Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
AgentGate is a middleware layer that intercepts every tool call an OpenClaw agent makes before it executes. It evaluates each call against regex-based policies stored in Firestore and returns ALLOW, DENY, or REQUIRE_APPROVAL. Blocked actions return a structured error; approvals pause execution until an operator responds.
Policies are enforced before tool execution, so a hallucinating agent cannot bypass rules by retrying or rephrasing the same call.
When to use it
- Blocking destructive bash commands like rm -rf in automated agent pipelines
- Requiring human approval before Stripe charges exceed a set dollar threshold
- Restricting outbound HTTP requests to a whitelist of approved domains
- Auditing every agent tool call in real time with a live Firestore log
- Preventing agents from sending unauthorized emails via SMTP or SendGrid
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Process a $500 refund for customer order #9821
- 1Agent invokes the stripe tool with a charge amount of 50000
- 2AgentGate intercepts the call and POSTs the tool name and serialized arguments to the Firebase Cloud Function
- 3Function validates the API key, evaluates regex policies, and matches the amount against the approval threshold rule
- 4Decision is REQUIRE_APPROVAL; a Telegram webhook fires to the operator with Approve/Deny buttons
- 5Operator approves; Firestore updates and the agent resumes execution
Stripe refund completes after human approval, with the full interaction recorded in the audit log
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.