@ory/openclaw 1.5.3 → 1.6.0

package/README.md

@@ -102,6 +102,28 @@ npx -y -p @ory/openclaw ory-openclaw permissions   # native allowed/blocked stat
 
 Then a denied tool is actually blocked and OpenClaw shows why.
 
+### MCP servers
+
+OpenClaw exposes a bundle MCP server's tools as `<server>__<tool>`, where the
+server part is the configured name with characters outside `[A-Za-z0-9_-]`
+replaced by `-`, cut to 30 characters, and suffixed `-2`, `-3`, … on a
+collision (OpenClaw v2026.10.6, `src/agents/agent-bundle-mcp-names.ts`). The
+plugin splits a tool name on its first `__` and checks `McpServer:<server>` and
+`McpTool:<server>:<tool>`; Agent Security resolves the reported name to a
+cataloged server. OpenClaw's built-in tools are not named with `__`, so they
+keep the native check.
+
+Limits: OpenClaw reports neither the configured server key nor how the server
+is launched, so no fingerprints are sent, and a renamed, truncated, or
+collision-suffixed server name may resolve as uncatalogued. A server name that
+itself contains `__` splits at the wrong place. MCP calls made through
+OpenClaw's code mode arrive as one code-mode tool and are not identified.
+
+The tool hooks register through `api.on`. Current OpenClaw only invokes typed
+hooks such as `before_tool_call` that way and ignores `registerHook`
+registrations for them. On hosts without `api.on`, the plugin falls back to
+`registerHook`.
+
 ## Connect to Ory Agent Security
 
 Copy the connection details from the [Ory Console](https://console.ory.sh) under **Agent Security**:
@@ -122,7 +144,7 @@ npx -y -p @ory/openclaw ory-openclaw configure \
 
 **Ory Network or OEL.** Either works. For an Ory Network project the URL is `https://<slug>.projects.oryapis.com`; for a self-hosted **Ory Enterprise License** deployment, point `--project-url` at that deployment's base URL and use the sign-in client id from its Agent Security configuration. Everything downstream — sign-in, checks, delegation — is identical.
 
-**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP grants, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls OpenClaw's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
+**There is nothing else for you to create.** The sign-in client, permission model, native-tool blocks, MCP server access, and observe/enforce posture are provisioned in the Console by someone with project access. At session start the plugin loads or enrolls OpenClaw's Talos runtime credential in the OS credential store; tool paths only read it. Installing needs no workspace privilege.
 
 Sign-in runs at the start of every session and never blocks — a declined, skipped, or timed-out login simply leaves that session without a user identity.
 

package/dist/plugin.js

@@ -22,14 +22,23 @@ function createOryPlugin(clientOrConfig, deps = {}) {
                 name: "ory.user-login",
                 description: "Block runs when the user login denies",
             });
-            api.registerHook("before_tool_call", createBeforeToolCallHandler(client, subagents), {
-                name: "ory.permission-check",
-                description: "Check tool permissions via Ory Permissions",
-            });
-            api.registerHook("after_tool_call", createAfterToolCallHandler(client), {
-                name: "ory.activity-complete",
-                description: "Record tool completion activity",
-            });
+            const beforeToolCall = createBeforeToolCallHandler(client, subagents);
+            const afterToolCall = createAfterToolCallHandler(client);
+            if (typeof api.on === "function") {
+                // Typed tool hooks only fire through `api.on` on current OpenClaw.
+                api.on("before_tool_call", (event, ctx) => beforeToolCall(fromTypedToolEvent(event, ctx)));
+                api.on("after_tool_call", (event, ctx) => afterToolCall(fromTypedAfterToolEvent(event, ctx)));
+            }
+            else {
+                api.registerHook("before_tool_call", beforeToolCall, {
+                    name: "ory.permission-check",
+                    description: "Check tool permissions via Ory Permissions",
+                });
+                api.registerHook("after_tool_call", afterToolCall, {
+                    name: "ory.activity-complete",
+                    description: "Record tool completion activity",
+                });
+            }
             api.registerHook("subagent_spawning", createSubagentSpawningHandler(client, deps, subagents), {
                 name: "ory.subagent-register",
                 description: "Register Ory identity and write delegation tuple for spawned sub-agent",
@@ -74,7 +83,7 @@ function createBeforeToolCallHandler(client, subagents) {
             toolArgs: ctx.args,
             subjectFallback: ctx.sessionId ? `session:${ctx.sessionId}` : "agent:openclaw",
             canBlock: true,
-            mcpTool: (0, argus_1.parseMcpToolGeneric)(ctx.toolId) ?? undefined,
+            mcpTool: identifyMcpTool(ctx.toolId),
             principals: openClawSubagentPrincipals(ctx, subagents),
         });
         if (result.blocked) {
@@ -82,6 +91,44 @@ function createBeforeToolCallHandler(client, subagents) {
         }
     });
 }
+/**
+ * OpenClaw names a bundle MCP tool `<safeServer>__<tool>`
+ * (`src/agents/agent-bundle-mcp-names.ts`): the configured server name with
+ * characters outside `[A-Za-z0-9_-]` replaced by `-`, at most 30 characters,
+ * suffixed `-2`, `-3`, … on collisions. The safe name is not the config key
+ * when sanitizing, truncation, or a collision changed it, so the first `__`
+ * splits the name instead of a configured-key lookup; Agent Security folds
+ * separators when resolving the reported name. Native OpenClaw tools carry
+ * no `__`.
+ */
+function identifyMcpTool(toolName) {
+    return (0, argus_1.parseMcpToolWithSeparator)(toolName, "__") ?? undefined;
+}
+/** Map a typed `before_tool_call` (event, ctx) pair onto the handler context. */
+function fromTypedToolEvent(event, ctx = {}) {
+    return {
+        toolId: event.toolName,
+        toolName: event.toolName,
+        args: event.params ?? {},
+        sessionId: ctx.sessionId ?? ctx.sessionKey ?? "",
+        callId: event.toolCallId ?? ctx.toolCallId ?? "",
+        agentId: ctx.agentId,
+        sessionKey: ctx.sessionKey,
+        runId: event.runId ?? ctx.runId,
+    };
+}
+function fromTypedAfterToolEvent(event, ctx = {}) {
+    return {
+        toolId: event.toolName,
+        toolName: event.toolName,
+        args: event.params ?? {},
+        result: event.result,
+        sessionId: ctx.sessionId ?? ctx.sessionKey ?? "",
+        callId: event.toolCallId ?? ctx.toolCallId ?? "",
+        durationMs: event.durationMs ?? 0,
+        ...(event.error ? { error: event.error } : {}),
+    };
+}
 function openClawSubagentPrincipals(ctx, subagents) {
     const childSession = ctx.sessionKey ?? ctx.sessionId;
     const subagent = subagents.get(childSession);

