OpenClaw

Connect

Install OpenClaw and Kastra Edge, then run:

kastra-edge login
kastra-edge install-openclaw
kastra-edge status

The installer delegates to OpenClaw’s plugin manager for npm:@kastra_labs/openclaw. It checks for an existing plugin before installing. Restart the OpenClaw gateway afterward.

Allow enough time for approval

Merge this into the existing OpenClaw configuration rather than replacing other plugin settings:

{
  "plugins": {
    "entries": {
      "kastra": {
        "enabled": true,
        "hooks": {"timeouts": {"before_tool_call": 600000}}
      }
    }
  }
}

The host’s hook timeout and the policy checkpoint expiry are different clocks. The plugin’s maximum wait is bounded separately. Test a real approval before relying on long-running waits.

Scope and configuration

The plugin governs calls exposed through before_tool_call. Provider-executed server-side tools remain outside that hook. Outbound message governance is optional (governMessages) and defaults off. Installing the plugin does not imply that all model traffic passes through Kastra’s proxy.

Configuration supports the API URL, device token, environment, jurisdiction, console URL, failMode, governMessages, and holdMaxWaitMs. Without an explicit device token, a local Edge login can supply the device handle. Failure mode defaults to open; choose the posture intentionally and test it.

Verify

Run a harmless tool call, inspect its source and arguments in Kastra, and test allow, deny, and HOLD in a test environment. A configured plugin with no corresponding action records needs investigation before rollout.