Policy telemetry for OpenClaw, with the boundary stated.
AgentGuard’s TypeScript package includes a structural before_tool_call HTTP hook. It can send observed events for policy evaluation and return a block result. The hook can be disabled or bypassed and owns no raw capability, so it is not firewall proof.
A fleet you can’t see is a fleet you can’t defend.
Tool access is consequential
The malevolent “Clawdbot” investigation showed how easy it is for an autonomous agent to take consequential actions. Read the Wired investigation.
Detection is not mediation
FleetDM’s research on detecting OpenClaw with automated tooling describes ways to detect agent processes. Detection can inform an inventory, but it does not prove that a tool capability is held behind a separate executor identity.
The proof boundary
Firewall proof requires OpenClaw to see only a mediated MCP-stdio tool while a separately owned broker alone retains the raw capability. That topology is still being tested.
A versioned compatibility hook.
The TypeScript package exposes a structural OpenClaw plugin that registers a before_tool_call hook and sends the observed proposal to the AgentGuard HTTP API.
Strict mode can return a block result when evaluation fails; permissive mode allows on error. Neither mode owns the underlying tool capability under a separate identity. See OpenClaw for the runtime project itself.
{
"plugins": {
"entries": {
"agentguard": {
"enabled": true,
"config": {
"apiKey": "${AGENTGUARD_API_KEY}",
"agentId": "my-agent",
"strict": true
}
}
},
"installs": {
"agentguard": {
"source": "npm",
"spec": "@the-bot-club/agentguard@0.11.2"
}
}
}
}Compatibility events, not fleet proof.
The hook can report observed tool-call proposals and policy results. This does not prove complete fleet coverage, non-bypassability, production use, or independent capability ownership.