package/dist/types.d.ts

@@ -19,6 +19,54 @@ export interface OpenClawPluginEntry {
 }
 export interface OpenClawPluginApi {
     registerHook<E extends HookEvent>(event: E, handler: HookHandler<E>, opts?: HookRegistrationOpts): void;
+    /**
+     * Register a typed lifecycle hook. Current OpenClaw dispatches typed names
+     * such as `before_tool_call` only to `api.on` registrations and warns that
+     * `registerHook` registrations for them are never invoked
+     * (`src/plugins/registry-registrars-tools-hooks.ts`). Optional so older hosts
+     * without it still load the plugin.
+     */
+    on?<K extends TypedHookName>(hookName: K, handler: TypedHookHandler<K>, opts?: TypedHookRegistrationOpts): void;
+}
+export interface TypedHookRegistrationOpts {
+    priority?: number;
+    timeoutMs?: number;
+}
+/** Typed hooks this plugin registers through `api.on`. */
+export type TypedHookName = "before_tool_call" | "after_tool_call";
+export type TypedHookHandler<K extends TypedHookName> = K extends "before_tool_call" ? (event: ToolCallEvent, ctx?: ToolHookContext) => Promise<HookResult | void> : K extends "after_tool_call" ? (event: AfterToolCallEvent, ctx?: ToolHookContext) => Promise<void> : never;
+/**
+ * Mirrors OpenClaw's `PluginHookBeforeToolCallEvent`. Bundle MCP tools are
+ * named `<safeServer>__<tool>` (`src/agents/agent-bundle-mcp-names.ts`).
+ */
+export interface ToolCallEvent {
+    toolName: string;
+    params: Record<string, unknown>;
+    /** `code_mode_exec` for code-mode tool envelopes. */
+    toolKind?: string;
+    toolInputKind?: string;
+    runId?: string;
+    toolCallId?: string;
+}
+/** Mirrors OpenClaw's `PluginHookAfterToolCallEvent`. */
+export interface AfterToolCallEvent {
+    toolName: string;
+    params: Record<string, unknown>;
+    runId?: string;
+    toolCallId?: string;
+    result?: unknown;
+    error?: string;
+    durationMs?: number;
+}
+/** Mirrors OpenClaw's `PluginHookToolContext`. */
+export interface ToolHookContext {
+    agentId?: string;
+    sessionKey?: string;
+    sessionId?: string;
+    runId?: string;
+    toolName?: string;
+    toolKind?: string;
+    toolCallId?: string;
 }
 export interface HookRegistrationOpts {
     name?: string;
@@ -26,6 +74,7 @@ export interface HookRegistrationOpts {
 }
 export type HookEvent = "session_start" | "session_end" | "before_tool_call" | "after_tool_call" | "before_agent_start" | "before_agent_run" | "subagent_spawning" | "subagent_spawned" | "subagent_ended";
 export type HookHandler<E extends HookEvent> = E extends "before_tool_call" ? (ctx: BeforeToolCallContext) => Promise<HookResult | void> : E extends "after_tool_call" ? (ctx: AfterToolCallContext) => Promise<void> : E extends "session_start" ? (ctx: SessionStartContext) => Promise<void> : E extends "before_agent_start" ? (ctx: BeforeAgentStartContext) => Promise<void> : E extends "before_agent_run" ? (ctx: BeforeAgentRunContext) => Promise<BeforeAgentRunResult | void> : E extends "session_end" ? (ctx: SessionEndContext) => Promise<void> : E extends "subagent_spawning" ? (ctx: SubagentSpawningContext) => Promise<SubagentSpawningResult | void> : E extends "subagent_spawned" ? (ctx: SubagentSpawnedContext) => Promise<void> : E extends "subagent_ended" ? (ctx: SubagentEndedContext) => Promise<void> : never;
+/** Legacy `registerHook("before_tool_call")` context, for hosts without `api.on`. */
 export interface BeforeToolCallContext {
     toolId: string;
     toolName: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ory/openclaw",
-  "version": "1.5.3",
+  "version": "1.6.0",
   "description": "Ory plugin for OpenClaw: scaffolding skills, a local Ory instance, and authentication, authorization, and audit for every tool call",
   "license": "Apache-2.0",
   "homepage": "https://ory.com",
@@ -68,7 +68,7 @@
   ],
   "dependencies": {
     "reova": "^0.7.0",
-    "@ory/argus": "1.5.3"
+    "@ory/argus": "1.6.0"
   },
   "engines": {
     "node": ">=22"