@atbash/atbash-openclaw
OpenClaw plugin that gates every tool call against the ATBASH policy service. A thin adapter on top of @atbash/sdk — the SDK does the audit pipeline, this package wires it into OpenClaw's before_tool_call hook.
If you're not using OpenClaw and want to use ATBASH from your own code, install the SDK directly.
Install
openclaw plugins install @atbash/[email protected]
The judge endpoint and chain ids are compiled into the build, so the version selects the environment. A -dev.N version targets the development environment. openclaw plugins list shows which you have. No configuration repoints a build afterwards — the wrong one loads cleanly, fires its hook, and then fails every judge call because the agent does not exist on the chain that build targets. Organization names are not unique across environments, so a resolving org name is not proof the build is right.
The plugin signs audit transactions locally with your agent's secp256k1 private key. The key never leaves your machine; only signed bytes plus the corresponding public key are transmitted.
Get an agent key
The plugin reads from ~/.config/atbash/guard-client-key by default. The file is JSON:
{
"privKey": "your-hex-private-key-64-chars",
"pubKey": "your-hex-public-key-66-chars"
}
…or key=value:
privkey=your-hex-private-key-64-chars
pubkey=your-hex-public-key-66-chars
Contact the ATBASH team to register an agent and obtain a key pair.
Configure it in OpenClaw
openclaw plugins install already recorded where the plugin lives, enabled it, and — if you keep a
plugins.allow list — added atbash-openclaw to it. Never hand-write the install directory: OpenClaw has
moved it between releases and records whichever it used, which is what it loads from. openclaw plugins list
shows the current state.
All that is left is your configuration. Open ~/.openclaw/openclaw.json and add, keeping the plugins
already there:
{
"plugins": {
"entries": {
"atbash-openclaw": {
"enabled": true,
"config": {
"enabled": true,
"enforceDecision": true,
"chromiaSecretPath": "~/.config/atbash/guard-client-key",
"orgName": "<your org name>"
},
"hooks": {
"allowConversationAccess": true,
"allowPromptInjection": true
}
}
}
}
}
Advanced configuration
The snippet below shows every supported config field with inline comments. Remove fields you don't need — all are optional except orgName (required when your org is on a private chain).
{
"plugins": {
"entries": {
"atbash-openclaw": {
"enabled": true,
"config": {
"enabled": true,
"enforceDecision": true,
"chromiaSecretPath": "~/.config/atbash/guard-client-key",
"orgName": "<your-org-name>",
"debug": false,
// --- Memory guard (optional) ---
// Root directory used to locate the memory pointer file and MEMORY.md.
"memoryWorkspaceDir": "~/.openclaw/workspace",
// Or set an explicit path to MEMORY.md (overrides memoryWorkspaceDir):
// "memoryFilePath": "~/.openclaw/workspace/MEMORY.md",
// How long (ms) to trust the local memory-chain cache before re-fetching.
"memorySyncTTLMs": 30000,
// Block memory reads when a rolled-back version scores below this (1–10).
// Default 1 = warn only. Raise to e.g. 3 to refuse poisoned rollbacks.
"memoryRollbackMinScore": 1,
// Additional path substrings to classify as memory (extends SDK built-ins).
// "memoryPathPatterns": ["/my-agent/memory/"],
// --- Self-hosted judge (optional, advanced) ---
// "judgeEndpoint": "https://your-judge.example.com/api/v1/judge",
// "judgeEndpointPolicy": "self-hosted",
// "judgeVerifyPubKey": "<66-hex-char-secp256k1-pubkey>"
},
"hooks": {
"allowConversationAccess": true,
"allowPromptInjection": true
}
}
}
}
}
The plugin id is atbash-openclaw — it comes from the id field in this package's openclaw.plugin.json,
not from the npm package name. A plugins.entries key that does not match the id is not an error: the
plugin loads unconfigured and audits nothing.
