> For the complete documentation index, see [llms.txt](https://cerebral-systems.gitbook.io/cerebral-systems-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cerebral-systems.gitbook.io/cerebral-systems-docs/getting-started-1/agent-integration/openclaw.md).

# OpenClaw

OpenClaw can consume Warrant as an MCP tool server. The OpenClaw agent chooses a bounded action; the Warrant MCP tool converts it into a proposal; Warrant decides whether it may run and owns the provider-side execution.

```mermaid
flowchart LR
  U[User or channel] --> O[OpenClaw agent]
  O -->|MCP tool call| C[Warrant proposal tool]
  C -->|POST /v1/actions| W[Warrant]
  W --> P[Policy and approval]
  P --> A[Deployment-side actuator]
  A --> S[External system]
```

Warrant does **not** belong between OpenClaw and its model provider. It belongs at the tool-execution seam, after the model has produced structured arguments and before anything uses a provider credential.

### Current integration status

This repository includes a narrow stdio MCP example at `tools/warrant_mcp_server.py`. It exposes `request_deploy_action`; it is useful for a first integration and must be extended with reviewed, operation-specific tools for a production catalog.

There is not yet a published Warrant OpenClaw plugin or ClawHub package. OpenClaw's native MCP configuration is the shortest current path. A dedicated OpenClaw tool plugin is a reasonable packaging follow-up, but it must preserve the same boundary.

### Connect the example MCP server

Add a Warrant stdio server under OpenClaw's `mcp.servers` configuration. Use an absolute repository path and a tenant-scoped **agent** key:

```json5
{
  mcp: {
    servers: {
      warrant: {
        command: "python",
        args: ["/absolute/path/to/warrant/tools/warrant_mcp_server.py"],
        env: {
          WARRANT_URL: "https://warrant.example.com",
          WARRANT_API_KEY: "<tenant-agent-key>",
          WARRANT_AGENT_ID: "openclaw-agent",
          WARRANT_RUN_ID: "openclaw-primary",
          WARRANT_TARGET_SYSTEM: "openclaw.tool.deploy",
        },
        supportsParallelToolCalls: false,
        toolFilter: {
          include: ["request_deploy_action"],
        },
      },
    },
  },
}
```

Install the Python MCP dependency used by the example server, restart or reload the OpenClaw Gateway, and confirm the tool is present in effective tool discovery. Keep parallel calls disabled for mutating operations unless the entire operation catalog and downstream system are safe under concurrency.

### Make it the action boundary

Connecting Warrant adds a guarded route; it does not remove unguarded routes. For the OpenClaw agent that can mutate production:

1. expose proposal-backed Warrant tools for the approved operations;
2. remove or deny direct provider MCP tools and mutating plugins for those systems;
3. do not place provider tokens in OpenClaw, its workspace, or the Warrant MCP process;
4. keep provider credentials only in Warrant's deployment-side actuator;
5. restrict `exec`, browser, and network paths that could call the provider directly;
6. treat `needs_approval`, `deny`, `202`, and `outcome_unknown` as terminal workflow states, not instructions to try another tool.

OpenClaw tool policy controls which tools the model can see, while Warrant policy controls whether a submitted operation can execute. Use both: tool hiding reduces the attack surface; Warrant provides the authenticated decision and execution record.

### Proposal mapping

| OpenClaw value           | Warrant field                           |
| ------------------------ | --------------------------------------- |
| Stable logical action id | `proposal_id`                           |
| Agent and session labels | `actor.agent_id`, `actor.run_id` claims |
| Tool family              | `action.target_system`                  |
| Tool name                | `action.operation`                      |
| Parsed tool arguments    | `action.parameters`                     |
| Human-readable intent    | `summary`                               |
| Claimed impact           | `risk`                                  |

The API key establishes `authenticated_principal`. OpenClaw-provided actor and risk values remain claims; the operation catalog supplies trusted semantics and minimum risk.

### Validate the integration

* A known low-risk operation reaches the expected Warrant verdict.
* A catalog operation with higher minimum risk cannot be downgraded by tool arguments.
* Extra or malformed arguments fail before policy evaluation.
* A held action does not cause any OpenClaw fallback tool to call the provider.
* Approval causes Warrant's actuator—not OpenClaw—to perform the side effect.
* Retrying the same logical action reuses a stable `proposal_id` in a production tool.

### What this does not secure

Warrant cannot stop an OpenClaw agent that retains another provider credential, unrestricted shell or browser access, or network access to the provider API. It also does not secure model prompts, channel authentication, OpenClaw plugins, the host, or the model-inference path. Raw network/process egress enforcement remains a separate deployment control.

Framework references: [OpenClaw capability surfaces](https://docs.openclaw.ai/tools), [MCP configuration](https://docs.openclaw.ai/gateway/configuration-reference#mcp), and [tool plugin development](https://docs.openclaw.ai/plugins/building-plugins).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cerebral-systems.gitbook.io/cerebral-systems-docs/getting-started-1/agent-integration/openclaw.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.