Interven Guard for OpenClaw

Scan every outbound tool call your OpenClaw agent makes — before it executes — through the Interven AI firewall. Block malicious URLs, redact PII and secrets, and route risky actions to human approval, without changing your agent code.

What it guards

By default this plugin scans five built-in OpenClaw tools:

You can narrow this set per-deployment (see Configuration).

Decisions

The plugin maps Interven's four decisions to OpenClaw hook results:

Network errors, timeouts, missing API keys, or non-200 responses fail open — your agent keeps working even if Interven is unreachable.

Why we hard-block instead of asking the operator

Interven is an AI firewall, not an operator-decision aid. Letting the operator (whose account could be compromised, who could be careless, or who just isn't the security team) approve their own risky actions makes Interven a logging tool, not a security control. v0.3.0 implements the two-actor PAM pattern used by BeyondTrust / CyberArk / Teleport: the agent operator requests, a separate security analyst approves. The operator retries after the analyst decides; the gateway recognises the recent approval and lets the second attempt through.

Install

Step 1 — Install the plugin

openclaw plugins install clawhub:openclaw-interven-guard

Step 2 — Configure your API key in ~/.openclaw/openclaw.json

The API key is set in plugin config (the plugin does not read environment variables — see Security model below). Add this block to your openclaw.json:

{
  plugins: {
    allow: ["openclaw-interven-guard"],
    entries: {
      "openclaw-interven-guard": {
        enabled: true,
        config: {
          apiKey: "iv_live_your_key_here"
        }
      }
    }
  }
}

Get an API key at intervensecurity.com (free tier: 1,000 scans/month).

Tip: chmod 600 ~/.openclaw/openclaw.json to keep the API key readable only by your user. If you check openclaw.json into git, use a config-templating tool (envsubst, sops, dotenvx) to substitute the key at deploy time — never commit the literal iv_live_* value.

Step 3 — Restart the gateway

openclaw gateway restart

Verify

openclaw plugins list --verbose | grep interven-guard
openclaw plugins inspect openclaw-interven-guard
journalctl --user -u openclaw-gateway.service -f | grep interven-guard

You should see [interven-guard] guarding tools: ... in the gateway logs on startup.

Manual install (development / self-hosted Interven)

git clone https://github.com/intervensecurity/openclaw-interven-guard.git
openclaw plugins install ./openclaw-interven-guard

Then configure as in Step 2 above. To point at a self-hosted Interven instead of the SaaS, add gatewayUrl:

"openclaw-interven-guard": {
  enabled: true,
  config: {
    apiKey: "iv_live_your_key_here",
    gatewayUrl: "http://your-interven-host:4000"
  }
}

Configuration

All config lives under plugins.entries["openclaw-interven-guard"].config in ~/.openclaw/openclaw.json. The plugin reads no environment variables.

Example openclaw.json snippet (recommended for chat agents)

{
  plugins: {
    allow: ["openclaw-interven-guard"],
    entries: {
      "openclaw-interven-guard": {
        enabled: true,
        config: {
          apiKey: "iv_live_your_key_here",
          // Only scan outbound HTTP fetches (lighter, recommended for chat agents)
          guardedTools: ["web_fetch"]
        }
      }
    }
  }
}

Tuning OpenClaw so the model actually calls tools

Small models (e.g. gpt-4o-mini) can skip tool calls when the system prompt is bloated with skills. If your agent answers "I can't access that URL" instead of calling web_fetch, trim the prompt:

{
  tools: { profile: "coding" },          // includes web_fetch, drops messaging surface
  skills: {
    allowBundled: false,
    limits: { maxSkillsPromptChars: 4000 }
  },
  agents: {
    list: [{
      id: "main",
      skills: [],                        // explicit empty: no skill text injected
      model: { primary: "openai/gpt-4o-mini" }
    }]
  }
}

Verified config keys (OpenClaw v2026.4.x): skills.allowBundled (bool, default true), skills.limits.maxSkillsPromptChars (default 18000), agents.list[].skills ([] = none), tools.profile ∈ minimal | coding | messaging | full.

Security model

This plugin sits in your agent's outbound path and intentionally:

• Reads from api.pluginConfig only. No process.env, no child_process, no filesystem reads, no credential stores. The API key reaches the plugin exclusively through OpenClaw's typed plugin-config surface.
• Sends outbound HTTP to one host only — the gatewayUrl you set (default https://api.intervensecurity.com). The destination is fixed at config time; the plugin cannot redirect traffic elsewhere at runtime.
• Sends only the tool-call metadata that's necessary for policy evaluation: HTTP method, URL, body, optional headers. It does not send your agent's conversation history, system prompts, memory, or any other workspace data.
• Logs to console.log only, never to disk, and never includes the API key in any log line.

If you're auditing this plugin before installing it on a sensitive agent, the entire data flow is in index.ts — ~360 lines, no dependencies beyond OpenClaw's plugin SDK and Node 20+ built-in fetch.

Troubleshooting

How it works

┌──────────────┐   tool call    ┌──────────────────┐    /v1/scan    ┌──────────┐
│ OpenClaw     │ ─────────────▶ │ before_tool_call │ ─────────────▶ │ Interven │
│ agent        │                │ hook (this)      │ ◀───────────── │ gateway  │
└──────────────┘ ◀───────────── └──────────────────┘  decision      └──────────┘
                  block / allow         │
                  / requireApproval     │ console.log
                                        ▼
                                   stdout / journal

Every guarded tool call is intercepted, sent to Interven's /v1/scan endpoint with the URL, method, and body, and the response decision is mapped back to OpenClaw's hook return shape. Interven runs 14 detection engines (PII, secrets, threat intel, semantic intent, trust scoring, etc.) and returns a decision in ~80ms p50.

License

MIT © Interven Security

Links

• Interven docs
• Interven API reference
• Get an API key
• Source / issues