ClawLens

Agent observability and guardrails for OpenClaw.
See every tool call, understand the risk, and add guardrails from the same dashboard.

ClawLens is a local OpenClaw plugin for monitoring agent activity. It records tool calls, scores risky behavior, shows live sessions in a dashboard, and lets you create block, require_approval, or allow_notify guardrails from real agent actions.

Use it when your agents can run shell commands, edit files, call external APIs, or operate across multiple sessions and you want an audit trail plus operator-controlled guardrails.

_{Watch the 2-minute product demo}

Quickstart

ClawLens requires a running OpenClaw gateway (>= 2026.4.0).

openclaw plugins install @nk3750/openclaw-clawlens

Open the dashboard:

http://localhost:18789/plugins/clawlens/

Your agents appear after their first tool call. The standard npm install path updates OpenClaw's plugin config automatically; you do not need to edit ~/.openclaw/openclaw.json by hand.

openclaw plugins install clawlens --marketplace nk3750/clawlens

git clone https://github.com/nk3750/clawlens.git
cd clawlens
npm install
openclaw plugins install ./

Why ClawLens

Agents often take many small actions before the one that matters. ClawLens gives you the activity stream, risk context, and guardrail controls in one place.

How It Works

1. OpenClaw runs your agents and tool calls as usual.
2. ClawLens observes each tool call, computes a deterministic local risk score, redacts common credential patterns, and writes an audit entry.
3. The local dashboard updates with agents, sessions, risk mix, recent actions, and Attention Inbox items.
4. When you create a guardrail, matching future tool calls can be blocked, paused for approval, or allowed with a local notification record.

No SDK, proxy, database, or separate service stack is required.

Guardrails

Guardrails are rules you create from real activity.

Rules can match specific commands, paths, URLs, tools, agents, or broader patterns. They can apply to one agent or the whole fleet.

Data Handling

ClawLens is designed for local operation by default. It is still an observability plugin, so it sees tool names and tool parameters; treat its audit log like other sensitive development logs.

On POSIX systems, ClawLens creates the audit directory/file with owner-only permissions where supported. On Windows, audit-log access follows the parent directory's ACLs.

To remove local audit history:

rm -f ~/.openclaw/clawlens/audit.jsonl

Optional LLM Evaluation

LLM evaluation is disabled unless you set risk.llmEnabled=true. When enabled, ClawLens can use your configured OpenClaw LLM provider to add context to eligible risk evaluations and generate session summaries.

When enabled, ClawLens sends a redacted JSON payload containing:

• current tool name
• redacted current tool parameters
• up to 5 recent actions with tool name, redacted parameters, and risk score
• preliminary deterministic risk score, tier, and tags

ClawLens does not read LLM API keys from environment variables and does not send LLM API keys in prompts. Provider credentials are handled by OpenClaw's model/auth runtime.

Redaction is best-effort. ClawLens removes common credential patterns before LLM evaluation, but you should still avoid placing secrets in tool parameters.

Configuration

Most users do not need custom configuration. Common settings live under plugins.entries.clawlens.config in ~/.openclaw/openclaw.json.

risk.llmEvalThreshold only controls opt-in LLM evaluation. It does not control guardrail matching or Attention Inbox freshness. Guardrails fire when a user-created rule matches. alerts.threshold only controls generic high-risk alerts when alerts.enabled=true.

Scope And Limits

ClawLens complements OpenClaw's built-in security. It does not replace tool profiles, exec approvals, prompt-injection detection, OS permissions, or secret scanning.

• Guardrails enforce on OpenClaw tool calls. They do not inspect every byte inside arbitrary payloads.
• Pattern matching catches obvious risky shapes, but ClawLens is not a full shell interpreter.
• LLM evaluation can add context when explicitly enabled; deterministic local scoring remains the default.
• The audit log is tamper-evident, not encrypted or hidden from your OS user, backups, or administrators.
• Sub-agents are observed and scored, but guardrails set for a parent agent do not automatically apply to spawned children.

FAQ

Contributing

PRs welcome. See CONTRIBUTING.md. All changes need tests, and npm run check must pass before merge.

Reporting Issues

• Bugs: open a GitHub issue
• Security: see SECURITY.md

License

MIT. See LICENSE.