@agentapprove/openclaw
Agent Approve plugin for OpenClaw. Approve or deny AI agent tool calls from your iPhone and Apple Watch.
Why Agent Approve?
- Visibility -- see what your OpenClaw agent is doing in real time from your mobile device
- Centralized policy -- define your default stance (allow, deny, or ask) and manage custom allowlists and denylists for tools, parameters, and commands
- Mobile approval -- when human approval is required, review and respond from your iPhone or Apple Watch with a tap
You decide the rules. Agent Approve enforces them.
Important
- A valid Agent Approve subscription is required to use this plugin.
- You must download the iOS app, run
npx agentapprove, and pair your device. - If a valid token is not configured, tool calls are blocked with setup guidance.
How it works
This plugin hooks into OpenClaw's agent loop to enforce your approval policy:
- before_tool_call -- evaluates each tool call against your policy. Auto-allows or auto-denies based on your lists, or sends an approval request to your device when manual review is needed.
- after_tool_call -- logs tool completion to your activity feed
- command/message events -- monitors session activity
Install
openclaw plugins install @agentapprove/[email protected]
Setup
- Download Agent Approve from the App Store and start your 7-day free trial
- Follow the in-app onboarding which will prompt you to run the installer on each machine where you have agents:
npx agentapprove
The installer handles pairing, token setup, and plugin activation. Select OpenClaw when prompted for which agents to configure.
- Restart the OpenClaw gateway to load the plugin
That's it. Tool calls will now be evaluated against your policy, and approval requests will appear on your paired device when needed.
Configuration
Plugin settings in ~/.openclaw/openclaw.json:
{
"plugins": {
"entries": {
"openclaw": {
"enabled": true,
"config": {
"apiUrl": "https://api.agentapprove.com",
"apiVersion": "v001",
"timeout": 300,
"failBehavior": "ask",
"privacyTier": "full",
"agentName": "OpenClaw"
}
}
}
}
}
| Setting | Default | Description |
|---|---|---|
token | from ~/.agentapprove/env | Optional explicit API token override |
apiUrl | https://api.agentapprove.com | Agent Approve API base URL |
apiVersion | v001 | API version prefix |
timeout | 300 | Seconds to wait for an approval response |
failBehavior | ask | Default policy when API is unreachable: allow, deny, or ask |
privacyTier | full | What tool data is stored in event logs: minimal, summary, or full |
debug | false | Write debug logs to ~/.agentapprove/hook-debug.log |
agentName | OpenClaw | Display name sent with approval events |
e2eEnabled | from ~/.agentapprove/env | Toggle E2E key loading for hosted installs |
For hosted or containerized OpenClaw installs, you can keep secrets in the service
environment and reference them from openclaw.json using OpenClaw's config
substitution, for example "token": "${AGENTAPPROVE_TOKEN}".
Requirements
- OpenClaw runtime
- Agent Approve iOS app and active subscription ($14.99/month, 7-day free trial)
Supported agents
Agent Approve works with OpenClaw, OpenCode, Claude Code, Cursor, OpenAI Codex, Google Antigravity, VS Code Copilot, Copilot CLI, Windsurf, Pi, Hermes, OpenHands, and more. Run npx agentapprove to configure multiple agents at once.