# OpenClaw

Install the Kastra plugin and govern supported OpenClaw tool calls.

Updated: 2026-09-22

Canonical: https://docs.kastra.ai/edge/openclaw

## Connect

Install OpenClaw and [Kastra Edge](https://docs.kastra.ai/edge/install), then run:

```sh
kastra-edge login
kastra-edge install-openclaw
kastra-edge status
```

The installer delegates to OpenClaw's plugin manager for `npm:@kastra_labs/openclaw`. It checks for an existing plugin before installing. Restart the OpenClaw gateway afterward.

## Allow enough time for approval

Merge this into the existing OpenClaw configuration rather than replacing other plugin settings:

```json
{
  "plugins": {
    "entries": {
      "kastra": {
        "enabled": true,
        "hooks": {"timeouts": {"before_tool_call": 600000}}
      }
    }
  }
}
```

The host's hook timeout and the policy checkpoint expiry are different clocks. The plugin's maximum wait is bounded separately. Test a real approval before relying on long-running waits.

## Scope and configuration

The plugin governs calls exposed through `before_tool_call`. Provider-executed server-side tools remain outside that hook. Outbound message governance is optional (`governMessages`) and defaults off. Installing the plugin does not imply that all model traffic passes through Kastra's proxy.

Configuration supports the API URL, device token, environment, jurisdiction, console URL, `failMode`, `governMessages`, and `holdMaxWaitMs`. Without an explicit device token, a local Edge login can supply the device handle. Failure mode defaults to open; choose the posture intentionally and test it.

## Verify

Run a harmless tool call, inspect its source and arguments in Kastra, and test allow, deny, and HOLD in a test environment. A configured plugin with no corresponding action records needs investigation before rollout.