ArmorClaw Security Plugin for OpenClaw

ArmorClaw operates in two main phases to protect AI agents:

1. Intent Planning

When a message is sent to an OpenClaw agent, ArmorClaw:

• Intercepts the LLM input via the llm_input hook.
• Parses available tools from the system prompt.
• Generates an explicit plan of allowed tool actions via a separate LLM call.
• Sends the plan to the ArmorClaw backend to receive a cryptographically signed intent token.

2. Tool Execution Enforcement

Before any tool is executed, ArmorClaw:

• Verifies the tool is in the approved plan.
• Validates the intent token is not expired.
• Applies local policy rules.
• Optionally verifies CSRG cryptographic proofs.
• Blocks execution if any check fails.

The ArmorIQ plugin integrates with the OpenClaw Gateway via three primary hooks to provide intent enforcement and cryptographic verification:

1. before_agent_start hook: Triggers Intent Planning. The plugin uses an LLM to create a plan and requests an intent token from the IAP backend.
2. before_tool_call hook: Triggers Step Verification. The plugin verifies the current tool call against the issued intent token and cryptographic proofs (CSRG) and checks against the active policy.
3. agent_end hook: Triggers Audit Logging to record the session activity.

This architecture ensures that every tool call is authorized by a valid intent and complies with cryptographic and organizational policies.

To use the ArmorIQ plugin with OpenClaw v2026.2.12, you must first apply a patch to the OpenClaw repository to extend the hook context, as the vanilla version lacks the necessary fields for intent planning and policy enforcement.

Prerequisites

• Node.js v22+
• pnpm v10+
• OpenAI API key (or OpenRouter key)

Step 1: Patch OpenClaw

Clone the specific version and apply the patch-armoriq.sh script:

git clone --branch v2026.2.12 https://github.com/openclaw/openclaw.git
cd openclaw
bash /path/to/patch-armoriq.sh
pnpm install
pnpm build

Step 2: Install the Plugin

Remove any existing ArmorIQ extensions and install from your local plugin path:

# Remove stale installs
rm -rf ~/.openclaw/extensions/armoriq

# Install from local path
node openclaw.mjs plugins install /path/to/armoriq-openclaw-plugin

You can install ArmorClaw using a one-line installer that clones OpenClaw, installs the plugin, and configures it automatically.

Prerequisites:

• Node.js (matching OpenClaw's engine range), pnpm, and Git.
• An LLM provider key (OpenAI, Anthropic, Gemini, or OpenRouter).

Note on Credentials: The installer uses browser approval to store a minted ArmorIQ key in ~/.armoriq/credentials.json. You do not need to copy keys manually unless you prefer to manage them via the ArmorIQ API Keys page.

curl -fsSL https://armoriq.ai/install-armorclaw.sh | bash

To use the ArmorIQ plugin, you must first have openclaw installed globally. You can then install the plugin using the openclaw plugins install command.

# Install OpenClaw
npm install -g openclaw

# Install ArmorIQ plugin
openclaw plugins install @openclaw/armoriq

For older OpenClaw versions (2026.2.x), you must install a specific version of the plugin that includes the necessary runtime patches.

npm install @armoriq/armorclaw@openclaw-2026.2

If you are developing the plugin, use the following commands to manage the lifecycle of your local build:

• npm run build: Compiles the TypeScript source into the dist/ directory.
• npm run dev: Starts the plugin in watch mode for continuous development.
• npm test: Executes the test suite.
• openclaw plugins install .: Installs the local plugin directory into your local OpenClaw instance.
• openclaw gateway run: Starts the OpenClaw gateway to test the integrated plugin.

# Build the plugin
npm run build

# Watch mode for development
npm run dev

# Run tests
npm test

# Test locally with OpenClaw
openclaw plugins install .
openclaw gateway run

To publish the plugin to the npm registry, follow these steps:

1. Log in to your ArmorIQ npm account: npm login.
2. Increment the version number: npm version patch (or minor/major).
3. Publish the package: npm publish --access public.

Note: GitHub Actions is configured to handle publishing automatically upon release.

# Login to npm (use ArmorIQ npm account)
npm login

# Bump version
npm version patch  # or minor, or major

# Publish (GitHub Actions will do this on release)
npm publish --access public

For OpenClaw version 2026.3.x and newer, use the standard plugin installation command. No patching is required.

openclaw plugins install @armoriq/armorclaw

The plugin uses environment variables for LLM access and backend routing.

LLM Configuration

Set either OPENAI_API_KEY or OPENROUTER_API_KEY in your .env file at the OpenClaw root.

ArmorIQ Backend Configuration

• ARMORIQ_API_KEY: Overrides the key stored in ~/.armoriq/credentials.json.
• ARMORIQ_ENV: Sets the environment to production (default), staging, or local.
• IAP_BACKEND_URL: The URL for the IAP backend (defaults to https://api.armoriq.ai).
• CSRG_URL: The URL for CSRG cryptographic verification (defaults to https://iap.armoriq.ai).

To run the gateway with loaded variables:

export $(grep -v '^#' .env | xargs)
pnpm dev gateway

# Example .env content
OPENAI_API_KEY=sk-proj-...
ARMORIQ_ENV=production

# Running the gateway
export $(grep -v '^#' .env | xargs)
pnpm dev gateway

After installation, verify that the plugin is correctly loaded by listing the installed plugins in OpenClaw. The output should explicitly show armorclaw | loaded.

openclaw plugins list
# Should show: armorclaw | loaded

After installation and configuration, use the following commands to verify the plugin status and start the gateway:

1. List all installed plugins to ensure armoriq is present.
2. Check specific information for the armoriq plugin.
3. Run the OpenClaw gateway.

# Check plugin is installed
openclaw plugins list

# Check plugin info
openclaw plugins info armoriq

# Start gateway
openclaw gateway run