> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sec0.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenClaw Integration

> Use sec0-sdk/integrations/openclaw for Moltbot hooks, plugin wiring, gateway-tool bridging, and escalation handling.

`sec0-sdk/integrations/openclaw` exports three integration helpers:

* `createMoltbotHooks(...)`
* `createMoltbotPlugin(...)`
* `createMoltbotEscalationManager(...)`

Use them when you want Sec0 policy enforcement inside an OpenClaw or Moltbot runtime without reimplementing audit, policy loading, or escalation glue.

For non-OpenClaw applications, use `createEscalationManager(...)` from `sec0-sdk/escalation` directly. `createMoltbotEscalationManager(...)` is now a thin OpenClaw adapter over that shared approvals lifecycle.

## Minimal Plugin

```javascript theme={null}
const { createMoltbotPlugin } = require("sec0-sdk/integrations/openclaw");

module.exports = createMoltbotPlugin((api) => ({
  policyPath: api.resolvePath("policies/policy.yaml"),
  auditDir: api.resolvePath("~/.moltbot/sec0/audit"),
  signingKeyPath: api.resolvePath("~/.moltbot/sec0/ed25519.b64"),
  tenant: "acme",
  serverName: "moltbot-gateway@prod",
  mode: "enforce",
}));
```

## Manual Hook Wiring

Use `createMoltbotHooks(...)` when you want full control over how the runtime registers handlers:

```javascript theme={null}
const { createMoltbotHooks } = require("sec0-sdk/integrations/openclaw");

module.exports = async function sec0Plugin(api) {
  const hooks = createMoltbotHooks({
    policyPath: api.resolvePath("policies/policy.yaml"),
    auditDir: api.resolvePath("~/.moltbot/sec0/audit"),
    signingKeyPath: api.resolvePath("~/.moltbot/sec0/ed25519.b64"),
    tenant: "acme",
    serverName: "moltbot-gateway@prod",
    mode: "enforce",
  });

  api.on("before_tool_call", hooks.beforeToolCall, { priority: 100 });
  api.on("after_tool_call", hooks.afterToolCall, { priority: -10 });
};
```

## Control-Plane Policy

You can load policy from the Sec0 control plane instead of a local file:

```javascript theme={null}
const hooks = createMoltbotHooks({
  policyFromControlPlane: true,
  policyRefreshMs: 30000,
  apiKey: process.env.SEC0_API_KEY,
  auditDir: api.resolvePath("~/.moltbot/sec0/audit"),
  signingKeyPath: api.resolvePath("~/.moltbot/sec0/ed25519.b64"),
  tenant: "acme",
  serverName: "moltbot-gateway@prod",
  mode: "enforce",
});
```

Use `policyControlPlaneSource` when you need a specific level, scope, or node override.

## Configuration

### Required

| Option                                         | Description                     |
| ---------------------------------------------- | ------------------------------- |
| `policyPath` or `policyYaml` or `policyObject` | Policy source                   |
| `auditDir`                                     | Directory for audit logs        |
| `signingKeyPath`                               | Path to Ed25519 key             |
| `tenant`                                       | Tenant identifier               |
| `serverName`                                   | Server identity (name\@version) |
| `mode`                                         | `"observe"` or `"enforce"`      |

### Common Optional Fields

| Option                     | Description                                                                     |
| -------------------------- | ------------------------------------------------------------------------------- |
| `allowlist`                | Override `policy.tools.allowlist`                                               |
| `policyFromControlPlane`   | Fetch policy from the control plane                                             |
| `policyControlPlaneSource` | Override control-plane level, scope, node, and fallback settings                |
| `policyRefreshMs`          | Policy refresh TTL in milliseconds                                              |
| `agentGuard`               | Agent Guard options or `false`                                                  |
| `skills`                   | See [Skills Hooks](/docs/skills-hooks) for resolver and scan hook configuration |
| `compliance`               | NL or regex compliance configuration                                            |
| `onDecision`               | Decision callback                                                               |
| `onAuditError`             | Audit error callback                                                            |
| `gatewayTool`              | Register a bridge-backed tool that routes through `callToolViaGateway(...)`     |
| `messages`                 | Govern inbound or outbound messages in addition to tool calls                   |

## Skills Hooks

Skill resolver and scanning behavior has moved to [Skills Hooks](/docs/skills-hooks). Use that section for `skills.resolve`, `skills.onScan`, and policy reason mapping.

