cerone-openclaw-plugin : check OpenClaw tool calls before they run

#langchain #agents

I’ve been working on cerone-openclaw-plugin, a native OpenClaw plugin that checks tool calls with Cerone before execution. (Cerone is an AI agent runtime.)

OpenClaw agents can read files, write files, call APIs, and trigger other tools.

This plugin adds a pre-execution check layer using OpenClaw’s existing before_tool_call hook, without modifying OpenClaw core.

What it does:

loads as a normal third-party OpenClaw plugin
intercepts tool calls through before_tool_call
sends the tool name, parameters, and runtime context to Cerone
gets back a decision: approved flagged rejected
maps that into OpenClaw behavior: approved -> tool runs flagged -> require approval by default rejected -> block the tool call

Example shape:

{
  "plugins": {
    "entries": {
      "cerone-openclaw-plugin": {
        "enabled": true,
        "config": {
          "trialMode": "auto",
          "flaggedBehavior": "requireApproval",
          "networkFailureBehavior": "allow",
          "agentPurpose": "Read repository files and inspect code inside OpenClaw for software engineering tasks.",
          "agentCapabilities": ["file_read", "file_write", "network_access", "api_call"]
        }
      }
    }
  }
}