OpenClaw | Golem docs

Connect OpenClaw to Golem with the plugin the Golem agent installs, so its tool calls are checked and signed.

There is nothing to configure by hand. Install Golem on the machine that runs the OpenClaw Gateway, and the Golem agent installs its OpenClaw plugin, MCP servers and skills. From then on every tool call OpenClaw makes is checked against your rules before it runs and signed into the record after. Restart the Gateway after the first install so it loads them.

What Golem adds#

Where	What
`~/.openclaw/extensions/golem/`	The Golem plugin: it checks every tool call before it runs and records it after.
`plugins.entries.golem` in `openclaw.json`	`enabled: true`, and `hooks.allowConversationAccess: true` so the plugin can read the prompt you type.
`mcp.servers` in `openclaw.json`	Golem's two MCP servers, `golem-witness` and `golem-context`, over `streamable-http`.
`~/.openclaw/skills/`	Golem's skills, including `/safely`.

The Golem agent recognizes OpenClaw from an openclaw command on the PATH, or the credentials or agents folders OpenClaw itself writes. It honours OPENCLAW_STATE_DIR, and never creates ~/.openclaw on a machine without OpenClaw. If OpenClaw arrives after Golem, the next check (every 15 minutes by default) picks it up. The same check puts the plugin back if its files are deleted or edited. To wire it straight away, run:

golem setup-client

Every other key in openclaw.json is left as it was, and so is any MCP server that is not Golem's. plugins.allow, plugins.deny and plugins.enabled are yours and Golem never edits them. If they keep the plugin from loading, golem setup-client prints a NOT LOADED line naming the setting. Add "golem" to plugins.allow to turn the checks on.

If your config uses JSON5#

openclaw.json may contain comments or trailing commas. Golem will not rewrite a file it cannot parse as plain JSON, because that would strip them, so golem setup-client reports the file and leaves it alone. Add the servers with OpenClaw's own command instead:

openclaw mcp add golem-witness --url http://127.0.0.1:39393/ --transport streamable-http
openclaw mcp add golem-context --url http://127.0.0.1:39393/context/ --transport streamable-http

What a block and a hold look like#

The plugin asks the Golem agent about each call before it runs. A block refuses the call, and OpenClaw shows the reason, which names the rule:

policy block: no-force-push-to-main

A rule set to Ask raises OpenClaw's own approval prompt, titled "Golem: approval required", naming the rule. It offers allow once or deny. Allow always is not offered, because OpenClaw's "always" covers more than one Golem rule and would switch that check off for good.

OpenClaw puts every held call to the person at the keyboard, including one a rule gives to your team or to Golem's reviewer agent.

Type /safely to restrict a session to a read-only profile. The plugin sends the prompt you typed to the Golem agent, which clamps the session itself, so the model cannot talk its way out of it. A machine you quarantine is held to its locked-down toolset the same way. See Safely and Block, hold and contain.

What is recorded#

OpenClaw hook	What Golem does
`before_tool_call`	Checks the call against your rules, and screens any URL or host in its arguments against the threat-intelligence feeds the workspace has set, if any.
`after_tool_call`	Records the tool, its arguments, how long it took and whether it worked. Never the output, and never OpenClaw's error text, which is a slice of the output.
`before_agent_run`	Sends the prompt you typed, which is what arms `/safely`.
`before_prompt_build`	Puts messages other agents sent this one ahead of the turn's prompt, after the Golem agent has checked them for prompt injection. Needs agent messaging on; see Agent coordination.
`llm_output`	Records the agent's reply.

Each entry is signed into the session's record under the agent openclaw.

Settings#

Settings go under plugins.entries.golem.config in openclaw.json:

Key	Default	What it does
`witnessUrl`	`http://127.0.0.1:39393`	Where the Golem agent listens. Also read from `GOLEM_WITNESS_URL`.
`enforce`	`true`	`false` records without ever refusing, for an observe-first rollout.
`captureResponses`	`true`	Whether the agent's replies are recorded.
`timeoutMs`	`3000`	How long to wait for the Golem agent. Capped at 10000.

Check that it is working#

golem status
openclaw mcp probe golem-context

openclaw mcp probe connects to the server and lists its tools, so it proves the Golem agent is reachable, not only that the entry exists. Then, in a session, ask the agent what else is running on this machine; it should answer from Golem's tools. In the console at app.golem.team, open Conversations and look for the agent openclaw.

Limits#

It fails open. OpenClaw treats a policy hook that errors or runs past 15 seconds as a denial, so a plugin that waited on a stopped Golem agent would stop every agent run on the machine. Golem's plugin never throws, waits 3 seconds by default, and lets the call through if there is no answer.
Your plugin policy wins. If plugins.allow or plugins.deny keeps the plugin out, nothing is checked, and only golem setup-client says so.
Every Ask goes to the person at the keyboard. A rule meant for your team or the reviewer agent is decided by whoever approves OpenClaw's prompt.
The shell jail does not apply. It covers Claude Code on macOS. See Shell jail and sandbox.

Remove it#

golem setup-client --remove

That removes Golem's plugin, servers and skills from every AI client on the machine, not only OpenClaw, and records the choice so the periodic check does not put them back. Running golem setup-client again undoes it. To keep Golem wired but stop it looking for new AI tools, turn Wire new AI tools off under Maintenance in the machine's profile (Hosts, Groups & Profiles). To remove Golem entirely, see Uninstall.