You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
No curl | bash, remote-code download/exec, or postinstall RCE.
No reading/exfiltration of secrets, tokens, .env, or env vars.
Hooks and MCP scope are least-privilege — the plugin ships no hooks and a single scoped HTTP MCP server (two tools: search_web_pages, fetch_page_content).
Network endpoints this plugin calls (and why): only https://api.keenable.ai/mcp — Keenable's hosted MCP server, for web search and page extraction.
Credentials/permissions it requires (and why): none. Keyless by default. The server optionally reads a KEENABLE_API_KEY env var to raise rate limits; a key is never required and none is bundled.
Notes for reviewers
Follows the same shape as the existing tavily, exa, and firecrawl entries: a thin remote-source repo (.mcp.json + .grok-plugin/plugin.json + skills) wrapping a hosted MCP endpoint. Like firecrawl, Keenable is keyless by default (public rate-limited path, no signup); an optional API key only lifts limits. Source is published under our official keenableai org.
@ykeremy gentle ping on this one. It has been open since June 20 with no comments, and the Validate catalog workflow has never run: it is stuck on the first-time-contributor approval gate, so the check never reports. Could you approve the workflow run when you get a chance?
Rebased onto current main today, MERGEABLE, 2 files / +35. Socket Security (project report + PR alerts) and semgrep all pass. Locally validate-catalog.py and generate-plugin-index.py --check are both green.
It is a catalog entry only, for keenable-grok-plugin: a thin .mcp.json pointing at our hosted api.keenable.ai/mcp plus two skills, no binary and no login. Like the Firecrawl entry it is keyless by default, so there is nothing for a user to sign up for before the plugin works.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Adds Keenable — a keyless web search + page-content extraction plugin backed by Keenable's hosted MCP server.
keenablehttps://github.com/keenableai/keenable-grok-plugin.git@350fd05a76a3e7bc6b6dbef616f30c9d08ce6c90Ownership
sourcerepo is published under our official org (keenableai/keenable-grok-plugin).Checklist
.grok-plugin/marketplace.json(valid JSON, kebab-casename).sha, public + reachable..grok-plugin/plugin-index.json.python3 scripts/validate-catalog.pypasses locally.python3 scripts/generate-plugin-index.py --checkpasses locally.homepage+ cleardescriptionset.Security
curl | bash, remote-code download/exec, orpostinstallRCE..env, or env vars.search_web_pages,fetch_page_content).https://api.keenable.ai/mcp— Keenable's hosted MCP server, for web search and page extraction.KEENABLE_API_KEYenv var to raise rate limits; a key is never required and none is bundled.Notes for reviewers
Follows the same shape as the existing
tavily,exa, andfirecrawlentries: a thin remote-source repo (.mcp.json+.grok-plugin/plugin.json+ skills) wrapping a hosted MCP endpoint. Likefirecrawl, Keenable is keyless by default (public rate-limited path, no signup); an optional API key only lifts limits. Source is published under our officialkeenableaiorg.