# openclaw-control-mcp The OpenClaw control plane MCP server — operate the gateway's full management surface (cron, sessions, agents, channels, skills, config, secrets, doctor, …) from Claude Code, Cursor, or any MCP client. 143 typed tools covering every published JSON-RPC met - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.8.3 - **Author:** io.github.smurfy92 - **License:** MIT - **npm:** openclaw-control-mcp - **Source:** https://github.com/smurfy92/openclaw-control-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-17T18:26:53.234Z - **Version scanned:** 0.8.3 - **CVEs:** none found by OSV at scan time **Findings** - injection-shaped content (note) in the `openclaw_agents_create` tool: References the system prompt - injection-shaped content (note) in the `openclaw_agents_files_get` tool: References the system prompt ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `edit` — Edit a file - `bash` — Run a shell command - `openclaw_commands_list` — List the slash-commands registered in the gateway (commands the agent or operator can invoke). Wraps `commands.list`. Read-only. - `openclaw_message_action` — Trigger a message-level action (e.g. retry, mark-as-handled, attach to a session). Wraps `message.action`. Mutates gateway state. - `openclaw_agents_list` — List configured agents on the gateway (e.g. 'main', custom agents). Wraps `agents.list`. Read-only. - `openclaw_agents_create` — Create a new agent configuration. Wraps `agents.create`. Pass `agentId`, `displayName`, `model`, plus any extra fields the gateway accepts (system prompt, defau - `openclaw_agents_update` — Update an existing agent's configuration. Wraps `agents.update`. Pass `agentId` + only the fields you want to change. Schema is permissive — gateway accepts the - `openclaw_agents_delete` — Delete an agent configuration. Wraps `agents.delete`. Destructive — confirm before calling. Sessions tied to this agent may be orphaned. - `openclaw_agents_files_list` — List files attached to an agent (instructions, system files, etc.). Wraps `agents.files.list`. Read-only. - `openclaw_agents_files_get` — Fetch a specific agent file's contents (system prompt, tool definitions, etc.). Wraps `agents.files.get`. Read-only. Pass either `path` (full path including the - `openclaw_agents_files_set` — Write or overwrite an agent file. Wraps `agents.files.set`. Destructive — overwrites existing content silently. Pass `agentId`, `path` or `name`, and `content` - `openclaw_channels_status` — Get the connection status of delivery channels (Telegram, email, etc.). Wraps `channels.status`. Read-only. - `openclaw_channels_logout` — Log out / disconnect a delivery channel. Wraps `channels.logout`. Destructive — channel won't deliver until re-authenticated. Pass the channel name (e.g. 'teleg - `openclaw_chat_send` — Send a message into a chat session via the gateway's chat layer. Wire format (verified live against gateway 2026.4.12+): requires `sessionKey` (composite, e.g. - `openclaw_chat_history` — Fetch chat history for a session. Wraps `chat.history`. Wire format (verified live): requires `sessionKey`; accepts `limit`. Read-only. The pre-0.5.x `agentId`/ - `openclaw_chat_abort` — Abort an in-flight chat turn for a session. Wraps `chat.abort`. Wire format (verified live): requires `sessionKey`. Destructive — cancels running LLM call. - `openclaw_config_get` — Read the gateway's current configuration. Wraps `config.get`. Read-only. The gateway returns the full config; pass `path` to project to a sub-section client-sid - `openclaw_config_set` — Replace a config value at a given path. Wraps `config.set`. Destructive — overwrites the previous value. Prefer openclaw_config_patch for partial updates. - `openclaw_config_patch` - `openclaw_config_apply` — Apply pending config changes (commit). Wraps `config.apply`. Destructive — propagates buffered config to running components. - `openclaw_config_schema` — Get the JSON schema describing the gateway's config structure. Wraps `config.schema`. Read-only — useful before openclaw_config_set/patch to know which paths ex - `openclaw_config_schema_lookup` — Look up the schema description for a specific config path. Wraps `config.schema.lookup`. Read-only. - `openclaw_cron_list` — List configured OpenClaw cron jobs. Wraps the gateway JSON-RPC method `cron.list`. Returns jobs with name, schedule, payload kind, and enabled state. - `openclaw_cron_status` — Get the OpenClaw cron scheduler status (enabled flag, next-run timestamp, recent failures). Wraps `cron.status`. - `openclaw_cron_run` — Trigger an immediate run of a specific OpenClaw cron job by id. Wraps `cron.run`. - `openclaw_cron_runs` — List recent runs of a specific OpenClaw cron job. Wraps `cron.runs`. Pass `compact: true` to truncate each run's `summary` to 200 chars (saves tokens when scann - `openclaw_cron_remove` — Delete an OpenClaw cron job by id. Destructive — confirm before calling. Wraps `cron.remove`. - `openclaw_cron_add` — Create a new OpenClaw cron job. Wraps `cron.add`. Field names match the gateway wire format (verified by the Control panel SPA + live calls), NOT the README pla - `openclaw_cron_update` — Update an existing OpenClaw cron job in place. Wraps `cron.update`. Avoids the remove + re-add dance when you just want to change schedule, timeout, payload, or - `openclaw_cron_add_weekly` — Create a cron job that fires once a week at a fixed local time. Synthesizes a `cron`-kind schedule and an `agentTurn` payload, then calls `cron.add`. Pass `dayO - `openclaw_cron_add_daily` — Create a cron job that fires every day at a fixed local time. Synthesizes the `cron`-kind schedule + `agentTurn` payload. Pass `hour`, `minute`, `tz`, `message` - `openclaw_cron_add_every` — Create a cron job that fires every N minutes/hours regardless of clock time. Synthesizes an `every`-kind schedule. Pass either `intervalMinutes` or `intervalHou - `openclaw_cron_add_once` — Create a one-shot reminder/job that fires exactly once at a given absolute timestamp, then auto-deletes. Synthesizes an `exact`-kind schedule with `deleteAfterR - `openclaw_device_status` — Show this MCP's local device identity, pairing status, current scopes (if any), and any pending pairing requestId. Triggers a fresh connect attempt, so it doubl - `openclaw_device_pair_list` - `openclaw_device_pair_approve` - `openclaw_device_pair_reject` - `openclaw_device_pair_remove` - `openclaw_device_token_revoke` - `openclaw_device_token_rotate` ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"openclaw-control\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"openclaw-control-mcp\"\n ]\n }\n }\n}" ``` ## Blast radius Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on your machine. - Floor 40, ceiling 64 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/openclaw-control-mcp - Install plan: https://forgeregistry.com/api/v1/packages/openclaw-control-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/openclaw-control-mcp - HTML page: https://forgeregistry.com/registry/openclaw-control-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.