## Message Governance

Enable inbound or outbound message scanning alongside tool calls:

```javascript theme={null}
const hooks = createMoltbotHooks({
  // ...base config...
  messages: {
    enabled: true,
    direction: "both",
    audit: true,
    storeContent: false,
    quarantine: { enabled: true, ttlMs: 3600000 },
  },
});

const result = await hooks.messageSending?.({ to: "user", content: "..." }, ctx);
if (result?.cancel) {
  // blocked
}
if (result?.escalate) {
  // send through createMoltbotEscalationManager(...)
}
```

## Escalation Manager

Use the built-in OpenClaw escalation adapter instead of hand-writing create, poll, and resolve logic in your app:

```typescript theme={null}
import {
  createMoltbotHooks,
  createMoltbotEscalationManager,
} from "sec0-sdk/integrations/openclaw";
import { createEscalationManager } from "sec0-sdk/escalation";

const hooks = createMoltbotHooks(cfg);
const sharedEscalationManager = createEscalationManager({
  apiKey: process.env.SEC0_API_KEY,
  controlPlaneUrl: process.env.SEC0_CONTROL_PLANE_URL,
  tenant: process.env.SEC0_TENANT_ID,
  timeoutMs: 5 * 60_000,
  pollIntervalMs: 2000,
  defaults: {
    ttlSeconds: 300,
    timeoutAction: "auto_reject",
  },
});
const escalation = createMoltbotEscalationManager({
  escalationMode: "human",
  manager: sharedEscalationManager,
  waitForResolution: true,
});

const gate = await hooks.messageSending?.({ to, content, metadata }, ctx);
const decision = await escalation.handle({
  gateResult: gate,
  nodeId: ctx?.accountId,
  agentRef: ctx?.conversationId,
  metadata: { turn: 3 },
});

if (!decision.allow) {
  return;
}
await sendToChannel(content);
```

Supported modes are `human`, `auto-approve`, `auto-reject`, and `off`.

Pass `reporter` and `resolver` directly if you want custom backends. Pass `manager` when you want one shared escalation lifecycle reused across OpenClaw hooks and the rest of your application.

## Gateway Tool Registration

`gatewayTool` registers a bridge-backed tool inside the host runtime:

```javascript theme={null}
const hooks = createMoltbotHooks({
  // ...base config...
  gatewayTool: {
    enabled: true,
    name: "sec0.call_gateway",
    defaults: {
      gatewayBaseUrl: "https://gateway.example.com",
      server: "payments-mcp",
      toolAtVersion: "charge@1.0",
    },
  },
});
```

The host can then call the registered tool and let Sec0 build the bridge request.

## Human Escalation Policy

Route high-risk actions to approval instead of hard-blocking:

```yaml theme={null}
security:
  side_effects:
    approve_high_risk: true
enforcement:
  escalate_on:
    - agent_guard_failed
```

## OpenTelemetry

`sec0-sdk/otel` provides helpers for bootstrapping tracing:

```typescript theme={null}
import { initTracing } from "sec0-sdk/otel";

initTracing({
  endpoint: "http://localhost:4317",
  serviceName: "my-tool-server",
  serviceVersion: "1.0.0",
  environment: "dev",
  tenant: "my-app",
  sample: { success: 1, error: 1 },
});
```

See the [Signer & OTel Reference](/docs/reference/signer-otel) for the full API.