Config fields
| Field | Type | Default | What it does |
|---|---|---|---|
enabled | bool | true | Master switch. false = plugin returns immediately. |
enforceDecision | bool | true | Fail-closed switch. When true (default), verdicts of BLOCK, HOLD, ERROR, and any unrecognized verdict block the tool call. When false, the plugin runs fail-open: all verdicts allow the tool call through and the outcome is only logged — useful for monitoring without enforcement. |
chromiaSecretPath | string | ~/.config/atbash/guard-client-key | Path to the agent key file. Supports ~/. |
orgName | string | — | Organization the agent was onboarded under, spelled as the dashboard shows it. The plugin resolves which chain to query from this, so it is required when the org is on a private chain. |
debug | bool | false | When true, logs a one-line probe for every before_tool_call showing toolName, top-level event/ctx/args keys, and whether the call was classified as a memory write. Useful for verifying memory-write classifier coverage against real traffic. Logs shape only — argument values are never printed. |
judgeEndpoint | string | — | Override the judge URL. Leave unset to use the compiled-in default for the installed environment (prod or dev). |
judgeEndpointPolicy | "default" | "self-hosted" | "default" | Set to "self-hosted" when pointing at your own judge; requires judgeVerifyPubKey. |
judgeVerifyPubKey | string | — | 66-char secp256k1 compressed pubkey used to verify the self-hosted judge response signature. Required when judgeEndpointPolicy is "self-hosted". |
memoryPathPatterns | string[] | SDK defaults | Extra path substrings the memory classifier uses to identify memory-shaped files (e.g. "/my-agent/memory/"). Extends, does not replace, the SDK's built-in list. |
memoryWorkspaceDir | string | process.cwd() | Workspace root used to locate the memory pointer file and MEMORY.md. Supports ~/. |
memoryFilePath | string | <memoryWorkspaceDir>/MEMORY.md | Explicit path to the agent's MEMORY.md. Overrides the memoryWorkspaceDir-relative default. Supports ~/. |
memorySyncTTLMs | integer | 30000 | How long (ms) to trust the locally cached memory chain pointer before re-fetching from the chain. Lower values increase freshness at the cost of more chain queries. |
memoryRollbackMinScore | integer (1–10) | 1 | Block memory reads when a rolled-back version's safety score is below this threshold. Default 1 means warn only, never block. Raise to e.g. 3 to refuse reading poisoned rollbacks. |
judgeTimeoutMs | integer | — | Max milliseconds to wait for a judge or memory-guard response before treating it as a timeout. When triggered, the plugin applies the same fail-closed/open logic as any other error (enforceDecision controls the outcome). Unset means the plugin waits as long as the host allows. Set to e.g. 12000 when the host has a hard hook deadline and you want the plugin to fail gracefully instead of being killed mid-await. |
Updating
openclaw plugins update atbash-openclaw
Uninstalling
openclaw plugins uninstall atbash-openclaw
The agent key file at ~/.config/atbash/guard-client-key is not removed — delete it manually if you want to retire the agent identity.
Secret redaction
Before each tool call is sent to the judge, the underlying @atbash/sdk scans the args and context for secret-shaped values and replaces matches with [REDACTED:<kind>]. Redaction is client-side and happens before signing, so secrets never reach the signed bytes, the request body, the on-chain log, or the AI provider.
When the redactor fires, OpenClaw will surface a warning like:
[atbash] redacted secrets before judge call { tool: "exec", count: 2, kinds: ["anthropic", "generic_token"] }
The kinds field shows which patterns matched. anthropic / openai / aws_access_key / jwt / etc. indicate real vendor secrets. generic_token is a catch-all for long random-looking strings — it can also match UUIDs and content hashes; the judge still gets enough context to evaluate the action, but worth knowing if you see it unexpectedly.
The agent's own tool execution is unaffected — only the data sent to the judge is scrubbed. Full kind list and behaviour reference: see the SDK README.
Environment variables
| Variable | Default | What it does |
|---|---|---|
ATBASH_TELEMETRY | "true" | Set to "false" to disable usage telemetry. Telemetry is opt-out — it's on unless you explicitly turn it off. |
Troubleshooting
Tool calls aren't being audited.
Check enabled: true is set both on the entry (plugins.entries["atbash-openclaw"].enabled) and inside config (config.enabled).
Every tool call is blocked, even safe ones.
The plugin is fail-closed: any pipeline error blocks. Look for [atbash] … warnings in the OpenClaw log. Most often: missing key, expired key, or restricted egress.
Plugin loads but config is not applied (audit runs on defaults).
The plugins.entries key must be exactly "atbash-openclaw" — the plugin's id from its openclaw.plugin.json. Former names ("openclaw", "atbash-plugin") are silently ignored; the plugin logs a warning at startup but otherwise runs unconfigured. Check the OpenClaw startup log for [atbash] found config under former plugin id and move the settings block to plugins.entries["atbash-openclaw"].
Maintainer release contract
Development packages are released only through the protected Publish development package GitHub workflow. The workflow requires the npm environment, the exact PUBLISH confirmation, and npm trusted-publisher configuration for this repository and workflow. It never accepts a registry token from package source.
The release guard refuses a dirty checkout, reads the live package and SDK tags, chooses a collision-free prerelease, copies only Git-tracked files into a temporary staging tree, pins the exact SDK version there, installs and tests from the staged lockfile, cleans and rebuilds dist, validates the tarball, rechecks registry state, publishes, and verifies the resulting dev tag. The tracked source manifest is never rewritten by a release.
Because this repository is private, npm provenance statements are not supported. Trusted publishing still removes long-lived npm tokens; configure the protected npm environment and trusted publisher before enabling the workflow.
License
Licensed under the Apache License, Version 2.0. See NOTICE for attribution. Versions published before this change remain available under the license they shipped with.