Never skip this step. 'download' โ€” generate a public download link. Requires the confirmationToken returned by a prior 'preview' call for the same file. A link CANNOT be generated without a valid token.

ParametersJSON Schema
NameRequiredDescriptionDefault
filePathYesThe name of the file inside the workspace (e.g., invoice.pdf)
actionYesread | preview | download. Always call 'preview' before 'download'.
confirmationTokenNoRequired for action=download. The token returned by the preceding 'preview' call for this exact file.
pageStartNoPDF files only. The first page to return, 1-based (page 1 = first page). Omit only if the PDF is under 15 pages total and you intend to read the whole file.
pageEndNoPDF files only. The last page to return, inclusive and 1-based. Keep the range between pageStart and pageEnd to 20 pages or fewer to avoid context overflow. If the content you need continues beyond pageEnd, make a follow-up call with the next range. Omit only if the PDF is under 15 pages total.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully carries the behavioral burden. It transparently discloses the multi-step algorithm for PDF reading, the necessity of confirmationToken for download, and that preview returns metadata. However, it does not mention potential side effects or permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is verbose, especially the PDF reading algorithm (6 bullet-like points). While well-structured and front-loaded with actions, it could be more concise without losing necessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters with full schema coverage and no output schema, the description covers all necessary usage context, including workflow constraints and edge cases for PDFs. It is complete for an agent to correctly invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 100% schema coverage, the description adds substantial meaning beyond the schema. For pageStart and pageEnd, it explains chunking and TOC search strategies. For confirmationToken, it clarifies dependency on preview call. The description compensates richly for any missing schema details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads or shares workspace files with three distinct actions: read, preview, download. It effectively distinguishes from sibling tools like download_from_url (different source) and save_shared_file (different action).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit workflow: always call 'preview' before 'download', and detailed PDF reading strategies (chunked reading, TOC search, etc.). It tells agents when to use each action and gives step-by-step instructions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv3.0.0
    • Addedsave_shared_file
    • Changedshare_files2 fields changed
      • addedInput schema / properties / pageEnd
        Added value: +{
        +  "description": "PDF files only. The last page to return, inclusive and 1-based. Keep the range between pageStart and pageEnd to 20 pages or fewer to avoid context overflow. If the content you need continues beyond pageEnd, make a follow-up call with the next range. Omit only if the PDF is under 15 pages total.",
        +  "type": "number"
        +}
      • addedInput schema / properties / pageStart
        Added value: +{
        +  "description": "PDF files only. The first page to return, 1-based (page 1 = first page). Omit only if the PDF is under 15 pages total and you intend to read the whole file.",
        +  "type": "number"
        +}
  2. 3 tool updates
    • First observeddownload_from_url
    • First observedshare_files
    • First observedweb_search

TDQS

A4.1/5.0
Disambiguation5/5

Each tool targets a distinct function: downloading from URLs, sharing workspace files with specific actions, and web search. No overlap in purpose.

Naming Consistency5/5

All tools use consistent verb_noun snake_case naming: download_from_url, share_files, web_search. No mixing of conventions.

Tool Count5/5

3 tools is well-scoped for a small utility server providing external download, file sharing, and web search. Not too few or too many.

Completeness5/5

The tool surface covers essential operations: downloading external files, reading/sharing workspace files (with a proper preview-then-download workflow), and web search. No obvious missing functionality.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    A
    quality
    D
    maintenance
    Provides local LLMs with web search and page fetching capabilities via MCP, with a focus on OWASP security best practices.
    2
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Unified MCP server that bridges Tavily and Brave Search APIs with key management, rate limiting, and an admin UI for monitoring and configuration.
    15
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    A multi-function Streamable HTTP MCP tool aggregation server that provides web search via Brave, Exa, and SearXNG with multi-key rotation and cross-provider fallback, and supports extensible tool families (URL fetch, code search, RAG) through a pluggable architecture.
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/pslkk/openclaw-syncralis'

If you have feedback or need assistance with the MCP directory API, please join our Discord server