# OpenClaw

> Connect OpenClaw to Golem with the plugin the Golem agent installs, so its tool calls are checked and signed.

There is nothing to configure by hand. [Install Golem](/install) on the machine that runs the OpenClaw Gateway, and the Golem agent installs its OpenClaw plugin, MCP servers and skills. From then on every tool call OpenClaw makes is checked against your [rules](/rules) before it runs and signed into the record after. Restart the Gateway after the first install so it loads them.

## What Golem adds

| Where | What |
|---|---|
| `~/.openclaw/extensions/golem/` | The Golem plugin: it checks every tool call before it runs and records it after. |
| `plugins.entries.golem` in `openclaw.json` | `enabled: true`, and `hooks.allowConversationAccess: true` so the plugin can read the prompt you type. |
| `mcp.servers` in `openclaw.json` | Golem's two MCP servers, `golem-witness` and `golem-context`, over `streamable-http`. |
| `~/.openclaw/skills/` | Golem's skills, including `/safely`. |

The Golem agent recognizes OpenClaw from an `openclaw` command on the `PATH`, or the `credentials` or `agents` folders OpenClaw itself writes. It honours `OPENCLAW_STATE_DIR`, and never creates `~/.openclaw` on a machine without OpenClaw. If OpenClaw arrives after Golem, the next check (every 15 minutes by default) picks it up. The same check puts the plugin back if its files are deleted or edited. To wire it straight away, run:

```bash
golem setup-client
```

Every other key in `openclaw.json` is left as it was, and so is any MCP server that is not Golem's. `plugins.allow`, `plugins.deny` and `plugins.enabled` are yours and Golem never edits them. If they keep the plugin from loading, `golem setup-client` prints a `NOT LOADED` line naming the setting. Add `"golem"` to `plugins.allow` to turn the checks on.

### If your config uses JSON5

`openclaw.json` may contain comments or trailing commas. Golem will not rewrite a file it cannot parse as plain JSON, because that would strip them, so `golem setup-client` reports the file and leaves it alone. Add the servers with OpenClaw's own command instead:

```bash
openclaw mcp add golem-witness --url http://127.0.0.1:39393/ --transport streamable-http
openclaw mcp add golem-context --url http://127.0.0.1:39393/context/ --transport streamable-http
```

## What a block and a hold look like

The plugin asks the Golem agent about each call before it runs. A **block** refuses the call, and OpenClaw shows the reason, which names the rule:

```text
policy block: no-force-push-to-main
```

A rule set to Ask raises OpenClaw's own approval prompt, titled "Golem: approval required", naming the rule. It offers **allow once** or **deny**. *Allow always* is not offered, because OpenClaw's "always" covers more than one Golem rule and would switch that check off for good.

OpenClaw puts every held call to the person at the keyboard, including one a rule gives to your team or to Golem's reviewer agent.

Type `/safely` to restrict a session to a read-only profile. The plugin sends the prompt you typed to the Golem agent, which clamps the session itself, so the model cannot talk its way out of it. A machine you [quarantine](/response#quarantine-a-machine) is held to its locked-down toolset the same way. See [Safely](/response#safely) and [Block, hold and contain](/response).

## What is recorded

| OpenClaw hook | What Golem does |
|---|---|
| `before_tool_call` | Checks the call against your rules, and screens any URL or host in its arguments against the threat-intelligence feeds the workspace has set, if any. |
| `after_tool_call` | Records the tool, its arguments, how long it took and whether it worked. Never the output, and never OpenClaw's error text, which is a slice of the output. |
| `before_agent_run` | Sends the prompt you typed, which is what arms `/safely`. |
| `before_prompt_build` | Puts messages other agents sent this one ahead of the turn's prompt, after the Golem agent has checked them for prompt injection. Needs agent messaging on; see [Agent coordination](/coordination). |
| `llm_output` | Records the agent's reply. |

Each entry is signed into the session's [record](/record) under the agent `openclaw`.

### Settings

Settings go under `plugins.entries.golem.config` in `openclaw.json`:

| Key | Default | What it does |
|---|---|---|
| `witnessUrl` | `http://127.0.0.1:39393` | Where the Golem agent listens. Also read from `GOLEM_WITNESS_URL`. |
| `enforce` | `true` | `false` records without ever refusing, for an observe-first rollout. |
| `captureResponses` | `true` | Whether the agent's replies are recorded. |
| `timeoutMs` | `3000` | How long to wait for the Golem agent. Capped at 10000. |

## Check that it is working

```bash
golem status
openclaw mcp probe golem-context
```

`openclaw mcp probe` connects to the server and lists its tools, so it proves the Golem agent is reachable, not only that the entry exists. Then, in a session, ask the agent what else is running on this machine; it should answer from Golem's tools. In the console at [app.golem.team](https://app.golem.team), open **Conversations** and look for the agent `openclaw`.

## Limits

- **It fails open.** OpenClaw treats a policy hook that errors or runs past 15 seconds as a denial, so a plugin that waited on a stopped Golem agent would stop every agent run on the machine. Golem's plugin never throws, waits 3 seconds by default, and lets the call through if there is no answer.
- **Your plugin policy wins.** If `plugins.allow` or `plugins.deny` keeps the plugin out, nothing is checked, and only `golem setup-client` says so.
- **Every Ask goes to the person at the keyboard.** A rule meant for your team or the reviewer agent is decided by whoever approves OpenClaw's prompt.
- **The shell jail does not apply.** It covers Claude Code on macOS. See [Shell jail and sandbox](/shield).

More in [Coverage](/coverage) and [Limits](/limits).

## Remove it

```bash
golem setup-client --remove
```

That removes Golem's plugin, servers and skills from every AI client on the machine, not only OpenClaw, and records the choice so the periodic check does not put them back. Running `golem setup-client` again undoes it. To keep Golem wired but stop it looking for new AI tools, turn **Wire new AI tools** off under **Maintenance** in the machine's profile (**Hosts, Groups & Profiles**). To remove Golem entirely, see [Uninstall](/install#uninstall).