Mautic Control for OpenClaw

Operate Mautic from OpenClaw with typed, policy-gated tools for API work, webhook discovery, safe console maintenance, and guarded workspace file staging.

Install

openclaw plugins install clawhub:@completetech/openclaw-mautic-plugin

After installation, set the Mautic connection values in OpenClaw plugin settings and provide API credentials through environment variables or your platform secret store.

Compatibility

This release was verified against Mautic Community 7.1.1, the latest GitHub release checked on 2026-05-26. Mautic's own release page lists Mautic 7 as the actively supported series.

Expected production target:

Validate against your exact Mautic instance before broad rollout, especially if custom plugins, nonstandard API routing, or reverse proxies are involved.

Tools

Production Setup

Use these production defaults unless a trusted operator needs broader access.

Required Secrets

Never store these values in the plugin UI, README, or source control.

OAuth2 is preferred for external production integrations where available. The local verification stack uses Basic auth only for loopback automation.

Plugin Settings

These settings are non-secret and can be configured in OpenClaw.

Environment fallbacks are supported for non-secret settings:

MAUTIC_BASE_URL
MAUTIC_CONSOLE_URL
MAUTIC_WORKSPACE_DIR
MAUTIC_ALLOWED_WORKSPACE_ROOT
MAUTIC_DEFAULT_API_VERSION
MAUTIC_REQUEST_TIMEOUT_SECONDS
MAUTIC_ALLOW_MAINTENANCE_COMMANDS
MAUTIC_ALLOW_AUTOMATION_JOB_COMMANDS
MAUTIC_ALLOW_WORKSPACE_READ
MAUTIC_ALLOW_WORKSPACE_WRITE

Security Defaults

The plugin starts in a conservative mode. API access becomes available only after credentials are provided, and operational controls stay off until an operator enables them.

Default Access

Optional Command Groups

Console requests are checked twice: first by the plugin allowlist, then by the optional bridge allowlist. For agents that process untrusted input, use restrictive OpenClaw profiles or explicit tool allowlists.

Console Bridge

The console bridge is optional. It is needed only for the console-command tool; API, entity, webhook, status, and workspace tools can run without it.

Use the included bridge file only as a private internal endpoint between OpenClaw and Mautic.

Without the bridge, disable or ignore mautic_console; the rest of the plugin remains usable.

Local Docker Stack

The companion Docker stack uses explicit local settings to preserve the development workflow:

baseUrl=http://mautic_web
consoleUrl=http://mautic_console:8099/console
workspaceRoot=/workspace/mautic
allowedWorkspaceRoot=/workspace/mautic
defaultApiVersion=legacy
requestTimeoutSeconds=60
allowMaintenanceCommands=true
allowAutomationJobCommands=false
allowWorkspaceRead=true
allowWorkspaceWrite=true

These are local-stack defaults, not production defaults. Do not expose the local stack's loopback credentials or Basic auth settings publicly.

Verify

Package checks:

npm run lint
npm test
npm run package:check

ClawHub readiness:

npm run readiness:check

Live stack checks:

npm run live:smoke
node scripts/audit.mjs
node scripts/audit.mjs --live
docker compose exec -T openclaw sh -lc 'openclaw security audit --deep --json'

Publish

The package is published on ClawHub as @completetech/openclaw-mautic-plugin.

Releases are published as a ClawPack npm-pack artifact, not the older legacy zip artifact. Trusted publishing uses GitHub Actions OIDC; no long-lived ClawHub token is stored in repository secrets. The GitHub workflow publishes the checked-in clawpack/ tarball through ClawHub's official reusable workflow so the release can use both official OIDC and the npm-pack artifact path.

Current ClawHub behavior: the release is source-linked to the GitHub commit and passes ClawHub's source provenance readiness check, but community ClawPack bundle releases still display artifact-only verification with hasProvenance=false.

For a future release:

npm run readiness:check
rm -rf clawpack
mkdir -p clawpack
npm exec --yes clawhub -- package pack . --pack-destination clawpack --json
gh workflow run clawhub-publish.yml --ref main

Optional publish environment variables are CLAWHUB_OWNER, CLAWHUB_CHANGELOG, CLAWHUB_SOURCE_REPO, CLAWHUB_SOURCE_REF, CLAWHUB_TAGS, CLAWHUB_CLAWSCAN_NOTE, and CLAWHUB_ALLOW_PRIVATE_SOURCE.

See docs/TRUSTED_PUBLISHING.md for the trusted publisher workflow and verification commands.

Limits

• Pre-1.0 release: validate in the target environment before broad rollout.
• mautic_console cannot run arbitrary shell or Mautic console commands.
• mautic_workspace_file is for guarded staging workflows, not full filesystem access.
• ClawHub scan status may be pending immediately after a new release is published.